rspamd/conf/scores.d/rbl_group.conf

# RBL rules scores
#
# Please don't modify this file as your changes might be overwritten with
# the next update.
#
# You can modify '$LOCAL_CONFDIR/rspamd.conf.local.override' to redefine
# parameters defined on the top level
#
# You can modify '$LOCAL_CONFDIR/rspamd.conf.local' to add
# parameters defined on the top level
#
# For specific modules or configuration you can also modify
# '$LOCAL_CONFDIR/local.d/file.conf' - to add your options or rewrite defaults
# '$LOCAL_CONFDIR/override.d/file.conf' - to override the defaults
#
# See https://rspamd.com/doc/tutorials/writing_rules.html for details

symbols = {

    "DNSWL_BLOCKED" {
        weight = 0.0;
        description = "Resolver blocked due to excessive queries";
        groups = ["dnswl", "blocked"];
    }
    "RCVD_IN_DNSWL" {
        weight = 0.0;
        description = "Unrecognised result from https://www.dnswl.org";
        groups = ["dnswl"];
    }
    "RCVD_IN_DNSWL_NONE" {
        weight = 0.0;
        description = "Sender listed at https://www.dnswl.org, no trust";
        groups = ["dnswl"];
    }
    "RCVD_IN_DNSWL_LOW" {
        weight = -0.1;
        description = "Sender listed at https://www.dnswl.org, low trust";
        groups = ["dnswl"];
    }
    "RCVD_IN_DNSWL_MED" {
        weight = -0.2;
        description = "Sender listed at https://www.dnswl.org, medium trust";
        groups = ["dnswl"];
    }
    "RCVD_IN_DNSWL_HI" {
        weight = -0.5;
        description = "Sender listed at https://www.dnswl.org, high trust";
        groups = ["dnswl"];
    }

    "DWL_DNSWL_BLOCKED" {
        weight = 0.0;
        description = "Resolver blocked due to excessive queries (dwl)";
        groups = ["dnswl", "blocked"];
    }
    "DWL_DNSWL" {
        weight = 0.0;
        description = "Unrecognised result from https://www.dnswl.org (dwl)";
        groups = ["dnswl"];
    }
    "DWL_DNSWL_NONE" {
        weight = 0.0;
        description = "Message has a valid dkim signature originated from domain listed at https://www.dnswl.org, no trust";
        groups = ["dnswl"];
    }
    "DWL_DNSWL_LOW" {
        weight = -1.0;
        description = "Message has a valid dkim signature originated from domain listed at https://www.dnswl.org, low trust";
        groups = ["dnswl"];
    }
    "DWL_DNSWL_MED" {
        weight = -2.0;
        description = "Message has a valid dkim signature originated from domain listed at https://www.dnswl.org, medium trust";
        groups = ["dnswl"];
    }
    "DWL_DNSWL_HI" {
        weight = -3.5;
        description = "Message has a valid dkim signature originated from domain listed at https://www.dnswl.org, high trust";
        groups = ["dnswl"];
    }

    "RBL_SPAMHAUS" {
        weight = 0.0;
        description = "Unrecognised result from Spamhaus ZEN";
        groups = ["spamhaus"];
    }
    "RBL_SPAMHAUS_SBL" {
        weight = 2.0;
        description = "From address is listed in ZEN SBL";
        groups = ["spamhaus"];
    }
    "RBL_SPAMHAUS_CSS" {
        weight = 2.0;
        description = "From address is listed in ZEN CSS";
        groups = ["spamhaus"];
    }
    "RBL_SPAMHAUS_XBL" {
        weight = 4.0;
        description = "From address is listed in ZEN XBL";
        groups = ["spamhaus"];
    }
    "RBL_SPAMHAUS_XBL_ANY" {
        weight = 4.0;
        description = "From or received address is listed in ZEN XBL (any list)";
        groups = ["spamhaus"];
    }
    "RBL_SPAMHAUS_PBL" {
        weight = 2.0;
        description = "From address is listed in ZEN PBL (ISP list)";
        groups = ["spamhaus"];
    }
    "RBL_SPAMHAUS_DROP" {
        weight = 7.0;
        description = "From address is listed in ZEN DROP BL";
        groups = ["spamhaus"];
    }
    "RECEIVED_SPAMHAUS_SBL" {
        weight = 1.0;
        description = "Received address is listed in ZEN SBL";
        groups = ["spamhaus"];
        one_shot = true;
    }
    "RECEIVED_SPAMHAUS_CSS" {
        weight = 1.0;
        description = "Received address is listed in ZEN CSS";
        groups = ["spamhaus"];
        one_shot = true;
    }
    "RECEIVED_SPAMHAUS_XBL" {
        weight = 3.0;
        description = "Received address is listed in ZEN XBL";
        groups = ["spamhaus"];
        one_shot = true;
    }
    "RECEIVED_SPAMHAUS_PBL" {
        weight = 0.0;
        description = "Received address is listed in ZEN PBL (ISP list)";
        groups = ["spamhaus"];
        one_shot = true;
    }
    "RECEIVED_SPAMHAUS_DROP" {
        weight = 6.0;
        description = "Received address is listed in ZEN DROP BL";
        groups = ["spamhaus"];
        one_shot = true;
    }

    "RBL_SENDERSCORE" {
        weight = 2.0;
        description = "From address is listed in senderscore.com BL";
    }
    "MAILSPIKE" {
        weight = 0.0;
        description = "Unrecognised result from Mailspike";
        groups = ["mailspike"];
    }
    "RWL_MAILSPIKE_NEUTRAL" {
        weight = 0.0;
        description = "Neutral result from Mailspike";
        groups = ["mailspike"];
    }
    "RBL_MAILSPIKE_WORST" {
        weight = 2.0;
        description = "From address is listed in RBL - worst possible reputation";
        groups = ["mailspike"];
    }
    "RBL_MAILSPIKE_VERYBAD" {
        weight = 1.5;
        description = "From address is listed in RBL - very bad reputation";
        groups = ["mailspike"];
    }
    "RBL_MAILSPIKE_BAD" {
        weight = 1.0;
        description = "From address is listed in RBL - bad reputation";
        groups = ["mailspike"];
    }
    "RWL_MAILSPIKE_POSSIBLE" {
        weight = 0.0;
        description = "From address is listed in RWL - possibly legit";
        groups = ["mailspike"];
    }
    "RWL_MAILSPIKE_GOOD" {
        weight = 0.0;
        description = "From address is listed in RWL - good reputation";
        groups = ["mailspike"];
    }
    "RWL_MAILSPIKE_VERYGOOD" {
        weight = 0.0;
        description = "From address is listed in RWL - very good reputation";
        groups = ["mailspike"];
    }
    "RWL_MAILSPIKE_EXCELLENT" {
        weight = 0.0;
        description = "From address is listed in RWL - excellent reputation";
        groups = ["mailspike"];
    }

    "RBL_SEM" {
        weight = 1.0;
        description = "From address is listed in Spameatingmonkey RBL";
        groups = ["sem"];
    }

    "RBL_SEM_IPV6" {
        weight = 1.0;
        description = "From address is listed in Spameatingmonkey RBL (IPv6)";
        groups = ["sem"];
    }

    "RBL_VIRUSFREE_BOTNET" {
        weight = 2.0;
        description = "From address is listed in virusfree.cz BL";
    }

    "RBL_NIXSPAM" {
        weight = 4.0;
        description = "From address is listed in NiX Spam (http://www.dnsbl.manitu.net/)";
    }

    "RBL_BLOCKLISTDE" {
        weight = 4.0;
        description = "From address is listed in Blocklist (https://www.blocklist.de/)";
        groups = ["blocklistde"];
    }

    "RECEIVED_BLOCKLISTDE" {
        weight = 3.0;
        description = "Received address is listed in Blocklist (https://www.blocklist.de/)";
        groups = ["blocklistde"];
        one_shot = true;
    }
}