@@ -6,3 +6,7 @@ VIRUS_FOUND {
expression = "CLAM_VIRUS & !MAILCOW_WHITE";
score = 2000;
}
+SPF_FAIL_NO_DKIM {
+ expression = "R_SPF_FAIL & R_DKIM_NA & !MAILCOW_WHITE";
+ score = 10;
+}
@@ -38,3 +38,6 @@ symbol "SPOOFED_SENDER" {
description = "Sender is not authenticated but part of mailcow managed domains";
score = 1.0;
+symbol "R_SPF_FAIL" {
+ score = 4.0;