← Back
Editing: rbl_group.conf
# RBL rules scores # # Please don't modify this file as your changes might be overwritten with # the next update. # # You can modify '$LOCAL_CONFDIR/rspamd.conf.local.override' to redefine # parameters defined on the top level # # You can modify '$LOCAL_CONFDIR/rspamd.conf.local' to add # parameters defined on the top level # # For specific modules or configuration you can also modify # '$LOCAL_CONFDIR/local.d/rbl_group.conf' - to add your options or rewrite defaults # '$LOCAL_CONFDIR/override.d/rbl_group.conf' - to override the defaults # # See https://rspamd.com/doc/developers/writing_rules.html for details description = "IP DNS lists"; symbols = { "DNSWL_BLOCKED" { weight = 0.0; description = "https://www.dnswl.org: Resolver blocked due to excessive queries"; groups = ["dnswl", "blocked"]; } "RCVD_IN_DNSWL" { weight = 0.0; description = "Unrecognised result from https://www.dnswl.org"; groups = ["dnswl"]; } "RCVD_IN_DNSWL_NONE" { weight = 0.0; description = "Sender listed at https://www.dnswl.org, no trust"; groups = ["dnswl"]; } "RCVD_IN_DNSWL_LOW" { weight = -0.1; description = "Sender listed at https://www.dnswl.org, low trust"; groups = ["dnswl"]; } "RCVD_IN_DNSWL_MED" { weight = -0.2; description = "Sender listed at https://www.dnswl.org, medium trust"; groups = ["dnswl"]; } "RCVD_IN_DNSWL_HI" { weight = -0.5; description = "Sender listed at https://www.dnswl.org, high trust"; groups = ["dnswl"]; } "DWL_DNSWL_BLOCKED" { weight = 0.0; description = "https://www.dnswl.org: Resolver blocked due to excessive queries (DWL)"; groups = ["dnswl", "blocked"]; } "DWL_DNSWL" { weight = 0.0; description = "Unrecognised result from https://www.dnswl.org (DWL)"; groups = ["dnswl"]; } "DWL_DNSWL_NONE" { weight = 0.0; description = "Message has a valid dkim signature originated from domain listed at https://www.dnswl.org, no trust"; groups = ["dnswl"]; } "DWL_DNSWL_LOW" { weight = -1.0; description = "Message has a valid dkim signature originated from domain listed at https://www.dnswl.org, low trust"; groups = ["dnswl"]; } "DWL_DNSWL_MED" { weight = -2.0; description = "Message has a valid dkim signature originated from domain listed at https://www.dnswl.org, medium trust"; groups = ["dnswl"]; } "DWL_DNSWL_HI" { weight = -3.5; description = "Message has a valid dkim signature originated from domain listed at https://www.dnswl.org, high trust"; groups = ["dnswl"]; } "RBL_SPAMHAUS" { weight = 0.0; description = "Unrecognised result from Spamhaus ZEN"; groups = ["spamhaus"]; } "RBL_SPAMHAUS_SBL" { weight = 4.0; description = "From address is listed in Spamhaus SBL"; groups = ["spamhaus"]; } "RBL_SPAMHAUS_CSS" { weight = 2.0; description = "From address is listed in Spamhaus CSS"; groups = ["spamhaus"]; } "RBL_SPAMHAUS_XBL" { weight = 4.0; description = "From address is listed in Spamhaus XBL"; groups = ["spamhaus"]; } "RBL_SPAMHAUS_PBL" { weight = 2.0; description = "From address is listed in Spamhaus PBL"; groups = ["spamhaus"]; } "RBL_SPAMHAUS_DROP" { weight = 7.0; description = "From address is listed in Spamhaus DROP"; groups = ["spamhaus"]; } "RBL_SPAMHAUS_BLOCKED_OPENRESOLVER" { weight = 0.0; description = "You are querying Spamhaus from an open resolver, please see https://www.spamhaus.org/returnc/pub/"; groups = ["spamhaus", "blocked"]; } "RBL_SPAMHAUS_BLOCKED" { weight = 0.0; description = "You are exceeding the query limit, please see https://www.spamhaus.org/returnc/vol/"; groups = ["spamhaus", "blocked"]; } "RECEIVED_SPAMHAUS_SBL" { weight = 3.0; description = "Received address is listed in Spamhaus SBL"; groups = ["spamhaus"]; one_shot = true; } "RECEIVED_SPAMHAUS_CSS" { weight = 1.0; description = "Received address is listed in Spamhaus CSS"; groups = ["spamhaus"]; one_shot = true; } "RECEIVED_SPAMHAUS_XBL" { weight = 1.0; description = "Received address is listed in Spamhaus XBL"; groups = ["spamhaus"]; one_shot = true; } "RECEIVED_SPAMHAUS_PBL" { weight = 0.0; description = "Received address is listed in Spamhaus PBL"; groups = ["spamhaus"]; one_shot = true; } "RECEIVED_SPAMHAUS_DROP" { weight = 6.0; description = "Received address is listed in Spamhaus DROP"; groups = ["spamhaus"]; one_shot = true; } "RECEIVED_SPAMHAUS_BLOCKED_OPENRESOLVER" { weight = 0.0; description = "You are querying Spamhaus from an open resolver, please see https://www.spamhaus.org/returnc/pub/"; groups = ["spamhaus", "blocked"]; } "RECEIVED_SPAMHAUS_BLOCKED" { weight = 0.0; description = "You are exceeding the query limit, please see https://www.spamhaus.org/returnc/vol/"; groups = ["spamhaus", "blocked"]; } "RBL_SENDERSCORE_UNKNOWN" { weight = 0.0; description = "Unrecognised result from SenderScore RPBL"; } "RBL_SENDERSCORE_BOT" { weight = 2.0; description = "From address is listed in SenderScore RPBL - botnet"; groups = ["senderscore"]; } "RBL_SENDERSCORE_NA" { weight = 0.0; description = "From address is listed in SenderScore RPBL - noauth"; groups = ["senderscore"]; } "RBL_SENDERSCORE_NA_BOT" { weight = 1.0; description = "From address is listed in SenderScore RPBL - noauth+botnet"; groups = ["senderscore"]; } "RBL_SENDERSCORE_PRST" { weight = 2.0; description = "From address is listed in SenderScore RPBL - pristine"; groups = ["senderscore"]; } "RBL_SENDERSCORE_PRST_BOT" { weight = 3.0; description = "From address is listed in SenderScore RPBL - pristine+botnet"; groups = ["senderscore"]; } "RBL_SENDERSCORE_PRST_NA" { weight = 2.0; description = "From address is listed in SenderScore RPBL - pristine+noauth"; groups = ["senderscore"]; } "RBL_SENDERSCORE_PRST_NA_BOT" { weight = 3.0; description = "From address is listed in SenderScore RPBL - pristine+noauth+botnet"; groups = ["senderscore"]; } "RBL_SENDERSCORE_SUS_ATT" { weight = 1.0; description = "From address is listed in SenderScore RPBL - suspect_attachments"; groups = ["senderscore"]; } "RBL_SENDERSCORE_SUS_ATT_NA" { weight = 1.0; description = "From address is listed in SenderScore RPBL - suspect_attachments+noauth"; groups = ["senderscore"]; } "RBL_SENDERSCORE_SUS_ATT_NA_BOT" { weight = 1.5; description = "From address is listed in SenderScore RPBL - suspect_attachments+noauth+botnet"; groups = ["senderscore"]; } "RBL_SENDERSCORE_SUS_ATT_PRST_NA" { weight = 3.0; description = "From address is listed in SenderScore RPBL - suspect_attachments+pristine+noauth"; groups = ["senderscore"]; } "RBL_SENDERSCORE_SUS_ATT_PRST_NA_BOT" { weight = 3.5; description = "From address is listed in SenderScore RPBL - suspect_attachments+pristine+noauth+botnet"; groups = ["senderscore"]; } "RBL_SENDERSCORE_SCORE" { weight = 2.0; description = "From address is listed in SenderScore RPBL - sender_score"; groups = ["senderscore"]; } "RBL_SENDERSCORE_SCORE_NA" { weight = 2.0; description = "From address is listed in SenderScore RPBL - sender_score+noauth"; groups = ["senderscore"]; } "RBL_SENDERSCORE_SCORE_PRST" { weight = 4.0; description = "From address is listed in SenderScore RPBL - sender_score+pristine"; groups = ["senderscore"]; } "RBL_SENDERSCORE_SCORE_PRST_NA" { weight = 4.0; description = "From address is listed in SenderScore RPBL - sender_score+pristine+noauth"; groups = ["senderscore"]; } "RBL_SENDERSCORE_SCORE_SUS_ATT_NA" { weight = 3.0; description = "From address is listed in SenderScore RPBL - sender_score+suspect_attachments+noauth"; groups = ["senderscore"]; } "RBL_SENDERSCORE_BLOCKED" { weight = 0.0; description = "Excessive number of queries to SenderScore RPBL, more info: https://knowledge.validity.com/hc/en-us/articles/20961730681243"; groups = ["senderscore", "blocked"]; } "RBL_SENDERSCORE_REPUT_UNKNOWN" { weight = 0.0; description = "Unrecognized result from SenderScore Reputation list."; groups = ["senderscore"]; } "RBL_SENDERSCORE_REPUT_0" { weight = 4.0; description = "SenderScore Reputation: Very Bad (0-9)."; groups = ["senderscore"]; } "RBL_SENDERSCORE_REPUT_1" { weight = 3.5; description = "SenderScore Reputation: Bad (10-19)."; groups = ["senderscore"]; } "RBL_SENDERSCORE_REPUT_2" { weight = 3.0; description = "SenderScore Reputation: Bad (20-29)."; groups = ["senderscore"]; } "RBL_SENDERSCORE_REPUT_3" { weight = 2.5; description = "SenderScore Reputation: Bad (30-39)."; groups = ["senderscore"]; } "RBL_SENDERSCORE_REPUT_4" { weight = 2.0; description = "SenderScore Reputation: Bad (40-49)."; groups = ["senderscore"]; } "RBL_SENDERSCORE_REPUT_5" { weight = 1.5; description = "SenderScore Reputation: Bad (50-59)."; groups = ["senderscore"]; } "RBL_SENDERSCORE_REPUT_6" { weight = 1.0; description = "SenderScore Reputation: Bad (60-69)."; groups = ["senderscore"]; } "RBL_SENDERSCORE_REPUT_7" { weight = 0.5; description = "SenderScore Reputation: Bad (70-79)."; groups = ["senderscore"]; } "RBL_SENDERSCORE_REPUT_8" { weight = 0.0; description = "SenderScore Reputation: Neutral (80-89)."; groups = ["senderscore"]; } "RBL_SENDERSCORE_REPUT_9" { weight = -1.0; description = "SenderScore Reputation: Good (90-100)."; groups = ["senderscore"]; } "RBL_SENDERSCORE_REPUT_BLOCKED" { weight = 0.0; description = "Excessive number of queries to SenderScore RPBL, more info: https://knowledge.validity.com/hc/en-us/articles/20961730681243"; groups = ["senderscore", "blocked"]; } "MAILSPIKE" { weight = 0.0; description = "Unrecognised result from Mailspike"; groups = ["mailspike"]; } "RWL_MAILSPIKE_NEUTRAL" { weight = 0.0; description = "Neutral result from Mailspike"; groups = ["mailspike"]; } "RBL_MAILSPIKE_WORST" { weight = 2.0; description = "From address is listed in Mailspike RBL - worst possible reputation"; groups = ["mailspike"]; } "RBL_MAILSPIKE_VERYBAD" { weight = 1.5; description = "From address is listed in Mailspike RBL - very bad reputation"; groups = ["mailspike"]; } "RBL_MAILSPIKE_BAD" { weight = 1.0; description = "From address is listed in Mailspike RBL - bad reputation"; groups = ["mailspike"]; } "RWL_MAILSPIKE_POSSIBLE" { weight = 0.0; description = "From address is listed in Mailspike RWL - possibly legit"; groups = ["mailspike"]; } "RWL_MAILSPIKE_GOOD" { weight = -0.1; description = "From address is listed in Mailspike RWL - good reputation"; groups = ["mailspike"]; } "RWL_MAILSPIKE_VERYGOOD" { weight = -0.2; description = "From address is listed in Mailspike RWL - very good reputation"; groups = ["mailspike"]; } "RWL_MAILSPIKE_EXCELLENT" { weight = -0.4; description = "From address is listed in Mailspike RWL - excellent reputation"; groups = ["mailspike"]; } "RBL_SEM" { weight = 1.0; description = "From address is listed in Spameatingmonkey RBL"; groups = ["sem"]; } "RBL_SEM_IPV6" { weight = 1.0; description = "From address is listed in Spameatingmonkey RBL (IPv6)"; groups = ["sem"]; } "RBL_VIRUSFREE_BOTNET" { weight = 2.0; description = "From address is listed in virusfree.cz BL"; } "RBL_BLOCKLISTDE" { weight = 4.0; description = "From address is listed in Blocklist (https://www.blocklist.de/)"; groups = ["blocklistde"]; } "RECEIVED_BLOCKLISTDE" { weight = 3.0; description = "Received address is listed in Blocklist (https://www.blocklist.de/)"; groups = ["blocklistde"]; one_shot = true; } }
Save File
Cancel