You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by km...@apache.org on 2020/01/29 19:06:00 UTC
svn commit: r1873332 [10/17] - in /spamassassin/site/full/3.4.x: ./ doc/
Added: spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_DKIM.html
URL: http://svn.apache.org/viewvc/spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_DKIM.html?rev=1873332&view=auto
==============================================================================
--- spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_DKIM.html (added)
+++ spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_DKIM.html Wed Jan 29 19:05:59 2020
@@ -0,0 +1,263 @@
+<?xml version="1.0" ?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<title></title>
+<meta http-equiv="content-type" content="text/html; charset=utf-8" />
+<link rev="made" href="mailto:root@localhost" />
+</head>
+
+<body style="background-color: white">
+
+
+
+<ul id="index">
+ <li><a href="#NAME">NAME</a></li>
+ <li><a href="#SYNOPSIS">SYNOPSIS</a></li>
+ <li><a href="#DESCRIPTION">DESCRIPTION</a></li>
+ <li><a href="#TAGS">TAGS</a></li>
+ <li><a href="#SEE-ALSO">SEE ALSO</a></li>
+ <li><a href="#USER-SETTINGS">USER SETTINGS</a></li>
+ <li><a href="#ADMINISTRATOR-SETTINGS">ADMINISTRATOR SETTINGS</a></li>
+</ul>
+
+<h1 id="NAME">NAME</h1>
+
+<p>Mail::SpamAssassin::Plugin::DKIM - perform DKIM verification tests</p>
+
+<h1 id="SYNOPSIS">SYNOPSIS</h1>
+
+<pre><code> loadplugin Mail::SpamAssassin::Plugin::DKIM [/path/to/DKIM.pm]</code></pre>
+
+<p>Taking into account signatures from any signing domains:</p>
+
+<pre><code> full DKIM_SIGNED eval:check_dkim_signed()
+ full DKIM_VALID eval:check_dkim_valid()
+ full DKIM_VALID_AU eval:check_dkim_valid_author_sig()
+ full DKIM_VALID_EF eval:check_dkim_valid_envelopefrom()</code></pre>
+
+<p>Taking into account signatures from specified signing domains only: (quotes may be omitted on domain names consisting only of letters, digits, dots, and minus characters)</p>
+
+<pre><code> full DKIM_SIGNED_MY1 eval:check_dkim_signed('dom1','dom2',...)
+ full DKIM_VALID_MY1 eval:check_dkim_valid('dom1','dom2',...)
+ full DKIM_VALID_AU_MY1 eval:check_dkim_valid_author_sig('d1','d2',...)
+
+ full __DKIM_DEPENDABLE eval:check_dkim_dependable()</code></pre>
+
+<p>Author Domain Signing Practices (ADSP) from any author domains:</p>
+
+<pre><code> header DKIM_ADSP_NXDOMAIN eval:check_dkim_adsp('N')
+ header DKIM_ADSP_ALL eval:check_dkim_adsp('A')
+ header DKIM_ADSP_DISCARD eval:check_dkim_adsp('D')
+ header DKIM_ADSP_CUSTOM_LOW eval:check_dkim_adsp('1')
+ header DKIM_ADSP_CUSTOM_MED eval:check_dkim_adsp('2')
+ header DKIM_ADSP_CUSTOM_HIGH eval:check_dkim_adsp('3')</code></pre>
+
+<p>Author Domain Signing Practices (ADSP) from specified author domains only:</p>
+
+<pre><code> header DKIM_ADSP_MY1 eval:check_dkim_adsp('*','dom1','dom2',...)
+
+ describe DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
+ describe DKIM_VALID Message has at least one valid DKIM or DK signature
+ describe DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain
+ describe DKIM_VALID_EF Message has a valid DKIM or DK signature from envelope-from domain
+ describe __DKIM_DEPENDABLE A validation failure not attributable to truncation
+
+ describe DKIM_ADSP_NXDOMAIN Domain not in DNS and no valid author domain signature
+ describe DKIM_ADSP_ALL Domain signs all mail, no valid author domain signature
+ describe DKIM_ADSP_DISCARD Domain signs all mail and suggests discarding mail with no valid author domain signature, no valid author domain signature
+ describe DKIM_ADSP_CUSTOM_LOW adsp_override is CUSTOM_LOW, no valid author domain signature
+ describe DKIM_ADSP_CUSTOM_MED adsp_override is CUSTOM_MED, no valid author domain signature
+ describe DKIM_ADSP_CUSTOM_HIGH adsp_override is CUSTOM_HIGH, no valid author domain signature</code></pre>
+
+<p>For compatibility with pre-3.3.0 versions, the following are synonyms:</p>
+
+<pre><code> OLD: eval:check_dkim_verified = NEW: eval:check_dkim_valid
+ OLD: eval:check_dkim_signall = NEW: eval:check_dkim_adsp('A')
+ OLD: eval:check_dkim_signsome = NEW: redundant, semantically always true</code></pre>
+
+<p>The __DKIM_DEPENDABLE eval rule deserves an explanation. The rule yields true when signatures are supplied by a caller, OR ELSE when signatures are obtained by this plugin AND either there are no signatures OR a rule __TRUNCATED was false. In other words: __DKIM_DEPENDABLE is true when failed signatures can not be attributed to message truncation when feeding a message to SpamAssassin. It can be consulted to prevent false positives on large but truncated messages with poor man's implementation of ADSP by hand-crafted rules.</p>
+
+<h1 id="DESCRIPTION">DESCRIPTION</h1>
+
+<p>This SpamAssassin plugin implements DKIM lookups as described by the RFC 4871, as well as historical DomainKeys lookups, as described by RFC 4870, thanks to the support for both types of signatures by newer versions of module Mail::DKIM.</p>
+
+<p>It requires the <code>Mail::DKIM</code> CPAN module to operate. Many thanks to Jason Long for that module.</p>
+
+<h1 id="TAGS">TAGS</h1>
+
+<p>The following tags are added to the set, available for use in reports, header fields, other plugins, etc.:</p>
+
+<pre><code> _DKIMIDENTITY_
+ Agent or User Identifier (AUID) (the 'i' tag) from valid signatures;
+
+ _DKIMDOMAIN_
+ Signing Domain Identifier (SDID) (the 'd' tag) from valid signatures;
+
+ _DKIMSELECTOR_
+ DKIM selector (the 's' tag) from valid signatures;</code></pre>
+
+<p>Identities and domains from signatures which failed verification are not included in these tags. Duplicates are eliminated (e.g. when there are two or more valid signatures from the same signer, only one copy makes it into a tag). Note that there may be more than one signature in a message - currently they are provided as a space-separated list, although this behaviour may change.</p>
+
+<h1 id="SEE-ALSO">SEE ALSO</h1>
+
+<p><code>Mail::DKIM</code> Mail::SpamAssassin::Plugin(3)</p>
+
+<pre><code> http://dkimproxy.sourceforge.net/
+ https://tools.ietf.org/rfc/rfc4871.txt
+ https://tools.ietf.org/rfc/rfc4870.txt
+ https://tools.ietf.org/rfc/rfc5617.txt
+ https://datatracker.ietf.org/group/dkim/about/</code></pre>
+
+<h1 id="USER-SETTINGS">USER SETTINGS</h1>
+
+<dl>
+
+<dt id="whitelist_from_dkim-author-example.com-signing-domain">whitelist_from_dkim author@example.com [signing-domain]</dt>
+<dd>
+
+<p>Works similarly to whitelist_from, except that in addition to matching an author address (From) to the pattern in the first parameter, the message must also carry a valid Domain Keys Identified Mail (DKIM) signature made by a signing domain (SDID, i.e. the d= tag) that is acceptable to us.</p>
+
+<p>Only one whitelist entry is allowed per line, as in <code>whitelist_from_rcvd</code>. Multiple <code>whitelist_from_dkim</code> lines are allowed. File-glob style characters are allowed for the From address (the first parameter), just like with <code>whitelist_from_rcvd</code>.</p>
+
+<p>The second parameter (the signing-domain) does not accept full file-glob style wildcards, although a simple '*.' (or just a '.') prefix to a domain name is recognized and implies any subdomain of the specified domain (but not the domain itself).</p>
+
+<p>If no signing-domain parameter is specified, the only acceptable signature will be an Author Domain Signature (sometimes called first-party signature) which is a signature where the signing domain (SDID) of a signature matches the domain of the author's address (i.e. the address in a From header field).</p>
+
+<p>Since this whitelist requires a DKIM check to be made, network tests must be enabled.</p>
+
+<p>Examples of whitelisting based on an author domain signature (first-party):</p>
+
+<pre><code> whitelist_from_dkim joe@example.com
+ whitelist_from_dkim *@corp.example.com
+ whitelist_from_dkim *@*.example.com</code></pre>
+
+<p>Examples of whitelisting based on third-party signatures:</p>
+
+<pre><code> whitelist_from_dkim jane@example.net example.org
+ whitelist_from_dkim rick@info.example.net example.net
+ whitelist_from_dkim *@info.example.net example.net
+ whitelist_from_dkim *@* mail7.remailer.example.com
+ whitelist_from_dkim *@* *.remailer.example.com</code></pre>
+
+</dd>
+<dt id="def_whitelist_from_dkim-author-example.com-signing-domain">def_whitelist_from_dkim author@example.com [signing-domain]</dt>
+<dd>
+
+<p>Same as <code>whitelist_from_dkim</code>, but used for the default whitelist entries in the SpamAssassin distribution. The whitelist score is lower, because these are often targets for abuse of public mailers which sign their mail.</p>
+
+</dd>
+<dt id="unwhitelist_from_dkim-author-example.com-signing-domain">unwhitelist_from_dkim author@example.com [signing-domain]</dt>
+<dd>
+
+<p>Removes an email address with its corresponding signing-domain field from def_whitelist_from_dkim and whitelist_from_dkim tables, if it exists. Parameters to unwhitelist_from_dkim must exactly match the parameters of a corresponding whitelist_from_dkim or def_whitelist_from_dkim config option which created the entry, for it to be removed (a domain name is matched case-insensitively); i.e. if a signing-domain parameter was specified in a whitelisting command, it must also be specified in the unwhitelisting command.</p>
+
+<p>Useful for removing undesired default entries from a distributed configuration by a local or site-specific configuration or by <code>user_prefs</code>.</p>
+
+</dd>
+<dt id="adsp_override-domain-signing-practices">adsp_override domain [signing-practices]</dt>
+<dd>
+
+<p>Currently few domains publish their signing practices (RFC 5617 - ADSP), partly because the ADSP rfc is rather new, partly because they think hardly any recipient bothers to check it, and partly for fear that some recipients might lose mail due to problems in their signature validation procedures or mail mangling by mailers beyond their control.</p>
+
+<p>Nevertheless, recipients could benefit by knowing signing practices of a sending (author's) domain, for example to recognize forged mail claiming to be from certain domains which are popular targets for phishing, like financial institutions. Unfortunately, as signing practices are seldom published or are weak, it is hardly justifiable to look them up in DNS.</p>
+
+<p>To overcome this chicken-or-the-egg problem, the <code>adsp_override</code> mechanism allows recipients using SpamAssassin to override published or defaulted ADSP for certain domains. This makes it possible to manually specify a stronger (or weaker) signing practices than a signing domain is willing to publish (explicitly or by default), and also save on a DNS lookup.</p>
+
+<p>Note that ADSP (published or overridden) is only consulted for messages which do not contain a valid DKIM signature from the author's domain.</p>
+
+<p>According to RFC 5617, signing practices can be one of the following: <code>unknown</code>, <code>all</code> and <code>discardable</code>.</p>
+
+<p><code>unknown</code>: The domain might sign some or all email - messages from the domain may or may not have an Author Domain Signature. This is a default if a domain exists in DNS but no ADSP record is found.</p>
+
+<p><code>all</code>: All mail from the domain is signed with an Author Domain Signature.</p>
+
+<p><code>discardable</code>: All mail from the domain is signed with an Author Domain Signature. Furthermore, if a message arrives without a valid Author Domain Signature, the domain encourages the recipient(s) to discard it.</p>
+
+<p>ADSP lookup can also determine that a domain is "out of scope", i.e., the domain does not exist (NXDOMAIN) in the DNS.</p>
+
+<p>To override domain's signing practices in a SpamAssassin configuration file, specify an <code>adsp_override</code> directive for each sending domain to be overridden.</p>
+
+<p>Its first argument is a domain name. Author's domain is matched against it, matching is case insensitive. This is not a regular expression or a file-glob style wildcard, but limited wildcarding is still available: if this argument starts by a "*." (or is a sole "*"), author's domain matches if it is a subdomain (to one or more levels) of the argument. Otherwise (with no leading asterisk) the match must be exact (not a subdomain).</p>
+
+<p>An optional second parameter is one of the following keywords (case-insensitive): <code>nxdomain</code>, <code>unknown</code>, <code>all</code>, <code>discardable</code>, <code>custom_low</code>, <code>custom_med</code>, <code>custom_high</code>.</p>
+
+<p>Absence of this second parameter implies <code>discardable</code>. If a domain is not listed by a <code>adsp_override</code> directive nor does it explicitly publish any ADSP record, then <code>unknown</code> is implied for valid domains, and <code>nxdomain</code> for domains not existing in DNS. (Note: domain validity is only checked with versions of Mail::DKIM 0.37 or later (actually since 0.36_5), the <code>nxdomain</code> would never turn up with older versions).</p>
+
+<p>The strong setting <code>discardable</code> is useful for domains which are known to always sign their mail and to always send it directly to recipients (not to mailing lists), and are frequent targets of fishing attempts, such as financial institutions. The <code>discardable</code> is also appropriate for domains which are known never to send any mail.</p>
+
+<p>When a message does not contain a valid signature by the author's domain (the domain in a From header field), the signing practices pertaining to author's domain determine which of the following rules fire and contributes its score: DKIM_ADSP_NXDOMAIN, DKIM_ADSP_ALL, DKIM_ADSP_DISCARD, DKIM_ADSP_CUSTOM_LOW, DKIM_ADSP_CUSTOM_MED, DKIM_ADSP_CUSTOM_HIGH. Not more than one of these rules can fire for messages that have one author (but see below). The last three can only result from a 'signing-practices' as given in a <code>adsp_override</code> directive (not from a DNS lookup), and can serve as a convenient means of providing a different score if scores assigned to DKIM_ADSP_ALL or DKIM_ADSP_DISCARD are not considered suitable for some domains.</p>
+
+<p>RFC 5322 permits a message to have more than one author - multiple addresses may be listed in a single From header field. RFC 5617 defines that a message with multiple authors has multiple signing domain signing practices, but does not prescribe how these should be combined. In presence of multiple signing practices, more than one of the DKIM_ADSP_* rules may fire.</p>
+
+<p>As a precaution against firing DKIM_ADSP_* rules when there is a known local reason for a signature verification failure, the domain's ADSP is considered 'unknown' when DNS lookups are disabled or a DNS lookup encountered a temporary problem on fetching a public key from the author's domain. Similarly, ADSP is considered 'unknown' when this plugin did its own signature verification (signatures were not passed to SA by a caller) and a metarule __TRUNCATED was triggered, indicating the caller intentionally passed a truncated message to SpamAssassin, which was a likely reason for a signature verification failure.</p>
+
+<p>Example:</p>
+
+<pre><code> adsp_override *.mydomain.example.com discardable
+ adsp_override *.neversends.example.com discardable
+
+ adsp_override ebay.com
+ adsp_override *.ebay.com
+ adsp_override ebay.co.uk
+ adsp_override *.ebay.co.uk
+ adsp_override paypal.com
+ adsp_override *.paypal.com
+ adsp_override amazon.com
+ adsp_override ealerts.bankofamerica.com
+ adsp_override americangreetings.com
+ adsp_override egreetings.com
+ adsp_override bluemountain.com
+ adsp_override hallmark.com all
+ adsp_override *.hallmark.com all
+ adsp_override youtube.com custom_high
+ adsp_override google.com custom_low
+ adsp_override gmail.com custom_low
+ adsp_override googlemail.com custom_low
+ adsp_override yahoo.com custom_low
+ adsp_override yahoo.com.au custom_low
+ adsp_override yahoo.se custom_low
+
+ adsp_override junkmailerkbw0rr.com nxdomain
+ adsp_override junkmailerd2hlsg.com nxdomain
+
+ # effectively disables ADSP network DNS lookups for all other domains:
+ adsp_override * unknown
+
+ score DKIM_ADSP_ALL 2.5
+ score DKIM_ADSP_DISCARD 25
+ score DKIM_ADSP_NXDOMAIN 3
+
+ score DKIM_ADSP_CUSTOM_LOW 1
+ score DKIM_ADSP_CUSTOM_MED 3.5
+ score DKIM_ADSP_CUSTOM_HIGH 8</code></pre>
+
+</dd>
+<dt id="dkim_minimum_key_bits-n-default:-1024">dkim_minimum_key_bits n (default: 1024)</dt>
+<dd>
+
+<p>The smallest size of a signing key (in bits) for a valid signature to be considered for whitelisting. Additionally, the eval function check_dkim_valid() will return false on short keys when called with explicitly listed domains, and the eval function check_dkim_valid_author_sig() will return false on short keys (regardless of its arguments). Setting the option to 0 disables a key size check.</p>
+
+<p>Note that the option has no effect when the eval function check_dkim_valid() is called with no arguments (like in a rule DKIM_VALID). A mere presence of some valid signature on a message has no reputational value (without being associated with a particular domain), regardless of its key size - anyone can prepend its own signature on a copy of some third party mail and re-send it, which makes it no more trustworthy than without such signature. This is also a reason for a rule DKIM_VALID to have a near-zero score, i.e. a rule hit is only informational.</p>
+
+</dd>
+</dl>
+
+<h1 id="ADMINISTRATOR-SETTINGS">ADMINISTRATOR SETTINGS</h1>
+
+<dl>
+
+<dt id="dkim_timeout-n-default:-5">dkim_timeout n (default: 5)</dt>
+<dd>
+
+<p>How many seconds to wait for a DKIM query to complete, before scanning continues without the DKIM result. A numeric value is optionally suffixed by a time unit (s, m, h, d, w, indicating seconds (default), minutes, hours, days, weeks).</p>
+
+</dd>
+</dl>
+
+
+</body>
+
+</html>
+
+
Added: spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_DKIM.txt
URL: http://svn.apache.org/viewvc/spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_DKIM.txt?rev=1873332&view=auto
==============================================================================
--- spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_DKIM.txt (added)
+++ spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_DKIM.txt Wed Jan 29 19:05:59 2020
@@ -0,0 +1,337 @@
+NAME
+ Mail::SpamAssassin::Plugin::DKIM - perform DKIM verification tests
+
+SYNOPSIS
+ loadplugin Mail::SpamAssassin::Plugin::DKIM [/path/to/DKIM.pm]
+
+ Taking into account signatures from any signing domains:
+
+ full DKIM_SIGNED eval:check_dkim_signed()
+ full DKIM_VALID eval:check_dkim_valid()
+ full DKIM_VALID_AU eval:check_dkim_valid_author_sig()
+ full DKIM_VALID_EF eval:check_dkim_valid_envelopefrom()
+
+ Taking into account signatures from specified signing domains only:
+ (quotes may be omitted on domain names consisting only of letters,
+ digits, dots, and minus characters)
+
+ full DKIM_SIGNED_MY1 eval:check_dkim_signed('dom1','dom2',...)
+ full DKIM_VALID_MY1 eval:check_dkim_valid('dom1','dom2',...)
+ full DKIM_VALID_AU_MY1 eval:check_dkim_valid_author_sig('d1','d2',...)
+
+ full __DKIM_DEPENDABLE eval:check_dkim_dependable()
+
+ Author Domain Signing Practices (ADSP) from any author domains:
+
+ header DKIM_ADSP_NXDOMAIN eval:check_dkim_adsp('N')
+ header DKIM_ADSP_ALL eval:check_dkim_adsp('A')
+ header DKIM_ADSP_DISCARD eval:check_dkim_adsp('D')
+ header DKIM_ADSP_CUSTOM_LOW eval:check_dkim_adsp('1')
+ header DKIM_ADSP_CUSTOM_MED eval:check_dkim_adsp('2')
+ header DKIM_ADSP_CUSTOM_HIGH eval:check_dkim_adsp('3')
+
+ Author Domain Signing Practices (ADSP) from specified author domains
+ only:
+
+ header DKIM_ADSP_MY1 eval:check_dkim_adsp('*','dom1','dom2',...)
+
+ describe DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
+ describe DKIM_VALID Message has at least one valid DKIM or DK signature
+ describe DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain
+ describe DKIM_VALID_EF Message has a valid DKIM or DK signature from envelope-from domain
+ describe __DKIM_DEPENDABLE A validation failure not attributable to truncation
+
+ describe DKIM_ADSP_NXDOMAIN Domain not in DNS and no valid author domain signature
+ describe DKIM_ADSP_ALL Domain signs all mail, no valid author domain signature
+ describe DKIM_ADSP_DISCARD Domain signs all mail and suggests discarding mail with no valid author domain signature, no valid author domain signature
+ describe DKIM_ADSP_CUSTOM_LOW adsp_override is CUSTOM_LOW, no valid author domain signature
+ describe DKIM_ADSP_CUSTOM_MED adsp_override is CUSTOM_MED, no valid author domain signature
+ describe DKIM_ADSP_CUSTOM_HIGH adsp_override is CUSTOM_HIGH, no valid author domain signature
+
+ For compatibility with pre-3.3.0 versions, the following are synonyms:
+
+ OLD: eval:check_dkim_verified = NEW: eval:check_dkim_valid
+ OLD: eval:check_dkim_signall = NEW: eval:check_dkim_adsp('A')
+ OLD: eval:check_dkim_signsome = NEW: redundant, semantically always true
+
+ The __DKIM_DEPENDABLE eval rule deserves an explanation. The rule yields
+ true when signatures are supplied by a caller, OR ELSE when signatures
+ are obtained by this plugin AND either there are no signatures OR a rule
+ __TRUNCATED was false. In other words: __DKIM_DEPENDABLE is true when
+ failed signatures can not be attributed to message truncation when
+ feeding a message to SpamAssassin. It can be consulted to prevent false
+ positives on large but truncated messages with poor man's implementation
+ of ADSP by hand-crafted rules.
+
+DESCRIPTION
+ This SpamAssassin plugin implements DKIM lookups as described by the RFC
+ 4871, as well as historical DomainKeys lookups, as described by RFC
+ 4870, thanks to the support for both types of signatures by newer
+ versions of module Mail::DKIM.
+
+ It requires the "Mail::DKIM" CPAN module to operate. Many thanks to
+ Jason Long for that module.
+
+TAGS
+ The following tags are added to the set, available for use in reports,
+ header fields, other plugins, etc.:
+
+ _DKIMIDENTITY_
+ Agent or User Identifier (AUID) (the 'i' tag) from valid signatures;
+
+ _DKIMDOMAIN_
+ Signing Domain Identifier (SDID) (the 'd' tag) from valid signatures;
+
+ _DKIMSELECTOR_
+ DKIM selector (the 's' tag) from valid signatures;
+
+ Identities and domains from signatures which failed verification are not
+ included in these tags. Duplicates are eliminated (e.g. when there are
+ two or more valid signatures from the same signer, only one copy makes
+ it into a tag). Note that there may be more than one signature in a
+ message - currently they are provided as a space-separated list,
+ although this behaviour may change.
+
+SEE ALSO
+ "Mail::DKIM" Mail::SpamAssassin::Plugin(3)
+
+ http://dkimproxy.sourceforge.net/
+ https://tools.ietf.org/rfc/rfc4871.txt
+ https://tools.ietf.org/rfc/rfc4870.txt
+ https://tools.ietf.org/rfc/rfc5617.txt
+ https://datatracker.ietf.org/group/dkim/about/
+
+USER SETTINGS
+ whitelist_from_dkim author@example.com [signing-domain]
+ Works similarly to whitelist_from, except that in addition to
+ matching an author address (From) to the pattern in the first
+ parameter, the message must also carry a valid Domain Keys
+ Identified Mail (DKIM) signature made by a signing domain (SDID,
+ i.e. the d= tag) that is acceptable to us.
+
+ Only one whitelist entry is allowed per line, as in
+ "whitelist_from_rcvd". Multiple "whitelist_from_dkim" lines are
+ allowed. File-glob style characters are allowed for the From address
+ (the first parameter), just like with "whitelist_from_rcvd".
+
+ The second parameter (the signing-domain) does not accept full
+ file-glob style wildcards, although a simple '*.' (or just a '.')
+ prefix to a domain name is recognized and implies any subdomain of
+ the specified domain (but not the domain itself).
+
+ If no signing-domain parameter is specified, the only acceptable
+ signature will be an Author Domain Signature (sometimes called
+ first-party signature) which is a signature where the signing domain
+ (SDID) of a signature matches the domain of the author's address
+ (i.e. the address in a From header field).
+
+ Since this whitelist requires a DKIM check to be made, network tests
+ must be enabled.
+
+ Examples of whitelisting based on an author domain signature
+ (first-party):
+
+ whitelist_from_dkim joe@example.com
+ whitelist_from_dkim *@corp.example.com
+ whitelist_from_dkim *@*.example.com
+
+ Examples of whitelisting based on third-party signatures:
+
+ whitelist_from_dkim jane@example.net example.org
+ whitelist_from_dkim rick@info.example.net example.net
+ whitelist_from_dkim *@info.example.net example.net
+ whitelist_from_dkim *@* mail7.remailer.example.com
+ whitelist_from_dkim *@* *.remailer.example.com
+
+ def_whitelist_from_dkim author@example.com [signing-domain]
+ Same as "whitelist_from_dkim", but used for the default whitelist
+ entries in the SpamAssassin distribution. The whitelist score is
+ lower, because these are often targets for abuse of public mailers
+ which sign their mail.
+
+ unwhitelist_from_dkim author@example.com [signing-domain]
+ Removes an email address with its corresponding signing-domain field
+ from def_whitelist_from_dkim and whitelist_from_dkim tables, if it
+ exists. Parameters to unwhitelist_from_dkim must exactly match the
+ parameters of a corresponding whitelist_from_dkim or
+ def_whitelist_from_dkim config option which created the entry, for
+ it to be removed (a domain name is matched case-insensitively); i.e.
+ if a signing-domain parameter was specified in a whitelisting
+ command, it must also be specified in the unwhitelisting command.
+
+ Useful for removing undesired default entries from a distributed
+ configuration by a local or site-specific configuration or by
+ "user_prefs".
+
+ adsp_override domain [signing-practices]
+ Currently few domains publish their signing practices (RFC 5617 -
+ ADSP), partly because the ADSP rfc is rather new, partly because
+ they think hardly any recipient bothers to check it, and partly for
+ fear that some recipients might lose mail due to problems in their
+ signature validation procedures or mail mangling by mailers beyond
+ their control.
+
+ Nevertheless, recipients could benefit by knowing signing practices
+ of a sending (author's) domain, for example to recognize forged mail
+ claiming to be from certain domains which are popular targets for
+ phishing, like financial institutions. Unfortunately, as signing
+ practices are seldom published or are weak, it is hardly justifiable
+ to look them up in DNS.
+
+ To overcome this chicken-or-the-egg problem, the "adsp_override"
+ mechanism allows recipients using SpamAssassin to override published
+ or defaulted ADSP for certain domains. This makes it possible to
+ manually specify a stronger (or weaker) signing practices than a
+ signing domain is willing to publish (explicitly or by default), and
+ also save on a DNS lookup.
+
+ Note that ADSP (published or overridden) is only consulted for
+ messages which do not contain a valid DKIM signature from the
+ author's domain.
+
+ According to RFC 5617, signing practices can be one of the
+ following: "unknown", "all" and "discardable".
+
+ "unknown": The domain might sign some or all email - messages from
+ the domain may or may not have an Author Domain Signature. This is a
+ default if a domain exists in DNS but no ADSP record is found.
+
+ "all": All mail from the domain is signed with an Author Domain
+ Signature.
+
+ "discardable": All mail from the domain is signed with an Author
+ Domain Signature. Furthermore, if a message arrives without a valid
+ Author Domain Signature, the domain encourages the recipient(s) to
+ discard it.
+
+ ADSP lookup can also determine that a domain is "out of scope",
+ i.e., the domain does not exist (NXDOMAIN) in the DNS.
+
+ To override domain's signing practices in a SpamAssassin
+ configuration file, specify an "adsp_override" directive for each
+ sending domain to be overridden.
+
+ Its first argument is a domain name. Author's domain is matched
+ against it, matching is case insensitive. This is not a regular
+ expression or a file-glob style wildcard, but limited wildcarding is
+ still available: if this argument starts by a "*." (or is a sole
+ "*"), author's domain matches if it is a subdomain (to one or more
+ levels) of the argument. Otherwise (with no leading asterisk) the
+ match must be exact (not a subdomain).
+
+ An optional second parameter is one of the following keywords
+ (case-insensitive): "nxdomain", "unknown", "all", "discardable",
+ "custom_low", "custom_med", "custom_high".
+
+ Absence of this second parameter implies "discardable". If a domain
+ is not listed by a "adsp_override" directive nor does it explicitly
+ publish any ADSP record, then "unknown" is implied for valid
+ domains, and "nxdomain" for domains not existing in DNS. (Note:
+ domain validity is only checked with versions of Mail::DKIM 0.37 or
+ later (actually since 0.36_5), the "nxdomain" would never turn up
+ with older versions).
+
+ The strong setting "discardable" is useful for domains which are
+ known to always sign their mail and to always send it directly to
+ recipients (not to mailing lists), and are frequent targets of
+ fishing attempts, such as financial institutions. The "discardable"
+ is also appropriate for domains which are known never to send any
+ mail.
+
+ When a message does not contain a valid signature by the author's
+ domain (the domain in a From header field), the signing practices
+ pertaining to author's domain determine which of the following rules
+ fire and contributes its score: DKIM_ADSP_NXDOMAIN, DKIM_ADSP_ALL,
+ DKIM_ADSP_DISCARD, DKIM_ADSP_CUSTOM_LOW, DKIM_ADSP_CUSTOM_MED,
+ DKIM_ADSP_CUSTOM_HIGH. Not more than one of these rules can fire for
+ messages that have one author (but see below). The last three can
+ only result from a 'signing-practices' as given in a "adsp_override"
+ directive (not from a DNS lookup), and can serve as a convenient
+ means of providing a different score if scores assigned to
+ DKIM_ADSP_ALL or DKIM_ADSP_DISCARD are not considered suitable for
+ some domains.
+
+ RFC 5322 permits a message to have more than one author - multiple
+ addresses may be listed in a single From header field. RFC 5617
+ defines that a message with multiple authors has multiple signing
+ domain signing practices, but does not prescribe how these should be
+ combined. In presence of multiple signing practices, more than one
+ of the DKIM_ADSP_* rules may fire.
+
+ As a precaution against firing DKIM_ADSP_* rules when there is a
+ known local reason for a signature verification failure, the
+ domain's ADSP is considered 'unknown' when DNS lookups are disabled
+ or a DNS lookup encountered a temporary problem on fetching a public
+ key from the author's domain. Similarly, ADSP is considered
+ 'unknown' when this plugin did its own signature verification
+ (signatures were not passed to SA by a caller) and a metarule
+ __TRUNCATED was triggered, indicating the caller intentionally
+ passed a truncated message to SpamAssassin, which was a likely
+ reason for a signature verification failure.
+
+ Example:
+
+ adsp_override *.mydomain.example.com discardable
+ adsp_override *.neversends.example.com discardable
+
+ adsp_override ebay.com
+ adsp_override *.ebay.com
+ adsp_override ebay.co.uk
+ adsp_override *.ebay.co.uk
+ adsp_override paypal.com
+ adsp_override *.paypal.com
+ adsp_override amazon.com
+ adsp_override ealerts.bankofamerica.com
+ adsp_override americangreetings.com
+ adsp_override egreetings.com
+ adsp_override bluemountain.com
+ adsp_override hallmark.com all
+ adsp_override *.hallmark.com all
+ adsp_override youtube.com custom_high
+ adsp_override google.com custom_low
+ adsp_override gmail.com custom_low
+ adsp_override googlemail.com custom_low
+ adsp_override yahoo.com custom_low
+ adsp_override yahoo.com.au custom_low
+ adsp_override yahoo.se custom_low
+
+ adsp_override junkmailerkbw0rr.com nxdomain
+ adsp_override junkmailerd2hlsg.com nxdomain
+
+ # effectively disables ADSP network DNS lookups for all other domains:
+ adsp_override * unknown
+
+ score DKIM_ADSP_ALL 2.5
+ score DKIM_ADSP_DISCARD 25
+ score DKIM_ADSP_NXDOMAIN 3
+
+ score DKIM_ADSP_CUSTOM_LOW 1
+ score DKIM_ADSP_CUSTOM_MED 3.5
+ score DKIM_ADSP_CUSTOM_HIGH 8
+
+ dkim_minimum_key_bits n (default: 1024)
+ The smallest size of a signing key (in bits) for a valid signature
+ to be considered for whitelisting. Additionally, the eval function
+ check_dkim_valid() will return false on short keys when called with
+ explicitly listed domains, and the eval function
+ check_dkim_valid_author_sig() will return false on short keys
+ (regardless of its arguments). Setting the option to 0 disables a
+ key size check.
+
+ Note that the option has no effect when the eval function
+ check_dkim_valid() is called with no arguments (like in a rule
+ DKIM_VALID). A mere presence of some valid signature on a message
+ has no reputational value (without being associated with a
+ particular domain), regardless of its key size - anyone can prepend
+ its own signature on a copy of some third party mail and re-send it,
+ which makes it no more trustworthy than without such signature. This
+ is also a reason for a rule DKIM_VALID to have a near-zero score,
+ i.e. a rule hit is only informational.
+
+ADMINISTRATOR SETTINGS
+ dkim_timeout n (default: 5)
+ How many seconds to wait for a DKIM query to complete, before
+ scanning continues without the DKIM result. A numeric value is
+ optionally suffixed by a time unit (s, m, h, d, w, indicating
+ seconds (default), minutes, hours, days, weeks).
+
Added: spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_DNSEval.html
URL: http://svn.apache.org/viewvc/spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_DNSEval.html?rev=1873332&view=auto
==============================================================================
--- spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_DNSEval.html (added)
+++ spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_DNSEval.html Wed Jan 29 19:05:59 2020
@@ -0,0 +1,117 @@
+<?xml version="1.0" ?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<title></title>
+<meta http-equiv="content-type" content="text/html; charset=utf-8" />
+<link rev="made" href="mailto:root@localhost" />
+</head>
+
+<body style="background-color: white">
+
+
+
+<ul id="index">
+ <li><a href="#NAME">NAME</a></li>
+ <li><a href="#SYNOPSIS">SYNOPSIS</a></li>
+ <li><a href="#DESCRIPTION">DESCRIPTION</a></li>
+ <li><a href="#USER-PREFERENCES">USER PREFERENCES</a></li>
+</ul>
+
+<h1 id="NAME">NAME</h1>
+
+<p>DNSEVAL - look up URLs against DNS blocklists</p>
+
+<h1 id="SYNOPSIS">SYNOPSIS</h1>
+
+<pre><code> loadplugin Mail::SpamAssassin::Plugin::DNSEval
+
+ rbl_headers EnvelopeFrom,Reply-To,Disposition-Notification-To
+ header RBL_IP eval:check_rbl_headers('rbl', 'rbl.example.com.', '127.0.0.2')
+ describe RBL_IP From address associated with spam domains
+ tflags RBL_IP net
+ reuse RBL_IP
+
+ Supported extra tflags from SpamAssassin 3.4.3:
+ domains_only - only non-IP-address "host" components are queried
+ ips_only - only IP addresses as the "host" component will be queried</code></pre>
+
+<h1 id="DESCRIPTION">DESCRIPTION</h1>
+
+<p>The DNSEval plugin queries dns to see if a domain or an ip address present on one of email's headers is on a particular rbl.</p>
+
+<h1 id="USER-PREFERENCES">USER PREFERENCES</h1>
+
+<p>The following options can be used in both site-wide (<code>local.cf</code>) and user-specific (<code>user_prefs</code>) configuration files to customize how SpamAssassin handles incoming email messages.</p>
+
+<dl>
+
+<dt id="rbl_headers">rbl_headers</dt>
+<dd>
+
+<pre><code> This option tells SpamAssassin in which headers to check for content
+ used to query the specified rbl.
+ If on the headers content there is an email address, an ip address
+ or a domain name, it will be checked on the specified rbl.
+ The configuration option can be overridden by passing an headers list as
+ last parameter to check_rbl_headers.
+ The default headers checked are:</code></pre>
+
+</dd>
+</dl>
+
+<ul>
+
+<li><p>EnvelopeFrom</p>
+
+</li>
+<li><p>Reply-To</p>
+
+</li>
+<li><p>Disposition-Notification-To</p>
+
+</li>
+<li><p>X-WebmailclientIP</p>
+
+</li>
+<li><p>X-Source-IP</p>
+
+</li>
+</ul>
+
+<dl>
+
+<dt id="check_rbl_from_domain">check_rbl_from_domain</dt>
+<dd>
+
+<p>This checks all the from addrs domain names as an alternate to check_rbl_from_host. As of v3.4.1, it has been improved to include a subtest for a specific octet.</p>
+
+</dd>
+</dl>
+
+<dl>
+
+<dt id="check_rbl_ns_from">check_rbl_ns_from</dt>
+<dd>
+
+<p>This checks the dns server of the from addrs domain name. It is possible to include a subtest for a specific octet.</p>
+
+</dd>
+</dl>
+
+<dl>
+
+<dt id="check_rbl_rcvd">check_rbl_rcvd</dt>
+<dd>
+
+<p>This checks all received headers domains or ip addresses against a specific rbl. It is possible to include a subtest for a specific octet.</p>
+
+</dd>
+</dl>
+
+
+</body>
+
+</html>
+
+
Added: spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_DNSEval.txt
URL: http://svn.apache.org/viewvc/spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_DNSEval.txt?rev=1873332&view=auto
==============================================================================
--- spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_DNSEval.txt (added)
+++ spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_DNSEval.txt Wed Jan 29 19:05:59 2020
@@ -0,0 +1,58 @@
+NAME
+ DNSEVAL - look up URLs against DNS blocklists
+
+SYNOPSIS
+ loadplugin Mail::SpamAssassin::Plugin::DNSEval
+
+ rbl_headers EnvelopeFrom,Reply-To,Disposition-Notification-To
+ header RBL_IP eval:check_rbl_headers('rbl', 'rbl.example.com.', '127.0.0.2')
+ describe RBL_IP From address associated with spam domains
+ tflags RBL_IP net
+ reuse RBL_IP
+
+ Supported extra tflags from SpamAssassin 3.4.3:
+ domains_only - only non-IP-address "host" components are queried
+ ips_only - only IP addresses as the "host" component will be queried
+
+DESCRIPTION
+ The DNSEval plugin queries dns to see if a domain or an ip address
+ present on one of email's headers is on a particular rbl.
+
+USER PREFERENCES
+ The following options can be used in both site-wide ("local.cf") and
+ user-specific ("user_prefs") configuration files to customize how
+ SpamAssassin handles incoming email messages.
+
+ rbl_headers
+ This option tells SpamAssassin in which headers to check for content
+ used to query the specified rbl.
+ If on the headers content there is an email address, an ip address
+ or a domain name, it will be checked on the specified rbl.
+ The configuration option can be overridden by passing an headers list as
+ last parameter to check_rbl_headers.
+ The default headers checked are:
+
+ * EnvelopeFrom
+
+ * Reply-To
+
+ * Disposition-Notification-To
+
+ * X-WebmailclientIP
+
+ * X-Source-IP
+
+ check_rbl_from_domain
+ This checks all the from addrs domain names as an alternate to
+ check_rbl_from_host. As of v3.4.1, it has been improved to include a
+ subtest for a specific octet.
+
+ check_rbl_ns_from
+ This checks the dns server of the from addrs domain name. It is
+ possible to include a subtest for a specific octet.
+
+ check_rbl_rcvd
+ This checks all received headers domains or ip addresses against a
+ specific rbl. It is possible to include a subtest for a specific
+ octet.
+
Added: spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_FreeMail.html
URL: http://svn.apache.org/viewvc/spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_FreeMail.html?rev=1873332&view=auto
==============================================================================
--- spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_FreeMail.html (added)
+++ spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_FreeMail.html Wed Jan 29 19:05:59 2020
@@ -0,0 +1,109 @@
+<?xml version="1.0" ?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<title></title>
+<meta http-equiv="content-type" content="text/html; charset=utf-8" />
+<link rev="made" href="mailto:root@localhost" />
+</head>
+
+<body style="background-color: white">
+
+
+
+<ul id="index">
+ <li><a href="#NAME">NAME</a></li>
+ <li><a href="#SYNOPSIS">SYNOPSIS</a></li>
+ <li><a href="#CONFIGURATION">CONFIGURATION</a></li>
+ <li><a href="#CHANGELOG">CHANGELOG</a></li>
+</ul>
+
+<h1 id="NAME">NAME</h1>
+
+<p>FreeMail - check message headers/body for freemail-domains</p>
+
+<h1 id="SYNOPSIS">SYNOPSIS</h1>
+
+<p>If for example From-address is freemail, and Reply-To or address found in mail body is different freemail address, return success. Good sign of Nigerian scams etc. Test idea from Marc Perkel.</p>
+
+<p>Also separate functions to check various portions of message for freemails.</p>
+
+<h1 id="CONFIGURATION">CONFIGURATION</h1>
+
+<p>freemail_domains domain ...</p>
+
+<pre><code> List of domains to be used in checks.
+
+ Regexp is not supported, but following wildcards work:
+
+ ? for single character (does not match a dot)
+ * for multiple characters (does not match a dot)
+
+ For example:
+ freemail_domains hotmail.com hotmail.co.?? yahoo.* yahoo.*.*</code></pre>
+
+<p>freemail_whitelist email/domain ...</p>
+
+<pre><code> Emails or domains listed here are ignored (pretend they aren't
+ freemail). No wildcards!</code></pre>
+
+<p>freemail_import_whitelist_auth 1/0</p>
+
+<pre><code> Entries in whitelist_auth will also be used to whitelist emails
+ or domains from being freemail. Default is 0.</code></pre>
+
+<p>freemail_import_def_whitelist_auth 1/0</p>
+
+<pre><code> Entries in def_whitelist_auth will also be used to whitelist emails
+ or domains from being freemail. Default is 0.</code></pre>
+
+<p>header FREEMAIL_REPLYTO eval:check_freemail_replyto(['option'])</p>
+
+<pre><code> Checks/compares freemail addresses found from headers and body.
+
+ Possible options:
+
+ replyto From: or body address is different than Reply-To
+ (this is the default)
+ reply as above, but if no Reply-To header is found,
+ compares From: and body</code></pre>
+
+<p>header FREEMAIL_FROM eval:check_freemail_from(['regex'])</p>
+
+<pre><code> Checks all possible "from" headers to see if sender is freemail.
+ Uses SA all_from_addrs() function (includes 'Resent-From', 'From',
+ 'EnvelopeFrom' etc).
+
+ Add optional regex to match the found email address(es). For example,
+ to see if user ends in digit: check_freemail_from('\d@')
+
+ If you use multiple check_freemail_from rules with regexes, remember
+ that they might hit different emails from different heades. To match
+ a certain header only, use check_freemail_header.</code></pre>
+
+<p>header FREEMAIL_HDRX eval:check_freemail_header('header' [, 'regex'])</p>
+
+<pre><code> Searches defined header for freemail address. Optional regex to match
+ the found address (like in check_freemail_from).</code></pre>
+
+<p>header FREEMAIL_BODY eval:check_freemail_body(['regex'])</p>
+
+<pre><code> Searches body for freemail address. With optional regex to match.</code></pre>
+
+<h1 id="CHANGELOG">CHANGELOG</h1>
+
+<pre><code> 1.996 - fix freemail_skip_bulk_envfrom
+ 1.997 - set freemail_skip_when_over_max to 1 by default
+ 1.998 - don't warn about missing freemail_domains when linting
+ 1.999 - default whitelist undisclosed-recipient@yahoo.com etc
+ 2.000 - some cleaning up
+ 2.001 - fix freemail_whitelist
+ 2.002 - _add_desc -> _got_hit, fix description email append bug
+ 2.003 - freemail_import_(def_)whitelist_auth</code></pre>
+
+
+</body>
+
+</html>
+
+
Added: spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_FreeMail.txt
URL: http://svn.apache.org/viewvc/spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_FreeMail.txt?rev=1873332&view=auto
==============================================================================
--- spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_FreeMail.txt (added)
+++ spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_FreeMail.txt Wed Jan 29 19:05:59 2020
@@ -0,0 +1,82 @@
+NAME
+ FreeMail - check message headers/body for freemail-domains
+
+SYNOPSIS
+ If for example From-address is freemail, and Reply-To or address found
+ in mail body is different freemail address, return success. Good sign of
+ Nigerian scams etc. Test idea from Marc Perkel.
+
+ Also separate functions to check various portions of message for
+ freemails.
+
+CONFIGURATION
+ freemail_domains domain ...
+
+ List of domains to be used in checks.
+
+ Regexp is not supported, but following wildcards work:
+
+ ? for single character (does not match a dot)
+ * for multiple characters (does not match a dot)
+
+ For example:
+ freemail_domains hotmail.com hotmail.co.?? yahoo.* yahoo.*.*
+
+ freemail_whitelist email/domain ...
+
+ Emails or domains listed here are ignored (pretend they aren't
+ freemail). No wildcards!
+
+ freemail_import_whitelist_auth 1/0
+
+ Entries in whitelist_auth will also be used to whitelist emails
+ or domains from being freemail. Default is 0.
+
+ freemail_import_def_whitelist_auth 1/0
+
+ Entries in def_whitelist_auth will also be used to whitelist emails
+ or domains from being freemail. Default is 0.
+
+ header FREEMAIL_REPLYTO eval:check_freemail_replyto(['option'])
+
+ Checks/compares freemail addresses found from headers and body.
+
+ Possible options:
+
+ replyto From: or body address is different than Reply-To
+ (this is the default)
+ reply as above, but if no Reply-To header is found,
+ compares From: and body
+
+ header FREEMAIL_FROM eval:check_freemail_from(['regex'])
+
+ Checks all possible "from" headers to see if sender is freemail.
+ Uses SA all_from_addrs() function (includes 'Resent-From', 'From',
+ 'EnvelopeFrom' etc).
+
+ Add optional regex to match the found email address(es). For example,
+ to see if user ends in digit: check_freemail_from('\d@')
+
+ If you use multiple check_freemail_from rules with regexes, remember
+ that they might hit different emails from different heades. To match
+ a certain header only, use check_freemail_header.
+
+ header FREEMAIL_HDRX eval:check_freemail_header('header' [, 'regex'])
+
+ Searches defined header for freemail address. Optional regex to match
+ the found address (like in check_freemail_from).
+
+ header FREEMAIL_BODY eval:check_freemail_body(['regex'])
+
+ Searches body for freemail address. With optional regex to match.
+
+CHANGELOG
+ 1.996 - fix freemail_skip_bulk_envfrom
+ 1.997 - set freemail_skip_when_over_max to 1 by default
+ 1.998 - don't warn about missing freemail_domains when linting
+ 1.999 - default whitelist undisclosed-recipient@yahoo.com etc
+ 2.000 - some cleaning up
+ 2.001 - fix freemail_whitelist
+ 2.002 - _add_desc -> _got_hit, fix description email append bug
+ 2.003 - freemail_import_(def_)whitelist_auth
+
Added: spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_FromNameSpoof.html
URL: http://svn.apache.org/viewvc/spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_FromNameSpoof.html?rev=1873332&view=auto
==============================================================================
--- spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_FromNameSpoof.html (added)
+++ spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_FromNameSpoof.html Wed Jan 29 19:05:59 2020
@@ -0,0 +1,110 @@
+<?xml version="1.0" ?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<title></title>
+<meta http-equiv="content-type" content="text/html; charset=utf-8" />
+<link rev="made" href="mailto:root@localhost" />
+</head>
+
+<body style="background-color: white">
+
+
+
+<ul id="index">
+ <li><a href="#NAME">NAME</a></li>
+ <li><a href="#SYNOPSIS">SYNOPSIS</a></li>
+ <li><a href="#DESCRIPTION">DESCRIPTION</a></li>
+ <li><a href="#CONFIGURATION">CONFIGURATION</a></li>
+ <li><a href="#TAGS">TAGS</a></li>
+ <li><a href="#EXAMPLE">EXAMPLE</a></li>
+</ul>
+
+<h1 id="NAME">NAME</h1>
+
+<p>FromNameSpoof - perform various tests to detect spoof attempts using the From header name section</p>
+
+<h1 id="SYNOPSIS">SYNOPSIS</h1>
+
+<p>loadplugin Mail::SpamAssassin::Plugin::FromNameSpoof</p>
+
+<pre><code> # Does the From:name look like it contains an email address
+ header __PLUGIN_FROMNAME_EMAIL eval:check_fromname_contains_email()
+
+ # Is the From:name different to the From:addr header
+ header __PLUGIN_FROMNAME_DIFFERENT eval:check_fromname_different()
+
+ # From:name and From:addr owners differ
+ header __PLUGIN_FROMNAME_OWNERS_DIFFER eval:check_fromname_owners_differ()
+
+ # From:name domain differs to from header
+ header __PLUGIN_FROMNAME_DOMAIN_DIFFER eval:check_fromname_domain_differ()
+
+ # From:name and From:address don't match and owners differ
+ header __PLUGIN_FROMNAME_SPOOF eval:check_fromname_spoof()
+
+ # From:name address matches To:address
+ header __PLUGIN_FROMNAME_EQUALS_TO eval:check_fromname_equals_to()</code></pre>
+
+<h1 id="DESCRIPTION">DESCRIPTION</h1>
+
+<p>Perform various tests against From:name header to detect spoofing. Steps in place to ensure minimal FPs.</p>
+
+<h1 id="CONFIGURATION">CONFIGURATION</h1>
+
+<p>The plugin allows you to skip emails that have been DKIM signed by specific senders:</p>
+
+<pre><code> fns_ignore_dkim googlegroups.com</code></pre>
+
+<p>FromNameSpoof allows for a configurable closeness when matching the From:addr and From:name, the closeness can be adjusted with:</p>
+
+<pre><code> fns_extrachars 50</code></pre>
+
+<p><b>Note</b> that FromNameSpoof detects the "owner" of a domain by the following search:</p>
+
+<pre><code> <owner>.<tld></code></pre>
+
+<p>By default FromNameSpoof will ignore the TLD when testing if From:addr is spoofed. Default 1</p>
+
+<pre><code> fns_check 1</code></pre>
+
+<p>Check levels:</p>
+
+<pre><code> 0 - Strict checking of From:name != From:addr
+ 1 - Allow for different tlds
+ 2 - Allow for different aliases but same domain</code></pre>
+
+<h1 id="TAGS">TAGS</h1>
+
+<p>The following tags are added to the set if a spoof is detected. They are available for use in reports, header fields, other plugins, etc.:</p>
+
+<pre><code> _FNSFNAMEADDR_
+ Detected spoof address from From:name header
+
+ _FNSFNAMEDOMAIN_
+ Detected spoof domain from From:name header
+
+ _FNSFNAMEOWNER_
+ Detected spoof owner from From:name header
+
+ _FNSFADDRADDR_
+ Actual From:addr address
+
+ _FNSFADDRDOMAIN_
+ Actual From:addr domain
+
+ _FNSFADDROWNER_
+ Actual From:addr detected owner</code></pre>
+
+<h1 id="EXAMPLE">EXAMPLE</h1>
+
+<p>header __PLUGIN_FROMNAME_SPOOF eval:check_fromname_spoof() header __PLUGIN_FROMNAME_EQUALS_TO eval:check_fromname_equals_to()</p>
+
+<p>meta FROMNAME_SPOOF_EQUALS_TO (__PLUGIN_FROMNAME_SPOOF && __PLUGIN_FROMNAME_EQUALS_TO) describe FROMNAME_SPOOF_EQUALS_TO From:name is spoof to look like To: address score FROMNAME_SPOOF_EQUALS_TO 1.2</p>
+
+
+</body>
+
+</html>
+
+
Added: spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_FromNameSpoof.txt
URL: http://svn.apache.org/viewvc/spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_FromNameSpoof.txt?rev=1873332&view=auto
==============================================================================
--- spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_FromNameSpoof.txt (added)
+++ spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_FromNameSpoof.txt Wed Jan 29 19:05:59 2020
@@ -0,0 +1,86 @@
+NAME
+ FromNameSpoof - perform various tests to detect spoof attempts using the
+ From header name section
+
+SYNOPSIS
+ loadplugin Mail::SpamAssassin::Plugin::FromNameSpoof
+
+ # Does the From:name look like it contains an email address
+ header __PLUGIN_FROMNAME_EMAIL eval:check_fromname_contains_email()
+
+ # Is the From:name different to the From:addr header
+ header __PLUGIN_FROMNAME_DIFFERENT eval:check_fromname_different()
+
+ # From:name and From:addr owners differ
+ header __PLUGIN_FROMNAME_OWNERS_DIFFER eval:check_fromname_owners_differ()
+
+ # From:name domain differs to from header
+ header __PLUGIN_FROMNAME_DOMAIN_DIFFER eval:check_fromname_domain_differ()
+
+ # From:name and From:address don't match and owners differ
+ header __PLUGIN_FROMNAME_SPOOF eval:check_fromname_spoof()
+
+ # From:name address matches To:address
+ header __PLUGIN_FROMNAME_EQUALS_TO eval:check_fromname_equals_to()
+
+DESCRIPTION
+ Perform various tests against From:name header to detect spoofing. Steps
+ in place to ensure minimal FPs.
+
+CONFIGURATION
+ The plugin allows you to skip emails that have been DKIM signed by
+ specific senders:
+
+ fns_ignore_dkim googlegroups.com
+
+ FromNameSpoof allows for a configurable closeness when matching the
+ From:addr and From:name, the closeness can be adjusted with:
+
+ fns_extrachars 50
+
+ Note that FromNameSpoof detects the "owner" of a domain by the following
+ search:
+
+ <owner>.<tld>
+
+ By default FromNameSpoof will ignore the TLD when testing if From:addr
+ is spoofed. Default 1
+
+ fns_check 1
+
+ Check levels:
+
+ 0 - Strict checking of From:name != From:addr
+ 1 - Allow for different tlds
+ 2 - Allow for different aliases but same domain
+
+TAGS
+ The following tags are added to the set if a spoof is detected. They are
+ available for use in reports, header fields, other plugins, etc.:
+
+ _FNSFNAMEADDR_
+ Detected spoof address from From:name header
+
+ _FNSFNAMEDOMAIN_
+ Detected spoof domain from From:name header
+
+ _FNSFNAMEOWNER_
+ Detected spoof owner from From:name header
+
+ _FNSFADDRADDR_
+ Actual From:addr address
+
+ _FNSFADDRDOMAIN_
+ Actual From:addr domain
+
+ _FNSFADDROWNER_
+ Actual From:addr detected owner
+
+EXAMPLE
+ header __PLUGIN_FROMNAME_SPOOF eval:check_fromname_spoof() header
+ __PLUGIN_FROMNAME_EQUALS_TO eval:check_fromname_equals_to()
+
+ meta FROMNAME_SPOOF_EQUALS_TO (__PLUGIN_FROMNAME_SPOOF &&
+ __PLUGIN_FROMNAME_EQUALS_TO) describe FROMNAME_SPOOF_EQUALS_TO From:name
+ is spoof to look like To: address score FROMNAME_SPOOF_EQUALS_TO 1.2
+
Added: spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_HashBL.html
URL: http://svn.apache.org/viewvc/spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_HashBL.html?rev=1873332&view=auto
==============================================================================
--- spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_HashBL.html (added)
+++ spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_HashBL.html Wed Jan 29 19:05:59 2020
@@ -0,0 +1,120 @@
+<?xml version="1.0" ?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<title></title>
+<meta http-equiv="content-type" content="text/html; charset=utf-8" />
+<link rev="made" href="mailto:root@localhost" />
+</head>
+
+<body style="background-color: white">
+
+
+
+<ul id="index">
+ <li><a href="#NAME">NAME</a></li>
+ <li><a href="#SYNOPSIS">SYNOPSIS</a></li>
+ <li><a href="#DESCRIPTION">DESCRIPTION</a></li>
+</ul>
+
+<h1 id="NAME">NAME</h1>
+
+<p>HashBL - query hashed (and unhashed) DNS blocklists</p>
+
+<h1 id="SYNOPSIS">SYNOPSIS</h1>
+
+<pre><code> loadplugin Mail::SpamAssassin::Plugin::HashBL
+
+ header HASHBL_EMAIL eval:check_hashbl_emails('ebl.msbl.org')
+ describe HASHBL_EMAIL Message contains email address found on EBL
+
+ hashbl_acl_freemail gmail.com
+ header HASHBL_OSENDR eval:check_hashbl_emails('rbl.example.com/A', 'md5/max=10/shuffle', 'X-Original-Sender', '^127\.', 'freemail')
+ describe HASHBL_OSENDR Message contains email address found on HASHBL
+ tflags HASHBL_OSENDR net
+
+ body HASHBL_BTC eval:check_hashbl_bodyre('btcbl.foo.bar', 'sha1/max=10/shuffle', '\b([13][a-km-zA-HJ-NP-Z1-9]{25,34})\b')
+ describe HASHBL_BTC Message contains BTC address found on BTCBL
+ priority HASHBL_BTC -100 # required priority to launch async lookups
+
+ header HASHBL_URI eval:check_hashbl_uris('rbl.foo.bar', 'sha1', '127.0.0.32')
+ describe HASHBL_URI Message contains uri found on rbl</code></pre>
+
+<h1 id="DESCRIPTION">DESCRIPTION</h1>
+
+<p>This plugin support multiple types of hashed or unhashed DNS blocklists.</p>
+
+<p>OPTS refers to multiple generic options:</p>
+
+<pre><code> raw do not hash data, query as is
+ md5 hash query with MD5
+ sha1 hash query with SHA1
+ case keep case before hashing, default is to lowercase
+ max=x maximum number of queries
+ shuffle if max exceeded, random shuffle queries before truncating to limit</code></pre>
+
+<p>Multiple options can be separated with slash or other non-word character. If OPTS is empty ('') or missing, default is used.</p>
+
+<p>HEADERS refers to slash separated list of Headers to process:</p>
+
+<pre><code> ALL all headers
+ ALLFROM all From headers as returned by $pms->all_from_addrs()
+ EnvelopeFrom message envelope from (Return-Path etc)
+ HeaderName any header as used with $pms->get()</code></pre>
+
+<p>if HEADERS is empty ('') or missing, default is used.</p>
+
+<dl>
+
+<dt id="header-RULE-check_hashbl_emails-bl.example.com-A-OPTS-HEADERS-body-127">header RULE check_hashbl_emails('bl.example.com/A', 'OPTS', 'HEADERS/body', '^127\.')</dt>
+<dd>
+
+<p>Check email addresses from DNS list, "body" can be specified along with headers to search body for emails. Optional subtest regexp to match DNS answer. Note that eval rule type must always be "header".</p>
+
+<p>DNS query type can be appended to list with /A (default) or /TXT.</p>
+
+<p>Additional supported OPTS:</p>
+
+<pre><code> nodot strip username dots from email
+ notag strip username tags from email
+ nouri ignore emails inside uris
+ noquote ignore emails inside < > or possible quotings</code></pre>
+
+<p>Default OPTS: sha1/notag/noquote/max=10/shuffle</p>
+
+<p>Default HEADERS: ALLFROM/Reply-To/body</p>
+
+<p>For existing public email blacklist, see: http://msbl.org/ebl.html</p>
+
+<pre><code> header HASHBL_EBL check_hashbl_emails('ebl.msbl.org')
+ priority HASHBL_EBL -100 # required for async query</code></pre>
+
+<dl>
+
+<dt id="header-RULE-check_hashbl_uris-bl.example.com-A-OPTS-127">header RULE check_hashbl_uris('bl.example.com/A', 'OPTS', '^127\.')</dt>
+<dd>
+
+<p>Check uris from DNS list, optional subtest regexp to match DNS answer.</p>
+
+<p>DNS query type can be appended to list with /A (default) or /TXT.</p>
+
+<p>Default OPTS: sha1/max=10/shuffle</p>
+
+</dd>
+</dl>
+
+</dd>
+<dt id="body-RULE-check_hashbl_bodyre-bl.example.com-A-OPTS-b-match-b-127">body RULE check_hashbl_bodyre('bl.example.com/A', 'OPTS', '\b(match)\b', '^127\.')</dt>
+<dd>
+
+<p>Search body for matching regexp and query the string captured. Regexp must have a single capture ( ) for the string ($1). Optional subtest regexp to match DNS answer. Note that eval rule type must be "body" or "rawbody".</p>
+
+</dd>
+</dl>
+
+
+</body>
+
+</html>
+
+
Added: spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_HashBL.txt
URL: http://svn.apache.org/viewvc/spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_HashBL.txt?rev=1873332&view=auto
==============================================================================
--- spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_HashBL.txt (added)
+++ spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_HashBL.txt Wed Jan 29 19:05:59 2020
@@ -0,0 +1,85 @@
+NAME
+ HashBL - query hashed (and unhashed) DNS blocklists
+
+SYNOPSIS
+ loadplugin Mail::SpamAssassin::Plugin::HashBL
+
+ header HASHBL_EMAIL eval:check_hashbl_emails('ebl.msbl.org')
+ describe HASHBL_EMAIL Message contains email address found on EBL
+
+ hashbl_acl_freemail gmail.com
+ header HASHBL_OSENDR eval:check_hashbl_emails('rbl.example.com/A', 'md5/max=10/shuffle', 'X-Original-Sender', '^127\.', 'freemail')
+ describe HASHBL_OSENDR Message contains email address found on HASHBL
+ tflags HASHBL_OSENDR net
+
+ body HASHBL_BTC eval:check_hashbl_bodyre('btcbl.foo.bar', 'sha1/max=10/shuffle', '\b([13][a-km-zA-HJ-NP-Z1-9]{25,34})\b')
+ describe HASHBL_BTC Message contains BTC address found on BTCBL
+ priority HASHBL_BTC -100 # required priority to launch async lookups
+
+ header HASHBL_URI eval:check_hashbl_uris('rbl.foo.bar', 'sha1', '127.0.0.32')
+ describe HASHBL_URI Message contains uri found on rbl
+
+DESCRIPTION
+ This plugin support multiple types of hashed or unhashed DNS blocklists.
+
+ OPTS refers to multiple generic options:
+
+ raw do not hash data, query as is
+ md5 hash query with MD5
+ sha1 hash query with SHA1
+ case keep case before hashing, default is to lowercase
+ max=x maximum number of queries
+ shuffle if max exceeded, random shuffle queries before truncating to limit
+
+ Multiple options can be separated with slash or other non-word
+ character. If OPTS is empty ('') or missing, default is used.
+
+ HEADERS refers to slash separated list of Headers to process:
+
+ ALL all headers
+ ALLFROM all From headers as returned by $pms->all_from_addrs()
+ EnvelopeFrom message envelope from (Return-Path etc)
+ HeaderName any header as used with $pms->get()
+
+ if HEADERS is empty ('') or missing, default is used.
+
+ header RULE check_hashbl_emails('bl.example.com/A', 'OPTS',
+ 'HEADERS/body', '^127\.')
+ Check email addresses from DNS list, "body" can be specified along
+ with headers to search body for emails. Optional subtest regexp to
+ match DNS answer. Note that eval rule type must always be "header".
+
+ DNS query type can be appended to list with /A (default) or /TXT.
+
+ Additional supported OPTS:
+
+ nodot strip username dots from email
+ notag strip username tags from email
+ nouri ignore emails inside uris
+ noquote ignore emails inside < > or possible quotings
+
+ Default OPTS: sha1/notag/noquote/max=10/shuffle
+
+ Default HEADERS: ALLFROM/Reply-To/body
+
+ For existing public email blacklist, see: http://msbl.org/ebl.html
+
+ header HASHBL_EBL check_hashbl_emails('ebl.msbl.org')
+ priority HASHBL_EBL -100 # required for async query
+
+ header RULE check_hashbl_uris('bl.example.com/A', 'OPTS', '^127\.')
+ Check uris from DNS list, optional subtest regexp to match DNS
+ answer.
+
+ DNS query type can be appended to list with /A (default) or
+ /TXT.
+
+ Default OPTS: sha1/max=10/shuffle
+
+ body RULE check_hashbl_bodyre('bl.example.com/A', 'OPTS', '\b(match)\b',
+ '^127\.')
+ Search body for matching regexp and query the string captured.
+ Regexp must have a single capture ( ) for the string ($1). Optional
+ subtest regexp to match DNS answer. Note that eval rule type must be
+ "body" or "rawbody".
+
Added: spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_Hashcash.html
URL: http://svn.apache.org/viewvc/spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_Hashcash.html?rev=1873332&view=auto
==============================================================================
--- spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_Hashcash.html (added)
+++ spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_Hashcash.html Wed Jan 29 19:05:59 2020
@@ -0,0 +1,78 @@
+<?xml version="1.0" ?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<title></title>
+<meta http-equiv="content-type" content="text/html; charset=utf-8" />
+<link rev="made" href="mailto:root@localhost" />
+</head>
+
+<body style="background-color: white">
+
+
+
+<ul id="index">
+ <li><a href="#NAME">NAME</a></li>
+ <li><a href="#SYNOPSIS">SYNOPSIS</a></li>
+ <li><a href="#DESCRIPTION">DESCRIPTION</a></li>
+ <li><a href="#USER-SETTINGS">USER SETTINGS</a></li>
+</ul>
+
+<h1 id="NAME">NAME</h1>
+
+<p>Mail::SpamAssassin::Plugin::Hashcash - perform hashcash verification tests</p>
+
+<h1 id="SYNOPSIS">SYNOPSIS</h1>
+
+<pre><code> loadplugin Mail::SpamAssassin::Plugin::Hashcash</code></pre>
+
+<h1 id="DESCRIPTION">DESCRIPTION</h1>
+
+<p>Hashcash is a payment system for email where CPU cycles used as the basis for an e-cash system. This plugin makes it possible to use valid hashcash tokens added by mail programs as a bonus for messages.</p>
+
+<h1 id="USER-SETTINGS">USER SETTINGS</h1>
+
+<dl>
+
+<dt id="use_hashcash-1-0-default:-1">use_hashcash { 1 | 0 } (default: 1)</dt>
+<dd>
+
+<p>Whether to use hashcash, if it is available.</p>
+
+</dd>
+<dt id="hashcash_accept-user-example.com">hashcash_accept user@example.com ...</dt>
+<dd>
+
+<p>Used to specify addresses that we accept HashCash tokens for. You should set it to match all the addresses that you may receive mail at.</p>
+
+<p>Like whitelist and blacklist entries, the addresses are file-glob-style patterns, so <code>friend@somewhere.com</code>, <code>*@isp.com</code>, or <code>*.domain.net</code> will all work. Specifically, <code>*</code> and <code>?</code> are allowed, but all other metacharacters are not. Regular expressions are not used for security reasons.</p>
+
+<p>The sequence <code>%u</code> is replaced with the current user's username, which is useful for ISPs or multi-user domains.</p>
+
+<p>Multiple addresses per line, separated by spaces, is OK. Multiple <code>hashcash_accept</code> lines is also OK.</p>
+
+</dd>
+<dt id="hashcash_doublespend_path-path-to-file-default:-.spamassassin-hashcash_seen">hashcash_doublespend_path /path/to/file (default: ~/.spamassassin/hashcash_seen)</dt>
+<dd>
+
+<p>Path for HashCash double-spend database. HashCash tokens are only usable once, so their use is tracked in this database to avoid providing a loophole.</p>
+
+<p>By default, each user has their own, in their <code>~/.spamassassin</code> directory with mode 0700/0600. Note that once a token is 'spent' it is written to this file, and double-spending of a hashcash token makes it invalid, so this is not suitable for sharing between multiple users.</p>
+
+</dd>
+<dt id="hashcash_doublespend_file_mode-default:-0700">hashcash_doublespend_file_mode (default: 0700)</dt>
+<dd>
+
+<p>The file mode bits used for the HashCash double-spend database file.</p>
+
+<p>Make sure you specify this using the 'x' mode bits set, as it may also be used to create directories. However, if a file is created, the resulting file will not have any execute bits set (the umask is set to 111).</p>
+
+</dd>
+</dl>
+
+
+</body>
+
+</html>
+
+
Added: spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_Hashcash.txt
URL: http://svn.apache.org/viewvc/spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_Hashcash.txt?rev=1873332&view=auto
==============================================================================
--- spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_Hashcash.txt (added)
+++ spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_Hashcash.txt Wed Jan 29 19:05:59 2020
@@ -0,0 +1,53 @@
+NAME
+ Mail::SpamAssassin::Plugin::Hashcash - perform hashcash verification
+ tests
+
+SYNOPSIS
+ loadplugin Mail::SpamAssassin::Plugin::Hashcash
+
+DESCRIPTION
+ Hashcash is a payment system for email where CPU cycles used as the
+ basis for an e-cash system. This plugin makes it possible to use valid
+ hashcash tokens added by mail programs as a bonus for messages.
+
+USER SETTINGS
+ use_hashcash { 1 | 0 } (default: 1)
+ Whether to use hashcash, if it is available.
+
+ hashcash_accept user@example.com ...
+ Used to specify addresses that we accept HashCash tokens for. You
+ should set it to match all the addresses that you may receive mail
+ at.
+
+ Like whitelist and blacklist entries, the addresses are
+ file-glob-style patterns, so "friend@somewhere.com", "*@isp.com", or
+ "*.domain.net" will all work. Specifically, "*" and "?" are allowed,
+ but all other metacharacters are not. Regular expressions are not
+ used for security reasons.
+
+ The sequence %u is replaced with the current user's username, which
+ is useful for ISPs or multi-user domains.
+
+ Multiple addresses per line, separated by spaces, is OK. Multiple
+ "hashcash_accept" lines is also OK.
+
+ hashcash_doublespend_path /path/to/file (default:
+ ~/.spamassassin/hashcash_seen)
+ Path for HashCash double-spend database. HashCash tokens are only
+ usable once, so their use is tracked in this database to avoid
+ providing a loophole.
+
+ By default, each user has their own, in their "~/.spamassassin"
+ directory with mode 0700/0600. Note that once a token is 'spent' it
+ is written to this file, and double-spending of a hashcash token
+ makes it invalid, so this is not suitable for sharing between
+ multiple users.
+
+ hashcash_doublespend_file_mode (default: 0700)
+ The file mode bits used for the HashCash double-spend database file.
+
+ Make sure you specify this using the 'x' mode bits set, as it may
+ also be used to create directories. However, if a file is created,
+ the resulting file will not have any execute bits set (the umask is
+ set to 111).
+
Added: spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_MIMEEval.html
URL: http://svn.apache.org/viewvc/spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_MIMEEval.html?rev=1873332&view=auto
==============================================================================
--- spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_MIMEEval.html (added)
+++ spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_MIMEEval.html Wed Jan 29 19:05:59 2020
@@ -0,0 +1,94 @@
+<?xml version="1.0" ?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<title></title>
+<meta http-equiv="content-type" content="text/html; charset=utf-8" />
+<link rev="made" href="mailto:root@localhost" />
+</head>
+
+<body style="background-color: white">
+
+
+
+<ul id="index">
+ <li><a href="#NAME">NAME</a></li>
+ <li><a href="#SYNOPSIS">SYNOPSIS</a></li>
+ <li><a href="#DESCRIPTION">DESCRIPTION</a></li>
+</ul>
+
+<h1 id="NAME">NAME</h1>
+
+<p>MIMEEval - perform various tests against MIME structure and body</p>
+
+<h1 id="SYNOPSIS">SYNOPSIS</h1>
+
+<pre><code> loadplugin Mail::SpamAssassin::Plugin::MIMEEval
+
+ body NAME_OF_RULE eval:check_for_mime
+ body NAME_OF_RULE eval:check_for_mime_html
+ body NAME_OF_RULE eval:check_for_mime_html_only
+ body NAME_OF_RULE eval:check_mime_multipart_ratio
+ body NAME_OF_RULE eval:check_msg_parse_flags
+ body NAME_OF_RULE eval:check_for_ascii_text_illegal
+ body NAME_OF_RULE eval:check_abundant_unicode_ratio
+ body NAME_OF_RULE eval:check_for_faraway_charset
+ body NAME_OF_RULE eval:check_for_uppercase
+ body NAME_OF_RULE eval:check_ma_non_text
+ body NAME_OF_RULE eval:check_base64_length
+ body NAME_OF_RULE eval:check_qp_ratio</code></pre>
+
+<h1 id="DESCRIPTION">DESCRIPTION</h1>
+
+<p>Perform various tests against MIME structure and body.</p>
+
+<dl>
+
+<dt id="has_check_for_ascii_text_illegal">has_check_for_ascii_text_illegal</dt>
+<dd>
+
+<p>Adds capability check for "if can()" for check_for_ascii_text_illegal</p>
+
+</dd>
+<dt id="check_for_ascii_text_illegal">check_for_ascii_text_illegal</dt>
+<dd>
+
+<p>If a MIME part claims to be text/plain or text/plain;charset=us-ascii and the Content-Transfer-Encoding is 7bit (either explicitly or by default), then we should enforce the actual text being only TAB, NL, SPACE through TILDE, i.e. all 7bit characters excluding NO-WS-CTL (per RFC-2822).</p>
+
+<p>All mainstream MTA's get this right.</p>
+
+</dd>
+<dt id="has_check_abundant_unicode_ratio">has_check_abundant_unicode_ratio</dt>
+<dd>
+
+<p>Adds capability check for "if can()" for check_abundant_unicode_ratio</p>
+
+</dd>
+<dt id="check_abundant_unicode_ratio">check_abundant_unicode_ratio</dt>
+<dd>
+
+<p>A MIME part claiming to be text/plain and containing Unicode characters must be encoded as quoted-printable or base64, or use UTF data coding (typically with 8bit encoding). Any message in 7bit or 8bit encoding containing (HTML) Unicode entities will not render them as Unicode, but literally.</p>
+
+<p>Thus a few such sequences might occur on a mailing list of developers discussing such characters, but a message with a high density of such characters is likely spam.</p>
+
+</dd>
+<dt id="has_check_qp_ratio">has_check_qp_ratio</dt>
+<dd>
+
+<p>Adds capability check for "if can()" for check_qp_ratio</p>
+
+</dd>
+<dt id="check_qp_ratio">check_qp_ratio</dt>
+<dd>
+
+<p>Takes a min ratio to use in eval to see if there is an spamminess to the ratio of quoted printable to total bytes in an email.</p>
+
+</dd>
+</dl>
+
+
+</body>
+
+</html>
+
+
Added: spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_MIMEEval.txt
URL: http://svn.apache.org/viewvc/spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_MIMEEval.txt?rev=1873332&view=auto
==============================================================================
--- spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_MIMEEval.txt (added)
+++ spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_MIMEEval.txt Wed Jan 29 19:05:59 2020
@@ -0,0 +1,57 @@
+NAME
+ MIMEEval - perform various tests against MIME structure and body
+
+SYNOPSIS
+ loadplugin Mail::SpamAssassin::Plugin::MIMEEval
+
+ body NAME_OF_RULE eval:check_for_mime
+ body NAME_OF_RULE eval:check_for_mime_html
+ body NAME_OF_RULE eval:check_for_mime_html_only
+ body NAME_OF_RULE eval:check_mime_multipart_ratio
+ body NAME_OF_RULE eval:check_msg_parse_flags
+ body NAME_OF_RULE eval:check_for_ascii_text_illegal
+ body NAME_OF_RULE eval:check_abundant_unicode_ratio
+ body NAME_OF_RULE eval:check_for_faraway_charset
+ body NAME_OF_RULE eval:check_for_uppercase
+ body NAME_OF_RULE eval:check_ma_non_text
+ body NAME_OF_RULE eval:check_base64_length
+ body NAME_OF_RULE eval:check_qp_ratio
+
+DESCRIPTION
+ Perform various tests against MIME structure and body.
+
+ has_check_for_ascii_text_illegal
+ Adds capability check for "if can()" for
+ check_for_ascii_text_illegal
+
+ check_for_ascii_text_illegal
+ If a MIME part claims to be text/plain or
+ text/plain;charset=us-ascii and the Content-Transfer-Encoding is
+ 7bit (either explicitly or by default), then we should enforce the
+ actual text being only TAB, NL, SPACE through TILDE, i.e. all 7bit
+ characters excluding NO-WS-CTL (per RFC-2822).
+
+ All mainstream MTA's get this right.
+
+ has_check_abundant_unicode_ratio
+ Adds capability check for "if can()" for
+ check_abundant_unicode_ratio
+
+ check_abundant_unicode_ratio
+ A MIME part claiming to be text/plain and containing Unicode
+ characters must be encoded as quoted-printable or base64, or use UTF
+ data coding (typically with 8bit encoding). Any message in 7bit or
+ 8bit encoding containing (HTML) Unicode entities will not render
+ them as Unicode, but literally.
+
+ Thus a few such sequences might occur on a mailing list of
+ developers discussing such characters, but a message with a high
+ density of such characters is likely spam.
+
+ has_check_qp_ratio
+ Adds capability check for "if can()" for check_qp_ratio
+
+ check_qp_ratio
+ Takes a min ratio to use in eval to see if there is an spamminess to
+ the ratio of quoted printable to total bytes in an email.
+
Added: spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_MIMEHeader.html
URL: http://svn.apache.org/viewvc/spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_MIMEHeader.html?rev=1873332&view=auto
==============================================================================
--- spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_MIMEHeader.html (added)
+++ spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_MIMEHeader.html Wed Jan 29 19:05:59 2020
@@ -0,0 +1,57 @@
+<?xml version="1.0" ?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<title></title>
+<meta http-equiv="content-type" content="text/html; charset=utf-8" />
+<link rev="made" href="mailto:root@localhost" />
+</head>
+
+<body style="background-color: white">
+
+
+
+<ul id="index">
+ <li><a href="#NAME">NAME</a></li>
+ <li><a href="#SYNOPSIS">SYNOPSIS</a></li>
+ <li><a href="#DESCRIPTION">DESCRIPTION</a></li>
+ <li><a href="#RULE-DEFINITIONS-AND-PRIVILEGED-SETTINGS">RULE DEFINITIONS AND PRIVILEGED SETTINGS</a></li>
+</ul>
+
+<h1 id="NAME">NAME</h1>
+
+<p>MIMEHeader - perform regexp tests against MIME headers</p>
+
+<h1 id="SYNOPSIS">SYNOPSIS</h1>
+
+<pre><code> loadplugin Mail::SpamAssassin::Plugin::MIMEHeader
+ mimeheader NAME_OF_RULE Content-Id =~ /foo/</code></pre>
+
+<h1 id="DESCRIPTION">DESCRIPTION</h1>
+
+<p>This plugin allows regexp rules to be written against MIME headers in the message.</p>
+
+<h1 id="RULE-DEFINITIONS-AND-PRIVILEGED-SETTINGS">RULE DEFINITIONS AND PRIVILEGED SETTINGS</h1>
+
+<dl>
+
+<dt id="mimeheader-NAME_OF_RULE-Header-Name-pattern-modifiers">mimeheader NAME_OF_RULE Header-Name =~ /pattern/modifiers</dt>
+<dd>
+
+<p>Specify a rule. <code>NAME_OF_RULE</code> is the name of the rule to be used, <code>Header-Name</code> is the name of the MIME header to check, and <code>/pattern/modifiers</code> is the Perl regular expression to match against this.</p>
+
+<p>Note that in a message of multiple parts, each header will be checked against the pattern separately. In other words, if multiple parts have a 'Content-Type' header, each header's value will be tested individually as a separate string.</p>
+
+<p>Header names are considered case-insensitive.</p>
+
+<p>The header values are normally cleaned up a little; for example, whitespace around the newline character in "folded" headers will be replaced with a single space. Append <code>:raw</code> to the header name to retrieve the raw, undecoded value, including pristine whitespace, instead.</p>
+
+</dd>
+</dl>
+
+
+</body>
+
+</html>
+
+
Added: spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_MIMEHeader.txt
URL: http://svn.apache.org/viewvc/spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_MIMEHeader.txt?rev=1873332&view=auto
==============================================================================
--- spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_MIMEHeader.txt (added)
+++ spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_MIMEHeader.txt Wed Jan 29 19:05:59 2020
@@ -0,0 +1,31 @@
+NAME
+ MIMEHeader - perform regexp tests against MIME headers
+
+SYNOPSIS
+ loadplugin Mail::SpamAssassin::Plugin::MIMEHeader
+ mimeheader NAME_OF_RULE Content-Id =~ /foo/
+
+DESCRIPTION
+ This plugin allows regexp rules to be written against MIME headers in
+ the message.
+
+RULE DEFINITIONS AND PRIVILEGED SETTINGS
+ mimeheader NAME_OF_RULE Header-Name =~ /pattern/modifiers
+ Specify a rule. "NAME_OF_RULE" is the name of the rule to be used,
+ "Header-Name" is the name of the MIME header to check, and
+ "/pattern/modifiers" is the Perl regular expression to match against
+ this.
+
+ Note that in a message of multiple parts, each header will be
+ checked against the pattern separately. In other words, if multiple
+ parts have a 'Content-Type' header, each header's value will be
+ tested individually as a separate string.
+
+ Header names are considered case-insensitive.
+
+ The header values are normally cleaned up a little; for example,
+ whitespace around the newline character in "folded" headers will be
+ replaced with a single space. Append ":raw" to the header name to
+ retrieve the raw, undecoded value, including pristine whitespace,
+ instead.
+