62 lines
1.6 KiB
Plaintext
62 lines
1.6 KiB
Plaintext
|
group "headers" {
|
||
|
|
description = "Various headers checks";
|
||
|
|
max_score = 8.0;
|
||
|
|
|
||
|
|
symbols = {
|
||
|
|
"FORGED_SENDER" {
|
||
|
|
weight = 0.3;
|
||
|
|
description = "Sender is forged (different From: header and smtp MAIL FROM: addresses)";
|
||
|
|
}
|
||
|
|
"R_MIXED_CHARSET" {
|
||
|
|
weight = 5.0;
|
||
|
|
description = "Mixed characters in a message";
|
||
|
|
one_shot = true;
|
||
|
|
}
|
||
|
|
"R_MIXED_CHARSET_URL" {
|
||
|
|
weight = 7.0;
|
||
|
|
description = "Mixed characters in a URL inside message";
|
||
|
|
one_shot = true;
|
||
|
|
}
|
||
|
|
"FORGED_RECIPIENTS" {
|
||
|
|
weight = 2.0;
|
||
|
|
description = "Recipients are not the same as RCPT TO: mail command";
|
||
|
|
}
|
||
|
|
"FORGED_RECIPIENTS_MAILLIST" {
|
||
|
|
weight = 0.0;
|
||
|
|
description = "Recipients are not the same as RCPT TO: mail command, but a message from a maillist";
|
||
|
|
}
|
||
|
|
"FORGED_SENDER_MAILLIST" {
|
||
|
|
weight = 0.0;
|
||
|
|
description = "Sender is not the same as MAIL FROM: envelope, but a message is from a maillist";
|
||
|
|
}
|
||
|
|
"ONCE_RECEIVED" {
|
||
|
|
weight = 0.1;
|
||
|
|
description = "One received header in a message";
|
||
|
|
}
|
||
|
|
"RDNS_NONE" {
|
||
|
|
weight = 1.0;
|
||
|
|
description = "Cannot resolve reverse DNS for sender's IP";
|
||
|
|
}
|
||
|
|
"RDNS_DNSFAIL" {
|
||
|
|
weight = 0.0;
|
||
|
|
description = "PTR verification DNS error";
|
||
|
|
}
|
||
|
|
"ONCE_RECEIVED_STRICT" {
|
||
|
|
weight = 4.0;
|
||
|
|
description = "One received header with 'bad' patterns inside";
|
||
|
|
}
|
||
|
|
"DIRECT_TO_MX" {
|
||
|
|
weight = 0.0;
|
||
|
|
description = "Message has been directly delivered from MUA to local MX";
|
||
|
|
}
|
||
|
|
"MAILLIST" {
|
||
|
|
weight = -0.2;
|
||
|
|
description = "Message seems to be from maillist";
|
||
|
|
}
|
||
|
|
"BOUNCE" {
|
||
|
|
weight = -0.1;
|
||
|
|
description = "(Non) Delivery Status Notification";
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|