| if (version >= 3.004002) |
| ifplugin Mail::SpamAssassin::Plugin::WLBLEval |
| |
| enlist_addrlist (PAYPAL) *@paypal.com *@paypal.co.uk *@paypal.de *@paypal.com.au *@paypal.it |
| enlist_addrlist (PAYPAL) *@paypal.es *@paypal.fr *@paypal.de *@paypal.com.hk |
| enlist_addrlist (PAYPAL) *@*.paypal.com *@*.paypal.co.uk |
| |
| header __FROM_ADDRLIST_PAYPAL eval:check_from_in_list('PAYPAL') |
| reuse __FROM_ADDRLIST_PAYPAL |
| |
| meta FROM_PAYPAL_SPOOF !__NOT_SPOOFED && __FROM_ADDRLIST_PAYPAL && (! NO_RELAYS && ! ALL_TRUSTED) |
| tflags FROM_PAYPAL_SPOOF publish net |
| describe FROM_PAYPAL_SPOOF From PayPal domain but matches SPOOFED |
| score FROM_PAYPAL_SPOOF 1.6 # limit |
| reuse FROM_PAYPAL_SPOOF |
| |
| #meta FROM_PAYPAL_REPLYTO_FREEMAIL FREEMAIL_FORGED_REPLYTO && __FROM_ADDRLIST_PAYPAL && !DKIM_VALID_AU |
| #tflags FROM_PAYPAL_REPLYTO_FREEMAIL publish net |
| #describe FROM_PAYPAL_REPLYTO_FREEMAIL From PayPal domain but ReplyTo is FREEMAIL |
| #score FROM_PAYPAL_REPLYTO_FREEMAIL 2.0 |
| #reuse FROM_PAYPAL_REPLYTO_FREEMAIL |
| |
| enlist_addrlist (BANKS) *@abbey.co.uk *@abbey.com *@abbeyinternational.com *@abbeyinternational.co.uk *@abbeynational.com *@abbeynational.co.uk |
| enlist_addrlist (BANKS) *@allianceleicester.com *@allianceleicester.co.uk *@alliance-leicester.com *@alliance-leicester.co.uk |
| enlist_addrlist (BANKS) *@bankofamerica.com *@bankofamerica.co.uk |
| enlist_addrlist (BANKS) *@barclaycard.com *@barclays.com |
| enlist_addrlist (BANKS) *@citibank.com |
| enlist_addrlist (BANKS) *@firstdirect.com *@firstdirect.co.uk |
| enlist_addrlist (BANKS) *@halifax.com *@halifax.co.uk *@halifax-online.co.uk *@halifax-online.com |
| enlist_addrlist (BANKS) *@hbos.com *@hbos.co.uk |
| enlist_addrlist (BANKS) *@hsbc.com *@hsbc.co.uk *@hsbc.hk *@hsbcgroup.com *@hsbcgroup.co.uk |
| enlist_addrlist (BANKS) *@lloydstsb.com *@lloydstsb.co.uk *@lloyds.com |
| enlist_addrlist (BANKS) *@mbna.com |
| enlist_addrlist (BANKS) *@nationwide.com *@nationwide.co.uk |
| enlist_addrlist (BANKS) *@natwest.com *@natwest.co.uk |
| enlist_addrlist (BANKS) *@santander.com *@santander.co.uk |
| enlist_addrlist (BANKS) *@standardbank.co.za |
| enlist_addrlist (BANKS) *@ybonline.co.uk *@ybonline.com |
| |
| header __FROM_ADDRLIST_BANKS eval:check_from_in_list('BANKS') |
| reuse __FROM_ADDRLIST_BANKS |
| |
| meta FROM_BANK_NOAUTH __FROM_ADDRLIST_BANKS && (! NO_RELAYS && ! ALL_TRUSTED) && (! SPF_PASS && ! DKIM_VALID_AU) |
| tflags FROM_BANK_NOAUTH publish net |
| describe FROM_BANK_NOAUTH From Bank domain but no SPF or DKIM |
| score FROM_BANK_NOAUTH 1.0 # limit |
| reuse FROM_BANK_NOAUTH |
| |
| endif |
| endif |
| |
