1 # -*- mode: spamassassin -*-
3 ## This file contains rules which match various automatic responders
4 ## which give us backscatter. The scores here are best guesses; and
5 ## may need to be overridden for recipients which actually want these
9 body QMAILBOUNCE /This\s*is\s*the\s*qmail-send\s*program/i
10 describe QMAILBOUNCE Stupid qmail bounces; we don't want them
13 # don 2009-02-05 (the following are all for various stupid auto-repsonse things)
14 header RECEIVEDMAIL subject =~ /(?:received\s*your\s*mail|(?:respuesta|risposta|response) (?:autom.tica|automatic)|auto(?:matic|m.tica)?\s*(?:respuesta|risposta|response))/i
15 describe RECEIVEDMAIL It's great that you've received our mail and automatically responded. We don't care
18 body AUTOREBOD /(?:received\s*your\s*mail|(?:respuesta|risposta|response) (?:autom.tica|automatic)|auto(?:matic|m.tica)?\s*(?:respuesta|risposta|response))/i
19 describe AUTOREBOD It's great that you've automatically responded
22 header YOURMESSAGE subject =~ /your message/i
23 describe YOURMESSAGE It's great that our message did something; we don't care
26 body YOURMESSAGEBOD /^Your message/i
27 describe YOURMESSAGEBOD It's great that our message did something; we don't care
28 score YOURMESSAGEBOD 2.5
30 body NODELIVERY /(?could not be|has not been) delivered/i
31 describe NODELIVERY We don't care if it could be or has not been delivered
34 body NORESEND /do not resend your original message/i
35 describe NORESEND If you don't want us to resend our message, why tell us?
38 header PROOFPOINT from =~ /proofpoint/
39 describe PROOFPOINT Automatic mail from proofpoint (some MTA thingie)
42 body NOTPROCBOUNCE /was not processed by our system/i
43 describe NOTPROCBOUNCE Bounce by system that was not processed
46 body ACCOUNTNOTEXIST /(?:account\s+\S+\s+(does\s*not|doesn't)\s*exist|(?:invalid|not a valid) e-?mail address)/i
47 describe ACCOUNTNOTEXIST It's not our problem if an account doesn't exist
48 score ACCOUNTNOTEXIST 2
50 body CR_SYSTEM1 /sent by a human and not a computer/i
51 describe CR_SYSTEM1 Looks like a challenge/response system
54 body CR_SYSTEM2 /do not reply/i
55 describe CR_SYSTEM2 Body contains do not reply; likely a CR system
58 body CR_SYSTEM3 /confirm this request/i
59 describe CR_SYSTEM3 Body contains confirm this request; likely a CR system
62 header CR_SYSTEM4 subject =~ /challenge.*response/i
63 describe CR_SYSTEM4 Subject contains challenge/response
66 body CR_SYSTEM5 /confirmation of list posting/i
67 describe CR_SYSTEM5 Body asks us to confirm a list posting
70 header CR_SYSTEM6 subject =~ /^confirm\:/i
71 describe CR_SYSTEM6 Subject asks us to confirm something; we don't want to
74 body SUPPORTMAIL1 /assigned a ticket/
75 describe SUPPORTMAIL1 Message from an automated support/response system
78 header SUPPORTMAIL2 subject =~ /^\[*(?:update\s*to\s*)?ticket/
79 describe SUPPORTMAIL2 Message with ticket leading it; probably a support mail
80 score SUPPORTMAIL2 1.5
82 body SUPPORTMAIL3 /the email address \S+ is not registered/i
83 describe SUPPORTMAIL3 We don't care if an e-mail address is not registered
84 score SUPPORTMAIL3 1.5
86 body SUPPORTMAIL4 /(reached an unmonitored e-mail address|no response will be given)/i
87 describe SUPPORTMAIL4 Yeay for dumb auto-response bots that don't want a response
88 score SUPPORTMAIL4 1.5
90 header SUPPORTMAIL5 from =~ /\bsupport\@/i
91 describe SUPPORTMAIL5 Message from an address that looks like support@
92 score SUPPORTMAIL5 1.5
94 header FROMAUTOREPLY from =~ /(autoreply|no-?repl(?:y|ies))/i
95 describe FROMAUTOREPLY Message from an autoreplier or something who doesn't seem to want a reply
98 header FROMABUSE from =~ /\babbuse\@/i
99 describe FROMABUSE Message from abbuse@somedomain
102 header FROMSPAMCOP from =~ /spamcop\@/i
103 describe FROMSPAMCOP Message from spamcop@somedomain
104 score FROMSPAMCOP 3.5
106 header SUBJECTSPAM subject =~ /(?:\*\*|\[)\s*spam\s*(?:\*\*|\])/i
107 describe SUBJECTSPAM Subject contains **spam** or [spam], so it's probably spam
108 score SUBJECTSPAM 3.5
110 header MESBLOCKED subject =~ /your message (?:is )?blocked/i
111 describe MESBLOCKED That's great that our message was blocked
114 header FAILDELIVERY subject =~ /failed to deliver/i
115 describe FAILDELIVERY Oh noes! You failed to deliver spam!
118 header NEWADDRESS subject =~ /new e-?mail address/i
119 describe NEWADDRESS We don't care that you have a new e-mail address
122 header VACATIONMAIL1 user-agent =~ /vacation/i
123 describe VACATIONMAIL1 Mail from the vacation user agent
124 score VACATIONMAIL1 0.1
126 header VACATIONMAIL2 X-Vacation =~ /./
127 describe VACATIONMAIL2 Has an X-Vacation header
128 score VACATIONMAIL2 0.1
130 meta VACATIONMAIL (VACATIONMAIL1 || VACATIONMAIL2)
131 describe VACATIONMAIL Looks like a vacation message