diff --git a/CHANGELOG.md b/CHANGELOG.md index 56a3eab..521fa6d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,18 @@ All notable changes to this project will be documented in this file. This project adheres to [Semantic Versioning](http://semver.org/). +## [2.0.1] - 2025-01-06 + +### Added +- Tag `RCPT_DOMAIN_IN_MESSAGE`. + +### Changed +- Removed known DMARC senders list. +- Removed `ALLOWLIST_DMARC` and `BLOCKLIST_DMARC` tags. + +### Fixed + + ## [2.0.0] - 2025-01-02 ### Added diff --git a/lists/known_dmarc.toml b/lists/known_dmarc.toml deleted file mode 100644 index 52dd180..0000000 --- a/lists/known_dmarc.toml +++ /dev/null @@ -1,787 +0,0 @@ -[lookup] -known-dmarc-domains = {"18f.gov", -"1password.com", -"2gis.com", -"4chan.org", -"4pda.ru", -"9-11commission.gov", -"911.gov", -"aberdeenshire.gov.uk", -"abilityone.gov", -"absolutbank.ru", -"access-board.gov", -"acquisition.gov", -"acus.gov", -"ada.gov", -"adf.gov", -"adidas.co.kr", -"adidas.com.au", -"adidas.com.br", -"adidas.com.hk", -"adidas.fi", -"adidas.fr", -"admongo.gov", -"adobe.dk", -"adobe.es", -"adobeawards.com", -"adp.com", -"advice.hmrc.gov.uk", -"aerocivil.gov.co", -"afreximbank.com", -"agingstats.gov", -"agro.ru", -"ahcpr.gov", -"aids.gov", -"airbnb.co.uk", -"airbnb.com", -"airbnb.com.tr", -"airbnb.cz", -"airbnb.de", -"airbnb.fi", -"airbnb.fr", -"airbnb.pl", -"airbnb.ru", -"airbnb.se", -"airnow.gov", -"airtel.in", -"alfabank.com", -"alfabank.ru", -"alfastrah.ru", -"alibaba.com", -"aliexpress.com", -"alipay.com", -"alkupone.ru", -"alzheimers.gov", -"amazon.co.uk", -"amazon.com", -"amazon.com.br", -"amberalert.gov", -"americanexpress.com", -"ameslab.gov", -"angus.gov.uk", -"anidub.com", -"annapolis.gov", -"anstaskforce.gov", -"apple.com.au", -"apple.com.cn", -"apps.gov", -"archives.gov", -"arctic.gov", -"arionbanki.is", -"asg.com", -"asic.gov.au", -"askona.ru", -"asos.com", -"assist.ru", -"atf.gov", -"avast.com", -"avg.com", -"avito.ru", -"avtoradio.ru", -"axisbank.com", -"badoo.com", -"baltbank.ru", -"bank.lv", -"banki.ru", -"bankofamerica.com", -"barclaycard.co.uk", -"barclays.co.uk", -"barclays.com", -"battle.net", -"beeline.kz", -"beeline.ru", -"benefits.gov", -"betfaq.ru", -"biglion.ru", -"binary.com", -"binbank.ru", -"bioethics.gov", -"biometrics.gov", -"biopreferred.gov", -"birminghampost.net", -"bishopsmove.com", -"bitbank.cc", -"bjs.gov", -"blizzard.com", -"blog.gov.uk", -"bls.gov", -"bluestarindia.com", -"boemre.gov", -"bolsover.gov.uk", -"bolton.gov.uk", -"booking.com", -"bookmate.com", -"books.ru", -"bournemouth.gov.uk", -"box.com", -"bpa.gov", -"brandshop.ru", -"bridgend.gov.uk", -"brighton-hove.gov.uk", -"britishembassy.gov.uk", -"broadbandmap.gov", -"bromley.gov.uk", -"bts.gov", -"business.gov", -"caerphilly.gov.uk", -"caixa.gov.br", -"cambridge-news.co.uk", -"campaign.gov.uk", -"cancer.gov", -"cannockchasedc.gov.uk", -"capitalone.co.uk", -"cardiff.gov.uk", -"carecredit.com", -"cbp.gov", -"cdfifund.gov", -"centralbedfordshire.gov.uk", -"ceredigion.gov.uk", -"cesg.gov.uk", -"cfda.gov", -"cfo.gov", -"challenge.gov", -"change.org", -"chase.com", -"chcoc.gov", -"childstats.gov", -"cio.gov", -"circle.com", -"citibank.ae", -"citibank.co.in", -"citibank.co.uk", -"citibank.com.my", -"citibank.hu", -"citibank.pl", -"cloud.gov", -"cloudflare.com", -"cms.gov", -"co-operativebank.co.uk", -"colgate.com.br", -"collegedrinkingprevention.gov", -"companies-house.gov.uk", -"comuneap.gov.it", -"conab.gov.br", -"concerts.com", -"consultant.ru", -"contact-sys.com", -"copeland.gov.uk", -"cosla.gov.uk", -"courtservice.gov.uk", -"coventry.gov.uk", -"cre.gov.uk", -"csosa.gov", -"cuidadodesalud.gov", -"culturarecreacionydeporte.gov.co", -"customs.gov.my", -"customs.gov.ua", -"cybercrime.gov", -"dailypost.co.uk", -"danskebank.dk", -"danskebank.fi", -"danskebank.ie", -"danskebank.no", -"dartford.gov.uk", -"dartmoor.gov.uk", -"dataprotection.gov.uk", -"daventrydc.gov.uk", -"dellin.ru", -"denbighshire.gov.uk", -"deutsche-bank.de", -"deutschebank.be", -"deutschebank.co.in", -"dh.gov.uk", -"dhl.com", -"dhs.gov", -"diablo3.com", -"digital.gov", -"digitalgov.gov", -"digitalliteracy.gov", -"disability.gov", -"disability.gov.uk", -"dnfsb.gov", -"docker.com", -"docusign.net", -"doe.gov", -"doioig.gov", -"dol.gov", -"doleta.gov", -"domofond.ru", -"drought.gov", -"drugabuse.gov", -"dsns.gov.ua", -"dtv.gov", -"dudley.gov.uk", -"dyslexiaida.org", -"e-boks.dk", -"e-verify.gov", -"eastdunbarton.gov.uk", -"eaststaffsbc.gov.uk", -"eastsuffolk.gov.uk", -"ebay.be", -"ebay.ca", -"ebay.ch", -"ebay.co.uk", -"ebay.com", -"ebay.com.au", -"ebay.com.cn", -"ebay.de", -"ebay.es", -"ebay.eu", -"ebay.fr", -"ebay.in", -"ebay.it", -"ebay.se", -"economy.gov.tr", -"econsumer.gov", -"ed.gov", -"eftps.gov", -"ehsni.gov.uk", -"eia.gov", -"ejob.gov.tw", -"elance.com", -"eldorado.ru", -"email-ee.co.uk", -"email.tektorg.ru", -"emarsys.com", -"ems.gov", -"energystar.gov", -"erewash.gov.uk", -"esetnod32.ru", -"essex-fire.gov.uk", -"eubank.kz", -"evernote.com", -"everychildmatters.gov.uk", -"evus.gov", -"exist.ru", -"expediamail.com", -"facebook.com", -"facebookmail.com", -"fbi.gov", -"fcc.gov", -"fco.gov.uk", -"fdic.gov", -"feb.gov", -"federalreserve.gov", -"fedex.com", -"fedramp.gov", -"fedshirevets.gov", -"feedthefuture.gov", -"fema.gov", -"ferc.gov", -"fhfa.gov", -"fhfaoig.gov", -"fife.gov.uk", -"financialresearch.gov", -"financialstability.gov", -"firstbankpb.bank", -"firstbankpb.com", -"firstnet.gov", -"firstresponder.gov", -"fishwatch.gov", -"fitness.gov", -"flagma.ua", -"flamp.ru", -"fletc.gov", -"fmc.gov", -"fmcs.gov", -"foia.gov", -"food.gov.uk", -"force.com", -"fordlibrarymuseum.gov", -"foreignassistance.gov", -"foreigntrade.gov.tr", -"franklinwi.gov", -"ftc.gov", -"ftccomplaintassistant.gov", -"gamereactor.dk", -"gap.com", -"garant.ru", -"geekbrains.ru", -"geektimes.ru", -"getsmartaboutdrugs.gov", -"gibraltar.gov.uk", -"gitlab.com", -"globalentry.gov", -"globalhealth.gov", -"globe.gov", -"gloucestershire.gov.uk", -"goes-r.gov", -"gosuslugi.ru", -"gov.uk", -"groupon.es", -"groupon.hk", -"groupon.it", -"gsa.gov", -"gsaadvantage.gov", -"gsaauctions.gov", -"gsaig.gov", -"gtbank.com", -"guideline.gov", -"guidelines.gov", -"gwynedd.gov.uk", -"habr.com", -"hambleton.gov.uk", -"harp.gov", -"hawaiicounty.gov", -"hdfcbank.com", -"hdrezka.ag", -"healthcare.gov", -"healthypeople.gov", -"hertfordshire.gov.uk", -"hh.kz", -"hh.ru", -"highland.gov.uk", -"highwaycode.gov.uk", -"hillingdon.gov.uk", -"hiv.gov", -"hmrc.gov.uk", -"homeoffice.gov.uk", -"homesales.gov", -"hotels.com", -"hounslow.gov.uk", -"howto.gov", -"hru.gov", -"huduser.gov", -"hurricanes.gov", -"iba.gov.au", -"ice.gov", -"idmanagement.gov", -"ikea.ch", -"ikea.co.uk", -"ikea.com", -"ikea.de", -"ikea.fr", -"ikea.gr", -"ikea.nl", -"ikea.pl", -"imgur.com", -"incometaxindiaefiling.gov.in", -"ing.com", -"inl.gov", -"inlandrevenue.gov.uk", -"insider.co.uk", -"insolvency.gov.uk", -"instagram.com", -"insurekidsnow.gov", -"invasivespeciesinfo.gov", -"investor.gov", -"irda.gov.in", -"itunes.com", -"jccbi.gov", -"jd.ru", -"jet.com", -"jimmycarterlibrary.gov", -"job.com", -"johnsonsbaby.co.uk", -"joybuy.com", -"jpmorgan.com", -"jpmorgansecurities.com", -"judiciary.gov.uk", -"justice.gov", -"justice.gov.az", -"justice.gov.uk", -"jyskebank.dk", -"kassy.ru", -"kent.gov.uk", -"keys.openpgp.org", -"kids.gov", -"kingston.gov.uk", -"kivra.com", -"klarna.com", -"klarna.se", -"kpk.gov.pl", -"lacoast.gov", -"landsbanki.is", -"lanl.gov", -"lbhf.gov.uk", -"lcd.gov.uk", -"learningcurve.gov.uk", -"leeds.gov.uk", -"leroymerlin.es", -"lichfielddc.gov.uk", -"lincoln.gov.uk", -"lincolnshire.gov.uk", -"linkedin.com", -"livejournal.com", -"llnl.gov", -"lloydsbank.com", -"locatorplus.gov", -"lostfilm.tv", -"louisvilleco.gov", -"love.ru", -"lufthansa-group.com", -"lufthansa.com", -"mackeeper.com", -"mailgun.net", -"mak.com", -"mandtbank.com", -"mcc.gov", -"mcga.gov.uk", -"mchenrycountyil.gov", -"mecknc.gov", -"mediamarkt.se", -"medicaid.gov", -"medicare.gov", -"medium.com", -"megafon.ru", -"megaplan.ru", -"mercadolibre.com.ar", -"mercadolivre.com.br", -"merseyfire.gov.uk", -"merthyr.gov.uk", -"meshok.ru", -"messenger.com", -"microsoft.net", -"middlesbrough.gov.uk", -"midlothian.gov.uk", -"mil.ru", -"mincit.gov.co", -"minhacienda.gov.co", -"minsvyaz.ru", -"mintic.gov.co", -"mirrorfootball.co.uk", -"mkb.ru", -"mlg.ru", -"mlg.tv", -"mns.gov.ua", -"mod.gov.az", -"molisa.gov.vn", -"mos.ru", -"mosoblbank.ru", -"mosreg.ru", -"motinfo.gov.uk", -"movavi.com", -"msha.gov", -"mspb.gov", -"msport.gov.pl", -"murfreesborotn.gov", -"mvideo.ru", -"mxtoolbox.com", -"mymoney.gov", -"myplate.gov", -"myra.gov", -"myshared.ru", -"n-kesteven.gov.uk", -"n-somerset.gov.uk", -"nads.gov.ua", -"nalog.ru", -"namus.gov", -"nasa.gov", -"nationalarchives.gov.uk", -"nationalservice.gov", -"nationsreportcard.gov", -"nbr.gov.bd", -"nbtbank.com", -"ncifcrf.gov", -"ncpw.gov", -"nctb.gov.bd", -"ne-derbyshire.gov.uk", -"nea.gov", -"nelincs.gov.uk", -"neobux.com", -"neolane.net", -"netflix.com", -"newegg.com", -"newmoney.gov", -"nga.gov", -"ngu.gov.ua", -"nhtsa.gov", -"nic.ru", -"nidw.gov.bd", -"nij.gov", -"nio.gov.uk", -"niscc.gov.uk", -"nist.gov", -"nixonlibrary.gov", -"nkh.gov.hu", -"noaa.gov", -"nordea.dk", -"nordea.com", -"nordea.fi", -"nordea.no", -"nordea.se", -"north-ayrshire.gov.uk", -"north-norfolk.gov.uk", -"northlincs.gov.uk", -"norwich.gov.uk", -"notifications.service.gov.uk", -"nottinghamcity.gov.uk", -"nrc-gateway.gov", -"nrc.gov", -"nrel.gov", -"nsf.gov", -"nsopr.gov", -"nsopw.gov", -"nwtrb.gov", -"oculus.com", -"ofcm.gov", -"office.com", -"officemag.ru", -"ok.ru", -"omb.gov", -"ombudsman.gov.tr", -"onedrive.com", -"onguardonline.gov", -"opengl.org", -"openinternet.gov", -"ordsvy.gov.uk", -"ornl.gov", -"oshrc.gov", -"osti.gov", -"oxfordshire.gov.uk", -"ozon.ru", -"paauditor.gov", -"paccar.com", -"paddle8.com", -"pandemicflu.gov", -"passport.gov.uk", -"payeer.com", -"paymentaccuracy.gov", -"paypal-community.com", -"paypal.be", -"paypal.cn", -"paypal.co.il", -"paypal.co.uk", -"paypal.com", -"paypal.com.au", -"paypal.com.br", -"paypal.com.mx", -"paypal.de", -"paypal.dk", -"paypal.es", -"paypal.fr", -"paypal.nl", -"paypal.se", -"pbgc.gov", -"pc.gov.au", -"pch.com", -"penanghill.gov.my", -"pepfar.gov", -"performance.gov", -"pinterest.co.kr", -"pinterest.com", -"pinterest.de", -"pinterest.jp", -"pinterest.se", -"pkc.gov.uk", -"planeta.ru", -"platron.ru", -"plymouth.gov.uk", -"pm.gov.uk", -"pmf.gov", -"pmi.gov", -"pncbank.com", -"pokerstars.com", -"pokerstars.fr", -"pokerstars.it", -"pokerstars.net", -"priorbank.by", -"privatbank.ua", -"prospertx.gov", -"prostocash.com", -"provident.bank", -"psbank.ru", -"psc.gov", -"punjab.gov.in", -"puzzle-english.com", -"qiwi.com", -"qiwi.ru", -"rabota.ru", -"rbkc.gov.uk", -"ready.gov", -"reaganlibrary.gov", -"redbridge.gov.uk", -"reddit.com", -"reebok.es", -"reebok.nl", -"reginfo.gov", -"regulations.gov", -"reisebank.de", -"renfrewshire.gov.uk", -"rentonwa.gov", -"reportband.gov", -"rgs.ru", -"richmond.gov.uk", -"rivers.gov", -"rkn.gov.ru", -"ros.gov.uk", -"roseltorg.ru", -"rostelecom.ru", -"roundrocktexas.gov", -"royalmail.com", -"rozetka.com.ua", -"rt.com", -"rt.ru", -"rushcliffe.gov.uk", -"rutubeinfo.ru", -"sacn.gov.uk", -"safercar.gov", -"samhsa.gov", -"sanmarcostx.gov", -"sberbank.ru", -"sberbank-ast.ru", -"sbir.gov", -"sbis.ru", -"scality.com", -"scdhhs.gov", -"science360.gov", -"sciencebase.gov", -"scijinks.gov", -"sec.gov", -"secretservice.gov", -"section508.gov", -"semnan.ac.ir", -"senate.gov", -"sendgrid.net", -"seniorcorps.gov", -"serpro.gov.br", -"service.gov.uk", -"sftool.gov", -"shetland.gov.uk", -"shropshire-cc.gov.uk", -"shutterstock.com", -"sigtarp.gov", -"sk.ru", -"skat.dk", -"skatteverket.se", -"skbbank.ru", -"skittles.com", -"skydio.com", -"skype.com", -"slideshare.com", -"smart.gov", -"smida.gov.ua", -"smokefree.gov", -"snickers.com", -"solardecathlon.gov", -"sourceforge.net", -"south-ayrshire.gov.uk", -"sovest.ru", -"spbrealty.ru", -"sportmaster.ru", -"squarespace.com", -"sravni.ru", -"srs.gov", -"staffordbc.gov.uk", -"stat.gov.az", -"stedmundsbury.gov.uk", -"sthelens.gov.uk", -"stihl.ru", -"stopalcoholabuse.gov", -"stopfraud.gov", -"studentloans.gov", -"subscribe.ru", -"suffolkcc.gov.uk", -"suncorpbank.com.au", -"sundaymirror.co.uk", -"sunlight.net", -"superjob.ru", -"surestart.gov.uk", -"sutton.gov.uk", -"swansea.gov.uk", -"swift.com", -"symantec.com", -"synologynotification.com", -"taobao.com", -"tatar.ru", -"tauntondeane.gov.uk", -"tda.gov.uk", -"tdk.gov.tr", -"tdscpc.gov.in", -"telework.gov", -"tenders.gov.au", -"textmagic.com", -"tfhrc.gov", -"thebell.io", -"thecoolspot.gov", -"thinkroadsafety.gov.uk", -"tiaabank.com", -"ticketland.ru", -"tinder.com", -"tinkoff.ru", -"tomsk.gov.ru", -"torbay.gov.uk", -"tradingstandards.gov.uk", -"treas.gov", -"trial-sport.ru", -"tsa.gov", -"tst.gov.br", -"tuba.gov.tr", -"turystyka.gov.pl", -"tutu.ru", -"twitch.tv", -"twitter.com", -"twix.com", -"uber.com", -"ucarecdn.com", -"ucrdatatool.gov", -"udall.gov", -"ukvisas.gov.uk", -"ulmart.ru", -"unicor.gov", -"uniras.gov.uk", -"ups.com", -"uralairlines.ru", -"us-cert.gov", -"usa.gov", -"usadf.gov", -"usaid.gov", -"usap.gov", -"uscg.gov", -"usconsulate.gov", -"usmission.gov", -"usphs.gov", -"uspis.gov", -"usps.com", -"usps.gov", -"ustreas.gov", -"utair.ru", -"utkonos.ru", -"vaccines.gov", -"valeofglamorgan.gov.uk", -"verizonwireless.com", -"vigoda.ru", -"visa.co.uk", -"visa.com", -"visa.com.ar", -"visa.com.br", -"visa.com.cn", -"visa.com.tw", -"visa.pl", -"vistacampus.gov", -"vk.com", -"vkrugudruzei.ru", -"vkusnyblog.ru", -"vmc.gov.in", -"voa.gov.uk", -"volunteer.gov", -"vote.gov", -"walsall.gov.uk", -"wandsworth.gov.uk", -"wartimecontracting.gov", -"warwickdc.gov.uk", -"wealden.gov.uk", -"wellingtonfl.gov", -"west-lindsey.gov.uk", -"westernunion.com", -"westernunion.ru", -"westlothian.gov.uk", -"whatsapp.com", -"whistleblowers.gov", -"wirral.gov.uk", -"wlga.gov.uk", -"womenshealth.gov", -"wrexham.gov.uk", -"wrigley.com", -"wrp.gov", -"yandex-team.ru", -"york.gov.uk", -"youla.ru", -"youth.gov", -"youthrules.gov", -"youtube.com", -"zcts.ru", -"zendesk.com", -"zionsbank.com", -"zomato.com"} - diff --git a/lists/scores.toml b/lists/scores.toml index 2a2f847..71a2ef7 100644 --- a/lists/scores.toml +++ b/lists/scores.toml @@ -1,6 +1,5 @@ [spam-filter.list] scores = {"ABUSE_SURBL" = "5.0", -"ALLOWLIST_DMARC" = "-7.0", "ARC_ALLOW" = "0.0", "ARC_DNSFAIL" = "0.0", "ARC_INVALID" = "0.5", @@ -12,7 +11,6 @@ scores = {"ABUSE_SURBL" = "5.0", "AUTOGEN_PHP_SPAMMY" = "1.0", "BAYES_HAM" = "-3.0", "BAYES_SPAM" = "5.1", -"BLOCKLIST_DMARC" = "6.0", "BODY_URI_ONLY" = "2.0", "BOGUS_ENCRYPTED_AND_TEXT" = "10.0", "BOUNCE" = "-0.1", @@ -235,6 +233,7 @@ scores = {"ABUSE_SURBL" = "5.0", "RBL_VIRUSFREE_BOTNET" = "2.0", "RCPT_IN_SUBJECT" = "3.0", "RCPT_DOMAIN_IN_SUBJECT" = "2.0", +"RCPT_DOMAIN_IN_MESSAGE" = "2.0", "RCPT_COUNT_FIVE" = "0.0", "RCPT_COUNT_GT_50" = "1.0", "RCPT_COUNT_ONE" = "0.0", diff --git a/rules/from.toml b/rules/from.toml index 6a81f07..6fa3cfd 100644 --- a/rules/from.toml +++ b/rules/from.toml @@ -35,10 +35,10 @@ priority = 14 condition = [ { if = "is_empty(env_from) && ($IS_DSN || $HAS_MESSAGE_PARTS || ($X_HDR_X_MDDSN_MESSAGE && contains_ignore_case(from.name, 'mdaemon')))", then = "'BOUNCE'" }, { else = false } ] -[spam-filter.rule.STWT_DMARC_ALLOW_BLOCK] +[spam-filter.rule.STWT_RCPT_DOMAIN_IN_MESSAGE] enable = true scope = "any" priority = 15 -condition = [ { if = "key_exists('known-dmarc-domains', from.domain)", then = "if_then($DMARC_POLICY_ALLOW, 'ALLOWLIST_DMARC', 'BLOCKLIST_DMARC')" }, +condition = [ { if = "$RCPT_DOMAIN_IN_SUBJECT && ($RCPT_DOMAIN_IN_BODY || $RCPT_IN_BODY)", then = "'RCPT_DOMAIN_IN_MESSAGE'" }, { else = false } ] diff --git a/versions.toml b/versions.toml index c73875a..e7c15e2 100644 --- a/versions.toml +++ b/versions.toml @@ -1,3 +1,3 @@ [version] -spam-filter = "2.0.0" +spam-filter = "2.0.1" server = "0.11.0"