+header FROMABUSE from =~ /\babbuse\@/i
+describe FROMABUSE Message from abbuse@somedomain
+score FROMABUSE 1.5
+
+header FROMSPAMCOP from =~ /spamcop\@/i
+describe FROMSPAMCOP Message from spamcop@somedomain
+score FROMSPAMCOP 3.5
+
+header SUBJECTSPAM subject =~ /(?:\*\*|\[)\s*spam\s*(?:\*\*|\])/i
+describe SUBJECTSPAM Subject contains **spam** or [spam], so it's probably spam
+score SUBJECTSPAM 3.5
+
+header MESBLOCKED subject =~ /your message (?:is )?blocked/i
+describe MESBLOCKED That's great that our message was blocked
+score MESBLOCKED 2
+
+header FAILDELIVERY subject =~ /failed to deliver/i
+describe FAILDELIVERY Oh noes! You failed to deliver spam!
+score FAILDELIVERY 2
+
+header NEWADDRESS subject =~ /(?:new e-?mail address|deaktivierung der mailadresse)/i
+describe NEWADDRESS We don't care that you have a new e-mail address
+score NEWADDRESS 4
+
+header VACATIONMAIL1 user-agent =~ /vacation/i
+describe VACATIONMAIL1 Mail from the vacation user agent
+score VACATIONMAIL1 0.1
+
+header VACATIONMAIL2 X-Vacation =~ /./
+describe VACATIONMAIL2 Has an X-Vacation header
+score VACATIONMAIL2 0.1