mailcow/data/conf/rspamd/local.d/multimap.conf

RCPT_MAILCOW_DOMAIN {
  type = "rcpt";
  filter = "email:domain";
  map = "redis://DOMAIN_MAP";
  symbols_set = ["RCPT_MAILCOW_DOMAIN"];
}

RCPT_WANTS_SUBJECT_TAG {
  type = "rcpt";
  filter = "email:addr";
  map = "redis://RCPT_WANTS_SUBJECT_TAG";
  symbols_set = ["RCPT_WANTS_SUBJECT_TAG"];
}

RCPT_WANTS_SUBFOLDER_TAG {
  type = "rcpt";
  filter = "email:addr";
  map = "redis://RCPT_WANTS_SUBFOLDER_TAG";
  symbols_set = ["RCPT_WANTS_SUBFOLDER_TAG"];
}

WHITELISTED_FWD_HOST {
  type = "ip";
  map = "redis://WHITELISTED_FWD_HOST";
  symbols_set = ["WHITELISTED_FWD_HOST"];
}

BULK_HEADER {
  type = "content";
  map = "${LOCAL_CONFDIR}/custom/bulk_header.map";
  filter = "headers"
  regexp = true;
  symbols_set = ["BULK_HEADER"];
}

LOCAL_BL_ASN {
  require_symbols = "!MAILCOW_WHITE";
  type = "asn";
  map = "${LOCAL_CONFDIR}/custom/bad_asn.map";
  score = 5;
  description = "Sender's ASN is on the local blacklist";
  symbols_set = ["LOCAL_BL_ASN"];
}

GLOBAL_SMTP_FROM_WL {
  type = "from";
  map = "${LOCAL_CONFDIR}/custom/global_smtp_from_whitelist.map";
  regexp = true;
  score = -2050;
}

GLOBAL_SMTP_FROM_BL {
  type = "from";
  map = "${LOCAL_CONFDIR}/custom/global_smtp_from_blacklist.map";
  regexp = true;
  prefilter = true;
  action = "reject";
}

GLOBAL_MIME_FROM_WL {
  type = "header";
  header = "from";
  filter = "email:addr";
  map = "${LOCAL_CONFDIR}/custom/global_mime_from_whitelist.map";
  regexp = true;
  score = -2050;
}

GLOBAL_MIME_FROM_BL {
  type = "header";
  header = "from";
  filter = "email:addr";
  map = "${LOCAL_CONFDIR}/custom/global_mime_from_blacklist.map";
  regexp = true;
  prefilter = true;
  action = "reject";
}

GLOBAL_RCPT_WL {
  type = "rcpt";
  map = "${LOCAL_CONFDIR}/custom/global_rcpt_whitelist.map";
  regexp = true;
  prefilter = true;
  action = "accept";
}

GLOBAL_RCPT_BL {
  type = "rcpt";
  map = "${LOCAL_CONFDIR}/custom/global_rcpt_blacklist.map";
  regexp = true;
  prefilter = true;
  action = "reject";
}

SIEVE_HOST {
  type = "ip";
  map = "${LOCAL_CONFDIR}/custom/dovecot_trusted.map";
  symbols_set = ["SIEVE_HOST"];
  score = -15;
}

RSPAMD_HOST {
  type = "ip";
  map = "${LOCAL_CONFDIR}/custom/rspamd_trusted.map";
  symbols_set = ["RSPAMD_HOST"];
}

MAILCOW_DOMAIN_HEADER_FROM { 
  type = "header";  
  header = "from";  
  filter = "email:domain";  
  map = "redis://DOMAIN_MAP"; 
}

IP_WHITELIST {
  type = "ip";
  map = "${LOCAL_CONFDIR}/custom/ip_wl.map";
  symbols_set = ["IP_WHITELIST"];
  score = -2050;
}

FISHY_TLD {
  type = "from";
  filter = "email:domain";
  map = "${LOCAL_CONFDIR}/custom/fishy_tlds.map";
  regexp = true;
  score = 0.1;
}

BAD_WORDS {
  type = "content";
  filter = "text";
  map = "${LOCAL_CONFDIR}/custom/bad_words.map";
  regexp = true;
  score = 0.1;
}

BAD_WORDS_DE {
  type = "content";
  filter = "text";
  map = "${LOCAL_CONFDIR}/custom/bad_words_de.map";
  regexp = true;
  score = 0.1;
}

BAD_LANG {
  type = 'selector';
  selector = 'languages';
  map = "${LOCAL_CONFDIR}/custom/bad_languages.map";
  symbols_set = ["LANG_FILTER"];
  regexp = true;
  score = 5.0;
}

BAZAR_ABUSE_CH {
  type = "selector";
  selector = "attachments(hex,md5)";
  map = "https://bazaar.abuse.ch/export/txt/md5/recent/";
  score = 10.0;
}

URLHAUS_ABUSE_CH {
  type = "url";
  filter = "full";
  map = "https://urlhaus.abuse.ch/downloads/text_online/";
  score = 10.0;
}