| # SpamAssassin rules file |
| |
| # Rawbody matches qp/base64 etc decoded long html, |
| # need full here to check pristine message lines!! |
| #rawbody __LONGLINE /^.{998}[^\r\n]/ |
| # To check only body |
| #full __LONGLINE /^(?=.*?\r?\n\r?\n.*?(?<=\n)[^\r\n]{998})/s |
| # Might as well include headers, they are "SMTP lines" as well |
| full __LONGLINE /^[^\r\n]{998}/m |
| meta LONGLINE __LONGLINE |
| describe LONGLINE Line length exceeds 998 character limit, RFC 5322 |
| |
| header RP_8BIT Return-Path:raw =~ /[^\000-\177]/ |
| describe RP_8BIT Return-Path contains 8-bit characters with high bit on |
| |
| header RP_LASTNAME Return-Path =~ /LAST_NAME/m |
| describe RP_LASTNAME Return-Path says LAST_NAME literally |
| |
| header RP_UNDERLINE Return-Path:addr =~ /^_/m |
| describe RP_UNDERLINE Return-Path address starts with an underline |
| |
| header RP_MINUS Return-Path:addr =~ /^-/m |
| describe RP_MINUS Return-Path address starts with a minus |
| |
| header CR_IN_SUBJ Subject:raw =~ /\015/ |
| describe CR_IN_SUBJ Subject contains a CR character |
| |
| # must use :raw to avoid seeing a decoded display name |
| header FROM_UNBAL1 From:raw =~ / < [^>]* $/xm |
| describe FROM_UNBAL1 From with unbalanced angle brackets, '>' missing |
| |
| header FROM_UNBAL2 From:raw =~ /^ [^<]* > /xm |
| describe FROM_UNBAL2 From with unbalanced angle brackets, '<' missing |
| |
| header FROM_WSP_TRAIL From:raw =~ /< [^>]* \s > [^<>]* \z/xm |
| describe FROM_WSP_TRAIL Trailing whitespace before '>' in From header field |
| |
| header FROM_WSP_LEAD From:raw =~ /< \s+ [^>\s] [^>]* > [^<>]* \z/xm |
| describe FROM_WSP_LEAD Leading whitespace after '<' in From header field |
| |
| header MSGID_WSP_TRAIL Message-ID:raw =~ /< [^>]* \s > [^<>]* \z/xm |
| describe MSGID_WSP_TRAIL Trailing whitespace before '>' in Message-ID header |
| |
| header __MSGID_NOFQDN1 Message-ID =~ /<[^\@]*>/m |
| meta MSGID_NOFQDN1 __MSGID_NOFQDN1 |
| describe MSGID_NOFQDN1 Message-ID with no domain name |
| header __MSGID_NOFQDN2 Message-ID =~ /<.*\@[A-Za-z0-9]+>/m |
| meta MSGID_NOFQDN2 __MSGID_NOFQDN2 |
| describe MSGID_NOFQDN2 Message-ID without a fully-qualified domain name |
| |
| #score LONGLINE 0.5 |
| #score RP_8BIT 2.8 |
| #score RP_LASTNAME 4 |
| #score RP_UNDERLINE 3 |
| #score RP_MINUS 2 |
| #score CR_IN_SUBJ 4 |
| #score FROM_UNBAL1 3 |
| #score FROM_UNBAL2 3 |
| #score FROM_WSP_TRAIL 2 |
| #score FROM_WSP_LEAD 2 |
| #score MSGID_WSP_TRAIL 2 |
| #score MSGID_NOFQDN1 1 |
| #score MSGID_NOFQDN2 1 |
