From fec6876490fa2b14e8880d2befa3f88588a4fcab Mon Sep 17 00:00:00 2001
From: Dmitriy Alekseev <1865999+dragoangel@users.noreply.github.com>
Date: Mon, 28 Dec 2020 23:04:01 +0200
Subject: [PATCH] [Rspamd] Block spoofing for free mail domains (#3907)

---
 data/conf/rspamd/local.d/composites.conf | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/data/conf/rspamd/local.d/composites.conf b/data/conf/rspamd/local.d/composites.conf
index e2f6f9d3..02664cca 100644
--- a/data/conf/rspamd/local.d/composites.conf
+++ b/data/conf/rspamd/local.d/composites.conf
@@ -6,6 +6,11 @@ VIRUS_FOUND {
   expression = "CLAM_VIRUS & !MAILCOW_WHITE";
   score = 2000.0;
 }
+# Bad policy from free mail providers
+FREEMAIL_POLICY_FAILURE {
+  expression = " -g+:policies & !DMARC_POLICY_ALLOW & ( FREEMAIL_ENVFROM | FREEMAIL_FROM ) & !WHITELISTED_FWD_HOST";
+  score = 16.0;
+}
 # Bad policy from non-whitelisted senders
 # Remove SOGO_CONTACT symbol for fwd hosts and senders with broken policy
 SOGO_CONTACT_EXCLUDE {