## Blocklists and DNS-Based Rules
# Rules related to blocklists, DNS checks, and relay listings.
score RCVD_IN_SBL_CSS 4.0 # Listed in Spamhaus SBL-CSS blocklist
score URIBL_DBL_PHISH 3.5 # Phishing URL in Spamhaus DBL
score RCVD_IN_VALIDITY_RPBL 2.0 # Relay in Validity RPBL
score URIBL_BLOCKED 1.5 # Blocked URI query
score URIBL_CSS_A 0.1 # URL's A record in Spamhaus CSS
score URIBL_SBL_A 0.1 # URL's A record in Spamhaus SBL
score RCVD_IN_MSPIKE_L3 0.9 # Low reputation in Mailspike
score RCVD_IN_MSPIKE_BL 0.0 # Listed in Mailspike blocklist
score RCVD_IN_DNSWL_BLOCKED 1.0 # Query to DNSWL blocked
## SPF, DKIM, and DMARC Authentication
# Rules related to email authentication mechanisms.
score SPF_SOFTFAIL 1.0 # SPF record softfail
score SPF_HELO_NONE 0.5 # Missing SPF in HELO command
score SPF_PASS -0.5 # SPF passed
score SPF_HELO_PASS -0.5 # SPF HELO passed
score DKIM_INVALID 0.1 # Invalid DKIM signature
score DKIM_SIGNED 0.1 # Message has a DKIM signature
score DKIM_VALID -0.5 # Valid DKIM signature
score DKIM_VALID_AU -0.5 # Valid DKIM from author's domain
score DKIM_VALID_EF -0.5 # Valid DKIM from envelope-from
score DMARC_MISSING 1.0 # Missing DMARC policy
score DMARC_PASS -1.0 # Valid DMARC policy
## Message Content Analysis
# Rules analyzing the content and structure of the email.
score HTML_IMAGE_RATIO_02 1.0 # Low text-to-image area ratio
score MIME_HTML_ONLY 0.5 # Message only has HTML MIME parts
score HTML_MIME_NO_HTML_TAG 0.6 # HTML message lacks HTML tag
score HTML_TAG_BALANCE_CENTER 0.5 # Malformed HTML tags
score HTML_EXTRA_CLOSE 0.2 # Excessive closing HTML tags
score HTML_SHORT_LINK_IMG_1 0.8 # Short HTML with linked image
score HTML_MESSAGE 0.1 # HTML included in message
score FROM_EXCESS_BASE64 0.5 # Unnecessary base64 encoding in From header
score URI_HEX 0.5 # URI hostname has long hex sequence
score T_PDS_OTHER_BAD_TLD 1.0 # Untrustworthy top-level domain
score KHOP_HELO_FCRDNS 1.5 # HELO differs from IP's reverse DNS
score BITCOIN_MALF_HTML 1.0 # Bitcoin mention with malformed HTML
score SHORT_IMG_SUSP_NTLD 1.0 # Short HTML with image and suspicious TLD
score FROM_SUSPICIOUS_NTLD 1.0 # From address uses suspicious TLD
score FROM_SUSPICIOUS_NTLD_FP 1.0 # From address uses abused NTLD
## Bayesian Filtering
# Rules related to Bayesian spam probability analysis.
score BAYES_05 -4.0 # Bayes probability 1% to 5%
score BAYES_20 -2.0 # Bayes probability 5% to 20%
score BAYES_50 0.0 # Bayes probability 20% to 80% (neutral)
score BAYES_60 1.0 # Bayes probability 80% to 95%
score BAYES_80 2.0 # Bayes probability 80% to 95%
score BAYES_95 4.0 # Bayes probability 95% to 99%
## Trusted and Certification Lists
# Rules that decrease score based on trusted sources or certifications.
score RCVD_IN_VALIDITY_CERTIFIED -2.0 # Sender in Validity Certified
score RCVD_IN_VALIDITY_SAFE -1.5 # Sender in Validity Safe
## Razor and Pyzor Checks
# Collaborative spam-detection networks.
score RAZOR2_CHECK 1.7 # Listed in Razor2
score RAZOR2_CF_RANGE_51_100 2.4 # Razor2 confidence level above 50%
## Miscellaneous Rules
# Other rules not categorized above.
score T_REMOTE_IMAGE 0.0 # Message contains a remote image
score MIME_QP_LONG_LINE 0.0 # Quoted-printable line longer than 76 chars
score URIBL_ABUSE_SURBL 1.9 # URL listed in ABUSE SURBL blocklist