| # Rules used in the test suite. This allows us to change the |
| # main ruleset without breaking the test suite. |
| |
| # <@LICENSE> |
| # Licensed to the Apache Software Foundation (ASF) under one or more |
| # contributor license agreements. See the NOTICE file distributed with |
| # this work for additional information regarding copyright ownership. |
| # The ASF licenses this file to you under the Apache License, Version 2.0 |
| # (the "License"); you may not use this file except in compliance with |
| # the License. You may obtain a copy of the License at: |
| # |
| # http://www.apache.org/licenses/LICENSE-2.0 |
| # |
| # Unless required by applicable law or agreed to in writing, software |
| # distributed under the License is distributed on an "AS IS" BASIS, |
| # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| # See the License for the specific language governing permissions and |
| # limitations under the License. |
| # </@LICENSE> |
| |
| # copied from 10_default_prefs.cf |
| clear_report_template |
| report Spam detection software, running on the system "_HOSTNAME_", has |
| report identified this incoming email as possible spam. The original message |
| report has been attached to this so you can view it (if it isn't spam) or label |
| report similar future email. If you have any questions, see |
| report _CONTACTADDRESS_ for details. |
| report |
| report Content preview: _PREVIEW_ |
| report |
| report Content analysis details: (_SCORE_ points, _REQD_ required) |
| report |
| report " pts rule name description" |
| report ---- ---------------------- -------------------------------------------------- |
| report _SUMMARY_ |
| |
| report_contact @@CONTACT_ADDRESS@@ |
| |
| clear_unsafe_report_template |
| unsafe_report The original message was not completely plain text, and may be unsafe to |
| unsafe_report open with some email clients; in particular, it may contain a virus, |
| unsafe_report or confirm that your address can receive spam. If you wish to view |
| unsafe_report it, it may be safer to save it to a file and open it with an editor. |
| |
| clear_headers |
| add_header all Checker-Version SpamAssassin _VERSION_ (_SUBVERSION_) on _HOSTNAME_ |
| add_header spam Flag _YESNOCAPS_ |
| add_header all Level _STARS(*)_ |
| add_header all Status "_YESNO_, score=_SCORE_ required=_REQD_ tests=_TESTS_ autolearn=_AUTOLEARN_ version=_VERSION_" |
| |
| clear_originating_ip_headers |
| originating_ip_headers X-Yahoo-Post-IP X-Originating-IP X-Apparently-From |
| originating_ip_headers X-SenderIP |
| |
| required_score 5 |
| ok_locales all |
| ifplugin Mail::SpamAssassin::Plugin::TextCat |
| ok_languages all |
| endif # Mail::SpamAssassin::Plugin::TextCat |
| |
| ifplugin Mail::SpamAssassin::Plugin::AutoLearnThreshold |
| bayes_auto_learn_threshold_nonspam 0.1 |
| bayes_auto_learn_threshold_spam 12.0 |
| endif # Mail::SpamAssassin::Plugin::AutoLearnThreshold |
| |
| bayes_auto_learn 1 |
| |
| report_safe 1 |
| |
| |
| header TEST_NOREALNAME From =~ /^["\s]*\<?\S+\@\S+\>?\s*$/ |
| describe TEST_NOREALNAME From: does not include a real name |
| score TEST_NOREALNAME 5 |
| |
| header TEST_ENDSNUMS From:addr =~ /\D\d{8,}\@/i |
| describe TEST_ENDSNUMS From: ends in many numbers |
| score TEST_ENDSNUMS 5 |
| |
| header TEST_FORGED_YAHOO_RCVD eval:check_for_forged_yahoo_received_headers() |
| describe TEST_FORGED_YAHOO_RCVD 'From' yahoo.com does not match 'Received' headers |
| score TEST_FORGED_YAHOO_RCVD 5 |
| |
| uri TEST_NORMAL_HTTP_TO_IP m{^https?://\d+\.\d+\.\d+\.\d+}i |
| describe TEST_NORMAL_HTTP_TO_IP Uses a dotted-decimal IP address in URL |
| score TEST_NORMAL_HTTP_TO_IP 5 |
| |
| body TEST_EXCUSE_12 /this (?:e?-?mail|message) (?:(?:has )?reached|was sent to) you in error/i |
| describe TEST_EXCUSE_12 Nobody's perfect |
| score TEST_EXCUSE_12 5 |
| |
| body TEST_EXCUSE_4 /To Be Removed,? Please/i |
| describe TEST_EXCUSE_4 Claims you can be removed from the list |
| score TEST_EXCUSE_4 5 |
| |
| header TEST_INVALID_DATE Date !~ /^\s*(?:(?i:Mon|Tue|Wed|Thu|Fri|Sat|Sun),\s+)?[0-3\s]?[0-9]\s+(?i:Jan|Feb|Ma[ry]|Apr|Ju[nl]|Aug|Sep|Oct|Nov|Dec)\s+(?:[12][901])?[0-9]{2}\s+[0-2]?[0-9](?:\:[0-5][0-9]){1,2}\s+(?:[AP]M\s+)?(?:[+-][0-9]{4}|UT|[A-Z]{2,3}T)(?:\s+\(.*\))?\s*$/ [if-unset: Wed, 31 Jul 2002 16:41:57 +0200] |
| describe TEST_INVALID_DATE Invalid Date: header (not RFC 2822) |
| score TEST_INVALID_DATE 5 |
| |
| header TEST_MSGID_OUTLOOK_INVALID eval:check_outlook_message_id() |
| describe TEST_MSGID_OUTLOOK_INVALID Message-Id is fake (in Outlook Express format) |
| score TEST_MSGID_OUTLOOK_INVALID 5 |
| |
| header MISSING_HB_SEP eval:check_msg_parse_flags('missing_head_body_separator') |
| describe MISSING_HB_SEP Missing blank line between message header and body |
| tflags MISSING_HB_SEP userconf |
| |
| header X_MESSAGE_INFO exists:X-Message-Info |
| describe X_MESSAGE_INFO Bulk email fingerprint (X-Message-Info) found |
| |
| header SORTED_RECIPS eval:sorted_recipients() |
| describe SORTED_RECIPS Recipient list is sorted by address |
| |
| header SUSPICIOUS_RECIPS eval:similar_recipients('0.65','undef') |
| describe SUSPICIOUS_RECIPS Similar addresses in recipient list |
| |
| body GTUBE /XJS\*C4JDBQADN1\.NSBN3\*2IDNEN\*GTUBE-STANDARD-ANTI-UBE-TEST-EMAIL\*C\.34X/ |
| describe GTUBE Generic Test for Unsolicited Bulk Email |
| score GTUBE 1000 |
| tflags GTUBE userconf noautolearn |
| |
| body BAYES_99 eval:check_bayes('0.99', '1.00') |
| tflags BAYES_99 learn |
| describe BAYES_99 Bayes spam probability is 99 to 100% |
| score BAYES_99 0 0 3.5 3.5 |
| |
| ifplugin Mail::SpamAssassin::Plugin::WLBLEval |
| #header USER_IN_WHITELIST eval:check_from_in_whitelist() |
| #tflags USER_IN_WHITELIST userconf nice noautolearn |
| #score USER_IN_WHITELIST -100.000 |
| header USER_IN_DEF_WHITELIST eval:check_from_in_default_whitelist() |
| tflags USER_IN_DEF_WHITELIST userconf nice noautolearn |
| score USER_IN_DEF_WHITELIST -15.000 |
| #header USER_IN_WHITELIST_TO eval:check_to_in_whitelist() |
| #tflags USER_IN_WHITELIST_TO userconf nice noautolearn |
| #score USER_IN_WHITELIST_TO -6.000 |
| header USER_IN_BLACKLIST eval:check_from_in_blacklist() |
| tflags USER_IN_BLACKLIST userconf noautolearn |
| score USER_IN_BLACKLIST 100.000 |
| header USER_IN_BLACKLIST_TO eval:check_to_in_blacklist() |
| tflags USER_IN_BLACKLIST_TO userconf noautolearn |
| score USER_IN_BLACKLIST_TO 10.000 |
| endif # Mail::SpamAssassin::Plugin::WLBLEval |
| |
| ifplugin Mail::SpamAssassin::Plugin::WhiteListSubject |
| header SUBJECT_IN_WHITELIST eval:check_subject_in_whitelist() |
| tflags SUBJECT_IN_WHITELIST userconf nice noautolearn |
| header SUBJECT_IN_BLACKLIST eval:check_subject_in_blacklist() |
| tflags SUBJECT_IN_BLACKLIST userconf noautolearn |
| score SUBJECT_IN_BLACKLIST 100 |
| score SUBJECT_IN_WHITELIST -100 |
| endif # Mail::SpamAssassin::Plugin::WhiteListSubject |
| |
| header __HAS_MSGID MESSAGEID =~ /\S/ |
| header __SANE_MSGID MESSAGEID =~ /^<[^<>\\ \t\n\r\x0b\x80-\xff]+\@[^<>\\ \t\n\r\x0b\x80-\xff]+>\s*$/m |
| header __MSGID_COMMENT MESSAGEID =~ /\(.*\)/m |
| meta INVALID_MSGID __HAS_MSGID && !(__SANE_MSGID || __MSGID_COMMENT) |
| describe INVALID_MSGID Message-Id is not valid, according to RFC 2822 |
| score INVALID_MSGID 2.999 2.603 2.489 1.900 |
| |
| header TEST_MSGID_SPAM_CAPS Message-ID =~ /^\s*<?[A-Z]+\@(?!(?:mailcity|whowhere)\.com)/ |
| score TEST_MSGID_SPAM_CAPS 5 |
| |
| header INVALID_DATE Date !~ /^\s*(?:(?i:Mon|Tue|Wed|Thu|Fri|Sat|Sun),\s)?\s*(?:[12]\d|3[01]|0?[1-9])\s+(?i:Jan|Feb|Ma[ry]|Apr|Ju[nl]|Aug|Sep|Oct|Nov|Dec)\s+(?:19[7-9]\d|2\d{3})\s+(?:[01]?\d|2[0-3])\:[0-5]\d(?::(?:[0-5]\d|60))?(?:\s+[AP]M)?(?:\s+(?:[+-][0-9]{4}|UT|[A-Z]{2,3}T|0000 GMT|"GMT"))?(?:\s*\(.*\))?\s*$/m [if-unset: Wed, 31 Jul 2002 16:41:57 +0200] |
| describe INVALID_DATE Invalid Date: header (not RFC 2822) |
| score INVALID_DATE 2.303 1.651 1.329 1.245 |
| |
| ifplugin Mail::SpamAssassin::Plugin::SPF |
| header SPF_PASS eval:check_for_spf_pass() |
| header SPF_NEUTRAL eval:check_for_spf_neutral() |
| header SPF_FAIL eval:check_for_spf_fail() |
| header SPF_SOFTFAIL eval:check_for_spf_softfail() |
| header SPF_HELO_PASS eval:check_for_spf_helo_pass() |
| header SPF_HELO_NEUTRAL eval:check_for_spf_helo_neutral() |
| header SPF_HELO_FAIL eval:check_for_spf_helo_fail() |
| header SPF_HELO_SOFTFAIL eval:check_for_spf_helo_softfail() |
| tflags SPF_PASS nice userconf net |
| tflags SPF_HELO_PASS nice userconf net |
| tflags SPF_NEUTRAL net |
| tflags SPF_FAIL net |
| tflags SPF_SOFTFAIL net |
| tflags SPF_HELO_NEUTRAL net |
| tflags SPF_HELO_FAIL net |
| tflags SPF_HELO_SOFTFAIL net |
| header USER_IN_SPF_WHITELIST eval:check_for_spf_whitelist_from() |
| tflags USER_IN_SPF_WHITELIST userconf nice noautolearn |
| header USER_IN_DEF_SPF_WL eval:check_for_def_spf_whitelist_from() |
| tflags USER_IN_DEF_SPF_WL userconf nice noautolearn |
| endif # Mail::SpamAssassin::Plugin::SPF |
| |
| ifplugin Mail::SpamAssassin::Plugin::AWL |
| header AWL eval:check_from_in_auto_whitelist() |
| describe AWL From: address is in the auto white-list |
| tflags AWL userconf noautolearn |
| priority AWL 1000 |
| endif # Mail::SpamAssassin::Plugin::AWL |
| |
| redirector_pattern /^http:\/\/chkpt\.zdnet\.com\/chkpt\/\w+\/(.*)$/i |
| redirector_pattern /^http:\/\/www(?:\d+)?\.nate\.com\/r\/\w+\/(.*)$/i |
| redirector_pattern /^http:\/\/.+\.gov\/(?:.*\/)?externalLink\.jhtml\?.*url=(.*?)(?:&.*)?$/i |
| redirector_pattern /^http:\/\/redir\.internet\.com\/.+?\/.+?\/(.*)$/i |
| redirector_pattern /^http:\/\/(?:.*?\.)?adtech\.de\/.*(?:;|\|)link=(.*?)(?:;|$)/i |
| redirector_pattern m'^http.*?/redirect\.php\?.*(?<=[?&])goto=(.*?)(?:$|[&\#])'i |
| redirector_pattern m'^https?:/*(?:[^/]+\.)?emf\d\.com/r\.cfm.*?&r=(.*)'i |
| |
| ifplugin Mail::SpamAssassin::Plugin::DCC |
| full DCC_CHECK eval:check_dcc() |
| describe DCC_CHECK Detected as bulk mail by DCC (dcc-servers.net) |
| tflags DCC_CHECK net |
| reuse DCC_CHECK |
| endif |
| |
| ifplugin Mail::SpamAssassin::Plugin::DKIM |
| full DKIM_SIGNED eval:check_dkim_signed() |
| full DKIM_VALID eval:check_dkim_valid() |
| full DKIM_VALID_AU eval:check_dkim_valid_author_sig() |
| header DKIM_ADSP_NXDOMAIN eval:check_dkim_adsp('N') |
| header DKIM_ADSP_DISCARD eval:check_dkim_adsp('D') |
| header DKIM_ADSP_ALL eval:check_dkim_adsp('A') |
| header DKIM_ADSP_CUSTOM_LOW eval:check_dkim_adsp('1') |
| header DKIM_ADSP_CUSTOM_MED eval:check_dkim_adsp('2') |
| header DKIM_ADSP_CUSTOM_HIGH eval:check_dkim_adsp('3') |
| adsp_override sa-test-nxd.spamassassin.org nxdomain |
| adsp_override sa-test-unk.spamassassin.org unknown |
| adsp_override sa-test-all.spamassassin.org all |
| adsp_override sa-test-dis.spamassassin.org discardable |
| adsp_override sa-test-di2.spamassassin.org |
| endif |
| |
| ifplugin Mail::SpamAssassin::Plugin::Shortcircuit |
| header SHORTCIRCUIT eval:check_shortcircuit() |
| describe SHORTCIRCUIT Not all rules were run, due to a shortcircuited rule |
| tflags SHORTCIRCUIT userconf noautolearn |
| endif |
| |
| |
| ifplugin Mail::SpamAssassin::Plugin::Razor2 |
| |
| full RAZOR2_CHECK eval:check_razor2() |
| describe RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) |
| tflags RAZOR2_CHECK net |
| |
| endif |
