MX_IMPLICIT {
  expression = "MX_GOOD & MX_MISSING";
  score = -0.01;
}
VIRUS_FOUND {
  expression = "CLAM_VIRUS & !MAILCOW_WHITE";
  score = 2000;
}
SPF_FAIL_NO_DKIM {
  expression = "R_SPF_FAIL & R_DKIM_NA & !MAILCOW_WHITE";
  score = 10;
}
SOGO_CONTACT_EXCLUDE_FWD_HOST {
  expression = "WHITELISTED_FWD_HOST & ~SOGO_CONTACT";
}
SOGO_CONTACT_SPOOFED {
  expression = "(R_SPF_PERMFAIL | R_SPF_SOFTFAIL | R_SPF_FAIL) & ~SOGO_CONTACT";
}
SPOOFED_UNAUTH {
  expression = "!MAILCOW_AUTH & !MAILCOW_WHITE & !R_SPF_ALLOW & !DMARC_POLICY_ALLOW & !ARC_ALLOW & !SIEVE_HOST & MAILCOW_DOMAIN_HEADER_FROM";
  score = 5.0;
}
# Only apply to inbound unauthed and not whitelisted
OLEFY_MACRO {
  expression = "!MAILCOW_AUTH & !MAILCOW_WHITE & OLETOOLS";
  score = 20.0;
  policy = "remove_weight";
}

BAD_WORD_BAD_TLD {
  expression = "FISHY_TLD & BAD_WORDS"
  score = 20.0;
}