## ## Please add loadplugin to init.pre (so it's loadeded before cf files!): ## ## loadplugin Mail::SpamAssassin::Plugin::FreeMail FreeMail.pm ## ifplugin Mail::SpamAssassin::Plugin::FreeMail header FREEMAIL_REPLYTO eval:check_freemail_replyto() describe FREEMAIL_REPLYTO Reply-To is different freemail than From or body score FREEMAIL_REPLYTO 2 header __freemail_reply eval:check_freemail_replyto('reply') meta FREEMAIL_REPLY (__freemail_reply && !FREEMAIL_REPLYTO) describe FREEMAIL_REPLY From and body are different freemails score FREEMAIL_REPLY 1 header FREEMAIL_FROM eval:check_freemail_from() describe FREEMAIL_FROM Sender email is freemail score FREEMAIL_FROM 0.5 ### Some other possibilities: # header FREEMAIL_FROM_DIGIT eval:check_freemail_from('\d@') # describe FREEMAIL_FROM_DIGIT Freemail username ends in digit # score FREEMAIL_FROM_DIGIT 0.5 # header FREEMAIL_FROM_YEAR eval:check_freemail_from('[^\d](20)?(0[7-9]|1[0-2])@') # describe FREEMAIL_FROM_YEAR Freemail username ends in year 2007-2012 # score FREEMAIL_FROM_YEAR 0.1 # header FREEMAIL_BODY eval:check_freemail_body() # describe FREEMAIL_BODY Email address found from body is freemail # score FREEMAIL_BODY 0.001 # header __freemail_replyto_hdr eval:check_freemail_header('Reply-To') # meta FREEMAIL_BODY_ONLY (!FREEMAIL_FROM && !__freemail_replyto_hdr && FREEMAIL_BODY) # describe FREEMAIL_BODY_ONLY No freemails in headers, only in body # score FREEMAIL_BODY_ONLY 0.001 ### You could also do more serious whitelisting: # header __freemail_replyto eval:check_freemail_replyto() # body __freemail_skip_fwd /---\s?(?:Forwarded|Original) message/i # header __freemail_skip_ml1 exists:List-Id # header __freemail_skip_ml2 exists:Mailing-List ## skip body larger than 5000 bytes # body __freemail_skip_big /(?=.{5000})./s # meta FREEMAIL_REPLYTO __freemail_replyto && !(BAYES_00 || __freemail_skip_fwd || __freemail_skip_ml1 || __freemail_skip_ml2 || __freemail_skip_big) endif