This is the current list of tests SpamAssassin(tm) performs on mail messages to
determine if they're spam or not. If you wish to change the score from the
default, add a line like this to your ~/.spamassassin/user_prefs:
Note that these are the scores for the current stable release of SpamAssassin;
they may be different from the ones you're running on your servers, if SpamAssassin
is installed there.
|
AREA TESTED
|
LOCALE
|
DESCRIPTION OF TEST
|
TEST NAME
|
DEFAULT SCORES (local, net, with bayes, with bayes+net)
|
|
header
|
|
Message-Id indicates a non-spam MUA (Pine)
|
USER_AGENT_PINE
|
0.001
|
|
header
|
|
User-Agent header indicates a non-spam MUA (Mozilla)
|
USER_AGENT_MOZILLA_UA
|
-0.498 0.001 -0.498 0.001
|
|
header
|
|
X-Mailer header indicates a non-spam MUA (Netscape)
|
USER_AGENT_MOZILLA_XM
|
-0.275 0.001 0.001 0.001
|
|
header
|
|
User-Agent header indicates a non-spam MUA (Outlook Express)
|
USER_AGENT_MACOE
|
0.001
|
|
header
|
|
User-Agent header indicates a non-spam MUA (Entourage)
|
USER_AGENT_ENTOURAGE
|
0.001
|
|
header
|
|
User-Agent header indicates a non-spam MUA (KMail)
|
USER_AGENT_KMAIL
|
-0.399 0.001 -0.299 -0.470
|
|
header
|
|
User-Agent header indicates a non-spam MUA (IMP)
|
USER_AGENT_IMP
|
-0.460 -0.347 -0.180 -0.407
|
|
header
|
|
X-Mailer header indicates a non-spam MUA (T-Offline)
|
USER_AGENT_TONLINE
|
-0.425 -0.499 -0.189 -0.349
|
|
header
|
|
X-Mailer header indicates a non-spam MUA (Apple Mail)
|
USER_AGENT_APPLEMAIL
|
0.001
|
|
header
|
|
User-Agent header indicates a non-spam MUA (Gnus)
|
USER_AGENT_GNUS_UA
|
-0.480 -0.499 -0.499 -0.480
|
|
header
|
|
X-Mailer header indicates a non-spam MUA (Gnus)
|
USER_AGENT_GNUS_XM
|
-0.298 -0.299 -0.166 -0.141
|
|
header
|
|
X-Mailer header indicates a non-spam MUA (VM)
|
USER_AGENT_VM
|
0.001 0.001 0.001 -0.061
|
|
header
|
|
X-Mailer header indicates a non-spam MUA (Forte)
|
USER_AGENT_FORTE
|
-0.443 -0.454 -0.499 -0.499
|
|
body
|
|
Generic Test for Unsolicited Bulk Email
|
GTUBE
|
1000
|
|
full
|
|
Listed in Razor1, see http://razor.sf.net/
|
RAZOR_CHECK
|
0.0
|
|
full
|
|
Listed in Razor2, see http://razor.sf.net/
|
RAZOR2_CHECK
|
0.0 2.063 0.0 0.880
|
|
body
|
|
Razor2 gives a spam confidence level between 1 and 10
|
RAZOR2_CF_RANGE_01_10
|
0.0 0.0 0.0 0.157
|
|
body
|
|
Razor2 gives a spam confidence level between 11 and 20
|
RAZOR2_CF_RANGE_11_20
|
0.0 0.0 0.0 0.418
|
|
body
|
|
Razor2 gives a spam confidence level between 21 and 30
|
RAZOR2_CF_RANGE_21_30
|
0.0 0.0 0.0 0.767
|
|
body
|
|
Razor2 gives a spam confidence level between 31 and 40
|
RAZOR2_CF_RANGE_31_40
|
0.0 0.0 0.0 0.414
|
|
body
|
|
Razor2 gives a spam confidence level between 41 and 50
|
RAZOR2_CF_RANGE_41_50
|
0.0 0.0 0.0 0.534
|
|
body
|
|
Razor2 gives a spam confidence level between 51 and 60
|
RAZOR2_CF_RANGE_51_60
|
0.0 0.0 0.0 0.594
|
|
body
|
|
Razor2 gives a spam confidence level between 61 and 70
|
RAZOR2_CF_RANGE_61_70
|
0.0
|
|
body
|
|
Razor2 gives a spam confidence level between 71 and 80
|
RAZOR2_CF_RANGE_71_80
|
0.0 0.0 0.0 1.909
|
|
body
|
|
Razor2 gives a spam confidence level between 81 and 90
|
RAZOR2_CF_RANGE_81_90
|
0.0 0.0 0.0 0.959
|
|
body
|
|
Razor2 gives a spam confidence level between 91 and 100
|
RAZOR2_CF_RANGE_91_100
|
0.0 0.0 0.0 1.208
|
|
full
|
|
Listed in DCC, see http://rhyolite.com/anti-spam/dcc/
|
DCC_CHECK
|
0.0 3.017 0.0 2.635
|
|
full
|
|
Listed in Pyzor, see http://pyzor.sf.net/
|
PYZOR_CHECK
|
0.0 4.400 0.0 1.211
|
|
body
|
|
List removal information
|
REMOVE_IN_QUOTES
|
0.001 0.197 0.001 0.301
|
|
body
|
|
Click-to-remove with mailto: found beforehand
|
CLICK_TO_REMOVE_2
|
0.700 0.626 0.717 0.0
|
|
rawbody
|
|
Contains an ASCII-formatted form
|
ASCII_FORM_ENTRY
|
0.0 1.070 0.0 0.834
|
|
body
|
|
Incorporates a tracking ID number
|
TRACKER_ID
|
2.574 3.376 2.898 4.295
|
|
body
|
|
RAND found, spammer forgot to run the random-ID generator
|
MARKUP_RAND
|
2.900
|
|
body
|
|
SSPL found, spammer forgot to run the random-ID generator
|
MARKUP_SSPL
|
0.0
|
|
body
|
|
Contains a large block of hexadecimal code
|
LARGE_HEX
|
1.151 0.502 0.524 1.378
|
|
body
|
|
A WHOLE LINE OF YELLING DETECTED
|
LINES_OF_YELLING
|
0.0
|
|
body
|
|
2 WHOLE LINES OF YELLING DETECTED
|
LINES_OF_YELLING_2
|
0.0
|
|
body
|
|
3 WHOLE LINES OF YELLING DETECTED
|
LINES_OF_YELLING_3
|
0.0
|
|
body
|
|
Weird repeated double-quotation marks in body
|
WEIRD_QUOTING
|
1.066 1.545 0.313 1.923
|
|
rawbody
|
|
Message text disguised using base-64 encoding
|
BASE64_ENC_TEXT
|
2.354 1.643 1.544 1.768
|
|
rawbody
|
|
Excessive quoted-printable encoding in body
|
MIME_EXCESSIVE_QP
|
0.0
|
|
rawbody
|
|
Message text in HTML without specified charset
|
MIME_HTML_NO_CHARSET
|
0.638 0.759 0.365 0.0
|
|
rawbody
|
|
Quoted-printable line longer than 76 characters
|
MIME_LONG_LINE_QP
|
0.261 0.155 0.051 0.0
|
|
rawbody
|
|
MIME section missing boundary
|
MIME_MISSING_BOUNDARY
|
0.501 0.163 0.0 1.334
|
|
rawbody
|
|
Message includes Microsoft executable program
|
MICROSOFT_EXECUTABLE
|
0.100
|
|
rawbody
|
|
MIME filename does not match content
|
MIME_SUSPECT_NAME
|
0.100
|
|
body
|
|
Character set indicates a foreign language
|
CHARSET_FARAWAY
|
3.200
|
|
body
|
|
Written in an undesired language
|
UNDESIRED_LANGUAGE_BODY
|
3.970
|
|
body
|
|
Body includes 8 consecutive 8-bit characters
|
BODY_8BITS
|
1.500
|
|
rawbody
|
|
Deficient quoted-printable encoding in body
|
MIME_DEFICIENT_QP
|
2.300 2.093 2.172 2.696
|
|
header
|
|
Uses the Habeas warrant mark (http://www.habeas.com/)
|
HABEAS_SWE
|
-4.600
|
|
header
|
|
Message from eBay
|
GENUINE_EBAY_RCVD
|
-1.615 -1.593 -1.401 -0.624
|
|
header
|
|
Has an Approved-By moderated list header
|
APPROVED_BY
|
-0.398 -0.157 -0.182 -0.147
|
|
header
|
|
Looks like a Bugzilla bug
|
BUGZILLA_BUG
|
-1.401 -1.401 -1.690 -1.401
|
|
header
|
|
Looks like a Debian BTS bug
|
DEBIAN_BTS_BUG
|
-1.401 -1.401 0.0 -2.710
|
|
header
|
|
From Majordomo
|
MAJORDOMO
|
-0.317 0.0 -0.035 0.0
|
|
header
|
|
Has a valid-looking References header
|
REFERENCES
|
-0.498 -0.499 -0.498 -0.001
|
|
header
|
|
Has a X-Cron-Env header
|
CRON_ENV
|
-0.380 -0.388 -0.270 -0.341
|
|
header
|
|
Has a In-Reply-To header
|
IN_REP_TO
|
-0.498 -0.499 -0.498 -0.369
|
|
header
|
|
Has a X-Authentication-Warning header
|
X_AUTH_WARNING
|
-0.498 -0.399 0.0 -0.398
|
|
header
|
|
Has a X-Mailing-List header
|
X_MAILING_LIST
|
0.001
|
|
header
|
|
Has a X-Loop header
|
X_LOOP
|
0.001
|
|
header
|
|
Has a X-Accept-Language header
|
X_ACCEPT_LANG
|
0.0 -0.095 0.0 0.0
|
|
header
|
|
Has a Resent-To header
|
RESENT_TO
|
-0.498 -0.192 -0.398 0.0
|
|
header
|
|
Email came from some known mailing list software
|
KNOWN_MAILING_LIST
|
-0.536 -0.872 -0.168 -0.300
|
|
body
|
|
Came from MSN Communities
|
MSN_GROUPS
|
0.0
|
|
header
|
|
Subject is an eBay question
|
Q_FOR_SELLER
|
-0.499 -0.278 -0.399 -0.399
|
|
header
|
|
Subject contains newsletter header (in review)
|
SUBJECT_IS_IN_REVIEW
|
0.0
|
|
header
|
|
Appears to be from yahoo groups
|
FROM_EGROUPS
|
-0.498 -0.499 0.0 -0.306
|
|
header
|
|
'Message-Id' was added by yahoo.com, that's OK
|
YAHOO_MSGID_ADDED
|
0.0
|
|
body
|
|
Common footer for Hotmail
|
HOTMAIL_FOOTER1
|
0.0 0.0 -0.231 -0.044
|
|
body
|
|
Common footer for Hotmail
|
HOTMAIL_FOOTER2
|
0.0 0.0 -0.210 0.0
|
|
body
|
|
Common footer for Hotmail
|
HOTMAIL_FOOTER3
|
0.0
|
|
body
|
|
Common footer for Hotmail
|
HOTMAIL_FOOTER5
|
-0.207 0.0 0.0 0.0
|
|
body
|
|
Common footer for MSN
|
MSN_FOOTER1
|
0.0 -0.177 -0.496 0.0
|
|
body
|
|
Yahoo! Groups message
|
GROUPS_YAHOO_1
|
-0.498 -0.499 -0.498 -0.497
|
|
full
|
|
Short signature present (no empty lines)
|
SIGNATURE_SHORT_DENSE
|
0.0
|
|
full
|
|
Short signature present (empty lines)
|
SIGNATURE_SHORT_SPARSE
|
0.0
|
|
full
|
|
Long signature present (no empty lines)
|
SIGNATURE_LONG_DENSE
|
-0.499 -0.221 0.0 -0.491
|
|
full
|
|
Long signature present (empty lines)
|
SIGNATURE_LONG_SPARSE
|
-0.498 0.0 -0.497 -0.494
|
|
body
|
|
A MailMan confirm-your-address message
|
MAILMAN_CONFIRM
|
0.0
|
|
header
|
|
Contains a PGP-signed message (signature attached)
|
PGP_SIGNATURE_2
|
-2.595 -2.454 -2.715 -2.207
|
|
rawbody
|
|
Contains what looks like a patch from diff -u
|
PATCH_UNIFIED_DIFF
|
-0.499 -0.499 -0.388 -0.498
|
|
rawbody
|
|
Contains what looks like a patch from diff -c
|
PATCH_CONTEXT_DIFF
|
0.0 -0.188 -0.100 -0.288
|
|
body
|
|
Contains what looks like an 'E-Mail Disclaimer'
|
DISCLAIMER_LEGALESE
|
0.0 0.0 -0.033 0.0
|
|
body
|
|
Contains what looks like an email attribution
|
EMAIL_ATTRIBUTION
|
-0.498 -0.499 -0.462 -0.498
|
|
rawbody
|
|
Contains what looks like a quoted email text
|
QUOTED_EMAIL_TEXT
|
-0.498 -0.481 -0.472 -0.380
|
|
body
|
|
Contains twice quoted reply
|
QUOTE_TWICE_1
|
-0.283 0.0 -0.498 0.0
|
|
body
|
|
Contains a password retrieval system
|
FORGOTTEN_PASSWORD
|
-0.170 -0.399 -0.095 -0.143
|
|
header
|
|
Where are you working at?
|
HAS_ORGANIZATION
|
0.0
|
|
body
|
|
Common footer for Hotmail
|
HOTMAIL_FOOTER4
|
0.0 -0.164 0.0 0.0
|
|
header
|
|
From the Mailer-Daemon
|
MAILER_DAEMON
|
0.0 0.0 0.0 -0.398
|
|
header
|
|
Mailer daemon failure notice (1)
|
FAILURE_NOTICE_1
|
0.0 -0.299 0.0 0.0
|
|
body
|
|
Mailer daemon failure notice (2)
|
FAILURE_NOTICE_2
|
0.0 -0.399 0.0 0.0
|
|
header
|
|
Forwarded email
|
FWD_MSG
|
0.0 -0.299 0.0 0.0
|
|
header
|
|
Message-Id indicates the message was sent from MS Exchange
|
MSGID_GOOD_EXCHANGE
|
-0.498 -0.376 0.0 -0.142
|
|
header
|
|
From: does not include a real name
|
NO_REAL_NAME
|
0.993 0.820 1.137 1.149
|
|
header
|
|
From: ends in numbers
|
FROM_ENDS_IN_NUMS
|
0.609 0.745 0.608 0.641
|
|
header
|
|
From: starts with nums
|
FROM_STARTS_WITH_NUMS
|
0.499 0.0 0.0 0.0
|
|
header
|
|
From: contains numbers mixed in with letters
|
FROM_HAS_MIXED_NUMS
|
0.0 0.0 0.508 0.062
|
|
header
|
|
Uses an address with lots of numbers, at a big ISP
|
ADDR_NUMS_AT_BIGSITE
|
0.659 0.555 1.962 2.051
|
|
header
|
|
From address is "at something-offers"
|
FROM_OFFERS
|
4.300 4.299 4.300 4.299
|
|
header
|
|
From: has no local-part before @ sign
|
FROM_NO_USER
|
1.773 0.928 2.796 2.587
|
|
header
|
|
To: has no local-part before @ sign
|
TO_NO_USER
|
2.796 2.799 2.796 2.324
|
|
header
|
|
To: address contains spaces
|
TO_HAS_SPACES
|
0.037 0.0 0.0 0.0
|
|
header
|
|
To: is empty
|
TO_EMPTY
|
1.994 2.596 1.725 2.497
|
|
header
|
|
Reply-To: is empty
|
REPLY_TO_EMPTY
|
1.805 0.498 0.586 1.875
|
|
header
|
|
Reply-To: contains an underline and numbers/letters
|
REPLY_TO_HAS_UNDERLINE_NUMS
|
0.500 0.501 1.820 0.001
|
|
header
|
|
To: repeats address as real name
|
TO_ADDRESS_EQ_REAL
|
0.635 0.0 1.198 0.209
|
|
header
|
|
Valid-looking To "undisclosed-recipients"
|
UNDISC_RECIPS
|
1.751 1.170 0.0 0.0
|
|
header
|
|
Faked To "Undisclosed-Recipients"
|
FAKED_UNDISC_RECIPS
|
4.300
|
|
header
|
|
Subject has exclamation mark and question mark
|
PLING_QUERY
|
0.382 0.699 0.867 0.070
|
|
header
|
|
Subject contains a unique ID
|
SUBJ_HAS_UNIQ_ID
|
1.082 1.254 0.668 0.453
|
|
header
|
|
Subject contains lots of white space
|
SUBJ_HAS_SPACES
|
1.388 1.702 1.519 3.531
|
|
header
|
|
Subject is all capitals
|
SUBJ_ALL_CAPS
|
1.099 1.148 0.817 0.491
|
|
header
|
|
Message-Id has no @ sign
|
MSGID_HAS_NO_AT
|
0.100 0.0 0.0 0.0
|
|
header
|
|
Message-Id generated by a spam tool
|
MSGID_SPAMSIGN_1
|
2.900
|
|
header
|
|
Message-Id generated by spam tool (zeroes variant)
|
MSGID_SPAMSIGN_ZEROES
|
4.400 4.300 4.300 4.300
|
|
header
|
|
Message-Id generated by spam tool (6-letter variant)
|
MSGID_SPAMSIGN_6LETTER
|
4.400 4.400 4.300 4.300
|
|
header
|
|
Message-Id generated by spam tool (4-zeroes variant)
|
MSGID_OE_SPAM_4ZERO
|
2.129 3.489 4.300 4.300
|
|
header
|
|
Message-Id generated by spam tool (3-dollars variant)
|
MSGID_3_DOLLARS
|
2.900
|
|
header
|
|
Message-Id generated by spam tool (4-num-dollar variant)
|
MSGID_4NUMS_DOLLAR
|
2.900
|
|
header
|
|
Message-Id has characters indicating spam
|
MSGID_CHARS_SPAM
|
0.218 0.0 1.138 0.342
|
|
header
|
|
Message-Id has no hostname
|
MSGID_NO_HOST
|
2.796 2.900 1.270 1.583
|
|
header
|
|
Message-Id is fake (in Outlook Express format)
|
MSGID_OUTLOOK_TIME
|
4.500 4.400 4.400 4.400
|
|
header
|
|
Invalid Date: header (not RFC 2822)
|
INVALID_DATE
|
0.594 0.594 0.592 0.592
|
|
header
|
|
Invalid Date: header (timezone does not exist)
|
INVALID_DATE_TZ_ABSURD
|
4.400 4.300 4.300 4.300
|
|
header
|
|
Invalid Date: year begins with zero
|
DATE_YEAR_ZERO_FIRST
|
4.300
|
|
header
|
|
Date: is 3 to 6 hours before Received: date
|
DATE_IN_PAST_03_06
|
0.271 0.294 0.494 0.267
|
|
header
|
|
Date: is 6 to 12 hours before Received: date
|
DATE_IN_PAST_06_12
|
0.759 0.755 0.415 0.059
|
|
header
|
|
Date: is 12 to 24 hours before Received: date
|
DATE_IN_PAST_12_24
|
0.0 0.126 0.094 0.0
|
|
header
|
|
Date: is 24 to 48 hours before Received: date
|
DATE_IN_PAST_24_48
|
0.0 0.0 0.069 0.0
|
|
header
|
|
Date: is 48 to 96 hours before Received: date
|
DATE_IN_PAST_48_96
|
0.0
|
|
header
|
|
Date: is 96 hours or more before Received: date
|
DATE_IN_PAST_96_XX
|
1.235 1.634 2.111 0.561
|
|
header
|
|
Date: is 3 to 6 hours after Received: date
|
DATE_IN_FUTURE_03_06
|
2.504 0.928 1.644 1.378
|
|
header
|
|
Date: is 6 to 12 hours after Received: date
|
DATE_IN_FUTURE_06_12
|
1.534 1.344 1.457 1.114
|
|
header
|
|
Date: is 12 to 24 hours after Received: date
|
DATE_IN_FUTURE_12_24
|
1.869 2.799 0.500 0.718
|
|
header
|
|
Date: is 24 to 48 hours after Received: date
|
DATE_IN_FUTURE_24_48
|
2.696 2.599 2.729 2.900
|
|
header
|
|
Date: is 48 to 96 hours after Received: date
|
DATE_IN_FUTURE_48_96
|
2.297 2.199 0.0 2.429
|
|
header
|
|
Date: is 96 hours or more after Received: date
|
DATE_IN_FUTURE_96_XX
|
1.691 0.0 2.098 0.0
|
|
header
|
|
Subject: starts with advertising tag
|
ADVERT_CODE
|
1.101 1.705 4.300 1.101
|
|
header
|
|
Subject: contains advertising tag
|
ADVERT_CODE2
|
2.104 2.477 1.558 0.930
|
|
header
|
|
|