diff --git a/data/conf/rspamd/local.d/composites.conf b/data/conf/rspamd/local.d/composites.conf
index 46f06743..1139b490 100644
--- a/data/conf/rspamd/local.d/composites.conf
+++ b/data/conf/rspamd/local.d/composites.conf
@@ -17,6 +17,6 @@ SOGO_CONTACT_SPOOFED {
   expression = "(R_SPF_PERMFAIL | R_SPF_SOFTFAIL | R_SPF_FAIL) & ~SOGO_CONTACT";
 }
 SPOOFED_UNAUTH {
-  expression = "UNAUTH_MAILCOW_DOMAIN & !MAILCOW_WHITE & !R_SPF_ALLOW";
+  expression = "!MAILCOW_AUTH & !MAILCOW_WHITE & !R_SPF_ALLOW & !DMARC_POLICY_ALLOW";
   score = 5.0;
 }
diff --git a/data/conf/rspamd/local.d/multimap.conf b/data/conf/rspamd/local.d/multimap.conf
index 6ce56f7a..7752b813 100644
--- a/data/conf/rspamd/local.d/multimap.conf
+++ b/data/conf/rspamd/local.d/multimap.conf
@@ -83,11 +83,3 @@ GLOBAL_RCPT_BL {
   prefilter = true;
   action = "reject";
 }
-
-UNAUTH_MAILCOW_DOMAIN {
-  type = "header";
-  header = "from";
-  filter = "email:domain";
-  nflags = ["authenticated"];
-  map = "redis://DOMAIN_MAP";
-}