diff --git a/data/conf/rspamd/local.d/composites.conf b/data/conf/rspamd/local.d/composites.conf
index d775c4f6..46f06743 100644
--- a/data/conf/rspamd/local.d/composites.conf
+++ b/data/conf/rspamd/local.d/composites.conf
@@ -16,3 +16,7 @@ SOGO_CONTACT_EXCLUDE_FWD_HOST {
 SOGO_CONTACT_SPOOFED {
   expression = "(R_SPF_PERMFAIL | R_SPF_SOFTFAIL | R_SPF_FAIL) & ~SOGO_CONTACT";
 }
+SPOOFED_UNAUTH {
+  expression = "UNAUTH_MAILCOW_DOMAIN & !MAILCOW_WHITE & !R_SPF_ALLOW";
+  score = 5.0;
+}
diff --git a/data/conf/rspamd/local.d/multimap.conf b/data/conf/rspamd/local.d/multimap.conf
index 7752b813..6ce56f7a 100644
--- a/data/conf/rspamd/local.d/multimap.conf
+++ b/data/conf/rspamd/local.d/multimap.conf
@@ -83,3 +83,11 @@ GLOBAL_RCPT_BL {
   prefilter = true;
   action = "reject";
 }
+
+UNAUTH_MAILCOW_DOMAIN {
+  type = "header";
+  header = "from";
+  filter = "email:domain";
+  nflags = ["authenticated"];
+  map = "redis://DOMAIN_MAP";
+}