# RBL rules scores
#
# Please don't modify this file as your changes might be overwritten with
# the next update.
#
# You can modify '$LOCAL_CONFDIR/rspamd.conf.local.override' to redefine
# parameters defined on the top level
#
# You can modify '$LOCAL_CONFDIR/rspamd.conf.local' to add
# parameters defined on the top level
#
# For specific modules or configuration you can also modify
# '$LOCAL_CONFDIR/local.d/file.conf' - to add your options or rewrite defaults
# '$LOCAL_CONFDIR/override.d/file.conf' - to override the defaults
#
# See https://rspamd.com/doc/tutorials/writing_rules.html for details

description = "IP DNS lists";

symbols = {

    "DNSWL_BLOCKED" {
        weight = 0.0;
        description = "https://www.dnswl.org: Resolver blocked due to excessive queries";
        groups = ["dnswl", "blocked"];
    }
    "RCVD_IN_DNSWL" {
        weight = 0.0;
        description = "Unrecognised result from https://www.dnswl.org";
        groups = ["dnswl"];
    }
    "RCVD_IN_DNSWL_NONE" {
        weight = 0.0;
        description = "Sender listed at https://www.dnswl.org, no trust";
        groups = ["dnswl"];
    }
    "RCVD_IN_DNSWL_LOW" {
        weight = -0.1;
        description = "Sender listed at https://www.dnswl.org, low trust";
        groups = ["dnswl"];
    }
    "RCVD_IN_DNSWL_MED" {
        weight = -0.2;
        description = "Sender listed at https://www.dnswl.org, medium trust";
        groups = ["dnswl"];
    }
    "RCVD_IN_DNSWL_HI" {
        weight = -0.5;
        description = "Sender listed at https://www.dnswl.org, high trust";
        groups = ["dnswl"];
    }

    "DWL_DNSWL_BLOCKED" {
        weight = 0.0;
        description = "https://www.dnswl.org: Resolver blocked due to excessive queries (DWL)";
        groups = ["dnswl", "blocked"];
    }
    "DWL_DNSWL" {
        weight = 0.0;
        description = "Unrecognised result from https://www.dnswl.org (DWL)";
        groups = ["dnswl"];
    }
    "DWL_DNSWL_NONE" {
        weight = 0.0;
        description = "Message has a valid dkim signature originated from domain listed at https://www.dnswl.org, no trust";
        groups = ["dnswl"];
    }
    "DWL_DNSWL_LOW" {
        weight = -1.0;
        description = "Message has a valid dkim signature originated from domain listed at https://www.dnswl.org, low trust";
        groups = ["dnswl"];
    }
    "DWL_DNSWL_MED" {
        weight = -2.0;
        description = "Message has a valid dkim signature originated from domain listed at https://www.dnswl.org, medium trust";
        groups = ["dnswl"];
    }
    "DWL_DNSWL_HI" {
        weight = -3.5;
        description = "Message has a valid dkim signature originated from domain listed at https://www.dnswl.org, high trust";
        groups = ["dnswl"];
    }

    "RBL_SPAMHAUS" {
        weight = 0.0;
        description = "Unrecognised result from Spamhaus ZEN";
        groups = ["spamhaus"];
    }
    "RBL_SPAMHAUS_SBL" {
        weight = 4.0;
        description = "From address is listed in Spamhaus SBL";
        groups = ["spamhaus"];
    }
    "RBL_SPAMHAUS_CSS" {
        weight = 2.0;
        description = "From address is listed in Spamhaus CSS";
        groups = ["spamhaus"];
    }
    "RBL_SPAMHAUS_XBL" {
        weight = 4.0;
        description = "From address is listed in Spamhaus XBL";
        groups = ["spamhaus"];
    }
    "RBL_SPAMHAUS_PBL" {
        weight = 2.0;
        description = "From address is listed in Spamhaus PBL";
        groups = ["spamhaus"];
    }
    "RBL_SPAMHAUS_DROP" {
        weight = 7.0;
        description = "From address is listed in Spamhaus DROP";
        groups = ["spamhaus"];
    }
    "RBL_SPAMHAUS_BLOCKED_OPENRESOLVER" {
        weight = 0.0;
        description = "You are querying Spamhaus from an open resolver, please see https://www.spamhaus.org/returnc/pub/";
        groups = ["spamhaus", "blocked"];
    }
    "RBL_SPAMHAUS_BLOCKED" {
        weight = 0.0;
        description = "You are exceeding the query limit, please see https://www.spamhaus.org/returnc/vol/";
        groups = ["spamhaus", "blocked"];
    }
    "RECEIVED_SPAMHAUS_SBL" {
        weight = 3.0;
        description = "Received address is listed in Spamhaus SBL";
        groups = ["spamhaus"];
        one_shot = true;
    }
    "RECEIVED_SPAMHAUS_CSS" {
        weight = 1.0;
        description = "Received address is listed in Spamhaus CSS";
        groups = ["spamhaus"];
        one_shot = true;
    }
    "RECEIVED_SPAMHAUS_XBL" {
        weight = 1.0;
        description = "Received address is listed in Spamhaus XBL";
        groups = ["spamhaus"];
        one_shot = true;
    }
    "RECEIVED_SPAMHAUS_PBL" {
        weight = 0.0;
        description = "Received address is listed in Spamhaus PBL";
        groups = ["spamhaus"];
        one_shot = true;
    }
    "RECEIVED_SPAMHAUS_DROP" {
        weight = 6.0;
        description = "Received address is listed in Spamhaus DROP";
        groups = ["spamhaus"];
        one_shot = true;
    }
    "RECEIVED_SPAMHAUS_BLOCKED_OPENRESOLVER" {
        weight = 0.0;
        description = "You are querying Spamhaus from an open resolver, please see https://www.spamhaus.org/returnc/pub/";
        groups = ["spamhaus", "blocked"];
    }
    "RECEIVED_SPAMHAUS_BLOCKED" {
        weight = 0.0;
        description = "You are exceeding the query limit, please see https://www.spamhaus.org/returnc/vol/";
        groups = ["spamhaus", "blocked"];
    }

    "RBL_SENDERSCORE_UNKNOWN" {
        weight = 0.0;
        description = "Unrecognised result from SenderScore RPBL";
    }
    "RBL_SENDERSCORE_BOT" {
        weight = 2.0;
        description = "From address is listed in SenderScore RPBL - botnet";
        groups = ["senderscore"];
    }
    "RBL_SENDERSCORE_NA" {
        weight = 0.0;
        description = "From address is listed in SenderScore RPBL - noauth";
        groups = ["senderscore"];
    }
    "RBL_SENDERSCORE_NA_BOT" {
        weight = 1.0;
        description = "From address is listed in SenderScore RPBL - noauth+botnet";
        groups = ["senderscore"];
    }
    "RBL_SENDERSCORE_PRST" {
        weight = 2.0;
        description = "From address is listed in SenderScore RPBL - pristine";
        groups = ["senderscore"];
    }
    "RBL_SENDERSCORE_PRST_BOT" {
        weight = 3.0;
        description = "From address is listed in SenderScore RPBL - pristine+botnet";
        groups = ["senderscore"];
    }
    "RBL_SENDERSCORE_PRST_NA" {
        weight = 2.0;
        description = "From address is listed in SenderScore RPBL - pristine+noauth";
        groups = ["senderscore"];
    }
    "RBL_SENDERSCORE_PRST_NA_BOT" {
        weight = 3.0;
        description = "From address is listed in SenderScore RPBL - pristine+noauth+botnet";
        groups = ["senderscore"];
    }
    "RBL_SENDERSCORE_SUS_ATT" {
        weight = 1.0;
        description = "From address is listed in SenderScore RPBL - suspect_attachments";
        groups = ["senderscore"];
    }
    "RBL_SENDERSCORE_SUS_ATT_NA" {
        weight = 1.0;
        description = "From address is listed in SenderScore RPBL - suspect_attachments+noauth";
        groups = ["senderscore"];
    }
    "RBL_SENDERSCORE_SUS_ATT_NA_BOT" {
        weight = 1.5;
        description = "From address is listed in SenderScore RPBL - suspect_attachments+noauth+botnet";
        groups = ["senderscore"];
    }
    "RBL_SENDERSCORE_SUS_ATT_PRST_NA" {
        weight = 3.0;
        description = "From address is listed in SenderScore RPBL - suspect_attachments+pristine+noauth";
        groups = ["senderscore"];
    }
    "RBL_SENDERSCORE_SUS_ATT_PRST_NA_BOT" {
        weight = 3.5;
        description = "From address is listed in SenderScore RPBL - suspect_attachments+pristine+noauth+botnet";
        groups = ["senderscore"];
    }
    "RBL_SENDERSCORE_SCORE" {
        weight = 2.0;
        description = "From address is listed in SenderScore RPBL - sender_score";
        groups = ["senderscore"];
    }
    "RBL_SENDERSCORE_SCORE_NA" {
        weight = 2.0;
        description = "From address is listed in SenderScore RPBL - sender_score+noauth";
        groups = ["senderscore"];
    }
    "RBL_SENDERSCORE_SCORE_PRST" {
        weight = 4.0;
        description = "From address is listed in SenderScore RPBL - sender_score+pristine";
        groups = ["senderscore"];
    }
    "RBL_SENDERSCORE_SCORE_PRST_NA" {
        weight = 4.0;
        description = "From address is listed in SenderScore RPBL - sender_score+pristine+noauth";
        groups = ["senderscore"];
    }
    "RBL_SENDERSCORE_SCORE_SUS_ATT_NA" {
        weight = 3.0;
        description = "From address is listed in SenderScore RPBL - sender_score+suspect_attachments+noauth";
        groups = ["senderscore"];
    }
    "RBL_SENDERSCORE_BLOCKED" {
        weight = 0.0;
        description = "Excessive number of queries to SenderScore RPBL, more info: https://knowledge.validity.com/hc/en-us/articles/20961730681243";
        groups = ["senderscore", "blocked"];
    }

    "RBL_SENDERSCORE_REPUT_UNKNOWN" {
        weight = 0.0;
        description = "Unrecognized result from SenderScore Reputation list.";
        groups = ["senderscore"];
    }
    "RBL_SENDERSCORE_REPUT_0" {
        weight = 4.0;
        description = "SenderScore Reputation: Very Bad (0-9).";
        groups = ["senderscore"];
    }
    "RBL_SENDERSCORE_REPUT_1" {
        weight = 3.5;
        description = "SenderScore Reputation: Bad (10-19).";
        groups = ["senderscore"];
    }
    "RBL_SENDERSCORE_REPUT_2" {
        weight = 3.0;
        description = "SenderScore Reputation: Bad (20-29).";
        groups = ["senderscore"];
    }
    "RBL_SENDERSCORE_REPUT_3" {
        weight = 2.5;
        description = "SenderScore Reputation: Bad (30-39).";
        groups = ["senderscore"];
    }
    "RBL_SENDERSCORE_REPUT_4" {
        weight = 2.0;
        description = "SenderScore Reputation: Bad (40-49).";
        groups = ["senderscore"];
    }
    "RBL_SENDERSCORE_REPUT_5" {
        weight = 1.5;
        description = "SenderScore Reputation: Bad (50-59).";
        groups = ["senderscore"];
    }
    "RBL_SENDERSCORE_REPUT_6" {
        weight = 1.0;
        description = "SenderScore Reputation: Bad (60-69).";
        groups = ["senderscore"];
    }
    "RBL_SENDERSCORE_REPUT_7" {
        weight = 0.5;
        description = "SenderScore Reputation: Bad (70-79).";
        groups = ["senderscore"];
    }
    "RBL_SENDERSCORE_REPUT_8" {
        weight = 0.0;
        description = "SenderScore Reputation: Neutral (80-89).";
        groups = ["senderscore"];
    }
    "RBL_SENDERSCORE_REPUT_9" {
        weight = -1.0;
        description = "SenderScore Reputation: Good (90-100).";
        groups = ["senderscore"];
    }
    "RBL_SENDERSCORE_REPUT_BLOCKED" {
        weight = 0.0;
        description = "Excessive number of queries to SenderScore RPBL, more info: https://knowledge.validity.com/hc/en-us/articles/20961730681243";
        groups = ["senderscore", "blocked"];
    }

    "MAILSPIKE" {
        weight = 0.0;
        description = "Unrecognised result from Mailspike";
        groups = ["mailspike"];
    }
    "RWL_MAILSPIKE_NEUTRAL" {
        weight = 0.0;
        description = "Neutral result from Mailspike";
        groups = ["mailspike"];
    }
    "RBL_MAILSPIKE_WORST" {
        weight = 2.0;
        description = "From address is listed in Mailspike RBL - worst possible reputation";
        groups = ["mailspike"];
    }
    "RBL_MAILSPIKE_VERYBAD" {
        weight = 1.5;
        description = "From address is listed in Mailspike RBL - very bad reputation";
        groups = ["mailspike"];
    }
    "RBL_MAILSPIKE_BAD" {
        weight = 1.0;
        description = "From address is listed in Mailspike RBL - bad reputation";
        groups = ["mailspike"];
    }
    "RWL_MAILSPIKE_POSSIBLE" {
        weight = 0.0;
        description = "From address is listed in Mailspike RWL - possibly legit";
        groups = ["mailspike"];
    }
    "RWL_MAILSPIKE_GOOD" {
        weight = -0.1;
        description = "From address is listed in Mailspike RWL - good reputation";
        groups = ["mailspike"];
    }
    "RWL_MAILSPIKE_VERYGOOD" {
        weight = -0.2;
        description = "From address is listed in Mailspike RWL - very good reputation";
        groups = ["mailspike"];
    }
    "RWL_MAILSPIKE_EXCELLENT" {
        weight = -0.4;
        description = "From address is listed in Mailspike RWL - excellent reputation";
        groups = ["mailspike"];
    }

    "RBL_SEM" {
        weight = 1.0;
        description = "From address is listed in Spameatingmonkey RBL";
        groups = ["sem"];
    }

    "RBL_SEM_IPV6" {
        weight = 1.0;
        description = "From address is listed in Spameatingmonkey RBL (IPv6)";
        groups = ["sem"];
    }

    "RBL_VIRUSFREE_BOTNET" {
        weight = 2.0;
        description = "From address is listed in virusfree.cz BL";
    }

    "RBL_NIXSPAM" {
        weight = 4.0;
        description = "From address is listed in NiX Spam (https://www.nixspam.net/)";
    }

    "RBL_BLOCKLISTDE" {
        weight = 4.0;
        description = "From address is listed in Blocklist (https://www.blocklist.de/)";
        groups = ["blocklistde"];
    }

    "RECEIVED_BLOCKLISTDE" {
        weight = 3.0;
        description = "Received address is listed in Blocklist (https://www.blocklist.de/)";
        groups = ["blocklistde"];
        one_shot = true;
    }
}