You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by pd...@apache.org on 2019/04/27 23:50:38 UTC
svn commit: r1858299 - in /spamassassin/trunk/rulesrc/sandbox/pds: 20_gov.cf
20_ntld.cf
Author: pds
Date: Sat Apr 27 23:50:38 2019
New Revision: 1858299
URL: http://svn.apache.org/viewvc?rev=1858299&view=rev
Log:
More NTLD rules for qa
Modified:
spamassassin/trunk/rulesrc/sandbox/pds/20_gov.cf
spamassassin/trunk/rulesrc/sandbox/pds/20_ntld.cf
Modified: spamassassin/trunk/rulesrc/sandbox/pds/20_gov.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/pds/20_gov.cf?rev=1858299&r1=1858298&r2=1858299&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/pds/20_gov.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/pds/20_gov.cf Sat Apr 27 23:50:38 2019
@@ -13,5 +13,17 @@ describe FROM_GOV_SPOOF From Government
score FROM_GOV_SPOOF 1.0 # limit
reuse FROM_GOV_SPOOF
+meta FROM_GOV_DKIM_AU DKIM_VALID_AU && __FROM_ADDRLIST_GOV
+tflags FROM_GOV_DKIM_AU nice publish
+describe FROM_GOV_DKIM_AU From Government address and DKIM signed
+score FROM_GOV_DKIM_AU -1.0 # limit
+reuse FROM_GOV_DKIM_AU
+
+meta FROM_GOV_REPLYTO_FREEMAIL FREEMAIL_FORGED_REPLYTO && __FROM_ADDRLIST_GOV && !DKIM_VALID_AU
+tflags FROM_GOV_REPLYTO_FREEMAIL publish
+describe FROM_GOV_REPLYTO_FREEMAIL From Government domain but ReplyTo is FREEMAIL
+score FROM_GOV_REPLYTO_FREEMAIL 2.0
+reuse FROM_GOV_REPLYTO_FREEMAIL
+
endif
endif
Modified: spamassassin/trunk/rulesrc/sandbox/pds/20_ntld.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/pds/20_ntld.cf?rev=1858299&r1=1858298&r2=1858299&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/pds/20_ntld.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/pds/20_ntld.cf Sat Apr 27 23:50:38 2019
@@ -51,5 +51,20 @@ describe SEO_SUSP_NTLD SEO offer from su
score SEO_SUSP_NTLD 1.2 # limit
reuse SEO_SUSP_NTLD
+body __PDS_THIS_IS_ADV /This is an advertisement\./
+reuse __PDS_THIS_IS_ADV
+
+meta THIS_IS_ADV_SUSP_NTLD FROM_SUSPICIOUS_NTLD && __PDS_THIS_IS_ADV
+tflags THIS_IS_ADV_SUSP_NTLD publish
+describe THIS_IS_ADV_SUSP_NTLD This is an advertisement from a suspicious TLD
+score THIS_IS_ADV_SUSP_NTLD 1.5 # limit
+reuse THIS_IS_ADV_SUSP_NTLD
+
+meta BULK_RE_SUSP_NTLD __SUBJ_RE && __ML1 && FROM_SUSPICIOUS_NTLD
+tflags BULK_RE_SUSP_NTLD publish
+describe BULK_RE_SUSP_NTLD Precedence bulk and RE: from a suspicious TLD
+score BULK_RE_SUSP_NTLD 1.0 # limit
+reuse BULK_RE_SUSP_NTLD
+
endif
endif