Detection rule reference
Every finding that can appear in a message's Why list. Points add up to the message score (see How filtering works). Several rules report the specific item that triggered them (the domain, file or phrase) in their description on the message page.
Jump to: lists · auth · spamhaus · antivirus · attachments · urls · impersonation · heuristics · bayes · ai
Allow / block lists
| Rule | Points | Meaning |
|---|---|---|
| ALLOWLIST | 0 | Sender matched an allow-list entry. Spam scoring is bypassed (but not virus checks or a DMARC p=reject failure). |
| BLOCKLIST | +100 | Sender, domain or IP matched a block-list entry; the 'blocked' action applies. |
Sender authentication (SPF, DKIM, DMARC, ARC)
| Rule | Points | Meaning |
|---|---|---|
| SPF_PASS | -0.3 | The connecting server is authorised by the envelope sender's SPF record. |
| SPF_FAIL | +3 | SPF hard fail (-all): the connecting server is explicitly NOT allowed to send for that domain. |
| SPF_SOFTFAIL | +1 | SPF soft fail (~all): the domain does not vouch for this server. |
| SPF_PERMERROR | +0.5 | The sender's SPF record is broken. |
| DKIM_INVALID | +1.5 | The message carries DKIM signatures but none verify (altered in transit or forged). |
| DMARC_PASS | -1 | SPF or DKIM passed and aligned with the From domain. |
| DMARC_FAIL_REJECT | +7 | DMARC failed and the From domain publishes p=reject - a likely spoof. |
| DMARC_FAIL_QUARANTINE | +5 | DMARC failed and the domain publishes p=quarantine. |
| DMARC_FAIL_NONE | +1.5 | DMARC failed; the domain only monitors (p=none). |
| DMARC_FAIL_ARC_PASS | +0.5 | DMARC failed but a valid ARC chain shows a trusted forwarder (mailing list, M365) changed the message. |
| AUTH_NONE | +1 | No SPF pass, no DKIM and no DMARC record at all - an unauthenticated sender. |
| SPOOF_INTERNAL_DOMAIN | +6 | From claims one of YOUR domains but arrived from outside without passing authentication. |
Spamhaus reputation
| Rule | Points | Meaning |
|---|---|---|
| SPAMHAUS_ZEN_SBL | +6 | Connecting IP is on the Spamhaus Block List (known spam source). |
| SPAMHAUS_ZEN_CSS | +5 | Connecting IP is on the CSS list (snowshoe / low-reputation bulk sender). |
| SPAMHAUS_ZEN_XBL | +7 | Connecting IP is a compromised or botnet-infected host. |
| SPAMHAUS_ZEN_DROP | +10 | IP is in a hijacked / criminal netblock (DROP). |
| SPAMHAUS_ZEN_PBL | +3 | IP is an end-user address that should send through its provider, not directly (only scored on the connecting hop). |
| SPAMHAUS_DBL_SPAM | +5 | A sender, HELO, rDNS or link domain is a known spam domain. |
| SPAMHAUS_DBL_PHISH | +8 (x1.3 for links) | A domain in the message is a known phishing domain. |
| SPAMHAUS_DBL_MALWARE | +8 (x1.3 for links) | A domain serves malware. |
| SPAMHAUS_DBL_BOTNET | +8 | A domain is a botnet command-and-control server. |
| SPAMHAUS_DBL_ABUSED_SPAM | +2 | A legitimate but abused domain seen in spam. |
| SPAMHAUS_DBL_ABUSED_REDIRECTOR | +2.5 | An abused URL shortener / redirector. |
| SPAMHAUS_DBL_ABUSED_PHISH | +5 | A legitimate domain currently hosting phishing. |
| SPAMHAUS_DBL_ABUSED_MALWARE | +5 | A legitimate domain currently hosting malware. |
| SPAMHAUS_DBL_ABUSED_BOTNET | +5 | A legitimate domain abused for botnet C&C. |
| SPAMHAUS_ZRD | +2 to +3.5 | Zero Reputation Domain: the domain was first seen less than 24 hours ago (DQS key required). |
| SPAMHAUS_HBL_EMAIL | +6 | The sender / Reply-To address itself is on the Hash Blocklist (DQS key required). |
| SPAMHAUS_HBL_FILE_MALICIOUS | +12 | An attachment's SHA-256 is known malware (treated as a virus). |
| SPAMHAUS_HBL_FILE_SUSPICIOUS | +4 | An attachment's hash is suspicious. |
| SPAMHAUS_HBL_CRYPTOWALLET | +5 | A cryptocurrency wallet in the body is known for fraud. |
IP rules score 60% of their points when the listed IP is an earlier relay rather than the connecting server. Domains checked: header From, envelope sender, Reply-To, HELO, reverse DNS and up to 60 link hosts. ZRD and HBL need a DQS key.
Antivirus (ClamAV)
| Rule | Points | Meaning |
|---|---|---|
| AV_VIRUS | +50 | ClamAV found a virus / malware signature. The message is a virus verdict (admin-only). |
| AV_CONTENT_SIG | +4 / +6 | A Sanesecurity / unofficial content signature (spam or phishing, not a virus) matched. |
| AV_SCAN_ERROR | +0.5 | ClamAV could not fully scan part of the message (e.g. encrypted or oversized container). |
| AV_TOO_LARGE | +0.5 | Message larger than the ClamAV size limit; not virus scanned. |
Attachments
| Rule | Points | Meaning |
|---|---|---|
| ATTACH_BLOCKED_EXT | +8 | Attachment type is on the policy's blocked list (attachment policy violation). |
| ATTACH_DOUBLE_EXT | +4 | Disguised double extension such as invoice.pdf.exe. |
| ATTACH_NAME_TRICK | +5 | File name uses right-to-left override or whitespace padding to hide the real extension. |
| ATTACH_EXEC_DISGUISED | +10 | The content is an executable (PE/ELF/LNK) whatever the name says. |
| ATTACH_TYPE_MISMATCH | +3 | The file claims a harmless type (e.g. .pdf) but is really an archive or HTML. |
| ATTACH_HTML | +1.5 | An HTML file is attached (common phishing wrapper). |
| ATTACH_HTML_SMUGGLING | +7 | HTML attachment builds a file in the browser (atob/Blob/createObjectURL) - HTML smuggling. |
| ATTACH_HTML_CREDFORM | +7 | HTML attachment contains a login / password form. |
| ATTACH_OFFICE_MACRO | +4 and up | Office document with VBA macros; more points for auto-run and suspicious keywords. |
| ATTACH_OLE_OBJECT | +2 | Office document embeds an OLE object. |
| ATTACH_RTF_EXPLOIT | +6 | RTF with auto-updating OLE objects (Equation Editor exploit pattern). |
| ATTACH_ONENOTE | +5 | OneNote file (a common malware delivery vehicle). |
| ATTACH_DISK_IMAGE | +6 | ISO / IMG disk image (used to bypass Mark-of-the-Web). |
| ARCHIVE_ENCRYPTED | +5 | Password-protected archive that cannot be scanned. |
| ARCHIVE_PASSWORD_IN_BODY | +4 | The password for that archive is in the message - classic malware delivery. |
| ARCHIVE_SINGLE_EXEC | +3 | Archive containing a single blocked-type file. |
| ARCHIVE_TOO_DEEP | +3 | Archives nested deeper than the policy allows. |
| ARCHIVE_CORRUPT | +1.5 | A ZIP that cannot be opened. |
| ARCHIVE_7Z | +1 | 7-Zip archive (contents are not unpacked; ClamAV still scans it). |
| ARCHIVE_RAR | +1 | RAR archive (contents are not unpacked; ClamAV still scans it). |
| PDF_JAVASCRIPT | +3 | PDF contains JavaScript. |
| PDF_LAUNCH | +6 | PDF has a /Launch action that can run programs. |
| PDF_EMBEDDED_FILE | +2 | PDF embeds another file. |
| PDF_OPENACTION | +1 | PDF runs an action when opened. |
| PDF_XFA | +1 | PDF uses XFA forms. |
| PDF_LINK_LURE | +1.5 | A small PDF whose content is essentially one link (phishing lure). |
Links
| Rule | Points | Meaning |
|---|---|---|
| URL_DATA_URI | +3 | A link is a data: URI carrying its own payload. |
| URL_JAVASCRIPT | +3 | A javascript: link. |
| URL_IP_HOST | +2.5 | Link to a raw IP address instead of a domain. |
| URL_PUNYCODE | +2 | Internationalised (punycode) domain - often a homoglyph lookalike. |
| URL_SHORTENER | +1 | URL shortener hides the real destination. |
| URL_FREE_HOSTING | +1.5 | Link to free / anonymous hosting frequently used for phishing pages (web.app, pages.dev, ipfs, blob storage...). |
| URL_SUSPICIOUS_TLD | +0.8 | Domain in a high-abuse top-level domain. |
| URL_USERINFO | +3 | URL uses user@host syntax to disguise the real host. |
| URL_BRAND_IMPERSONATION | +3 | A link host uses a brand name (microsoft, paypal, docusign...) but is not that brand. |
| URL_LOOKALIKE_ORG | +5 | A link domain imitates one of YOUR domains. |
| URL_TEXT_MISMATCH | +3 | The visible link text shows one domain but the link goes to another. |
| URL_FORM_EXTERNAL | +3 | An HTML form in the message posts to an external site. |
| URL_REDIRECTOR | +1.5 | An open redirector link forwards to another site. |
| URL_MANY_HOSTS | +0.5 | More than 25 different link hosts. |
Impersonation
| Rule | Points | Meaning |
|---|---|---|
| VIP_DISPLAY_NAME | +6 | External sender uses the display name of one of your VIP users. |
| DISPLAY_NAME_ADDRESS_MISMATCH | +3 | Display name contains an email address different from the real sender. |
| DISPLAY_NAME_ORG_DOMAIN | +2.5 | External sender puts your domain name in the display name. |
| DISPLAY_NAME_MIXED_SCRIPT | +2 | Display name mixes alphabets (e.g. Cyrillic letters in a Latin name). |
| DISPLAY_NAME_BRAND | +2.5 | Display name claims a brand the sending domain does not belong to. |
| FROM_LOOKALIKE_ORG | +7 | Sender domain imitates one of your domains (typo, homoglyph or added word). |
| FROM_LOOKALIKE_BRAND | +5 | Sender domain imitates a well-known brand's domain. |
| REPLYTO_MISMATCH | +1 / +2 | Replies would go to a different domain than the sender (+2 when it is a free-mail account). |
| FIRST_TIME_SENDER | +0.3 | First message from this address to the organization (no earlier clean mail, never written to). |
Content and headers
| Rule | Points | Meaning |
|---|---|---|
| HDR_NO_DATE | +1 | Missing Date header. |
| HDR_DATE_FUTURE | +1.5 | Date header more than a day in the future. |
| HDR_DATE_PAST | +0.8 | Date header more than a week old. |
| HDR_DATE_INVALID | +1 | Date header cannot be parsed. |
| HDR_NO_MESSAGE_ID | +1.2 | Missing Message-ID header. |
| HDR_NO_FROM | +2.5 | Missing or unparseable From address. |
| HDR_UNDISCLOSED | +0.7 | No visible recipients (BCC blast). |
| HDR_MANY_RECIPIENTS | +0.8 | More than 30 visible recipients. |
| HDR_SPAMWARE_MAILER | +2.5 | X-Mailer names a known bulk-spam tool. |
| SUBJ_EMPTY | +0.6 | Empty subject. |
| SUBJ_ALL_CAPS | +1 | Subject written entirely in capitals. |
| SUBJ_EXCITED | +0.7 | Excessive punctuation in the subject. |
| SUBJ_FAKE_REPLY | +1.5 | Subject starts with RE:/FW: but the message is not part of any thread. |
| SUBJ_HAS_RECIPIENT | +0.7 | Subject contains the recipient's name (personalised lure). |
| BULK_MAIL | +1 | Newsletter / marketing mail (List-Unsubscribe, ESP headers, Precedence: bulk). Drives the 'bulk' verdict. |
| BODY_PHISH_LANGUAGE | up to +4.5 | Credential-phishing phrases (verify your account, password expires, shared a document...). |
| BODY_BEC_LANGUAGE | up to +6 | Payment / urgency request phrases (wire transfer, gift cards, change of bank details...). Weighted up for free-mail, VIP-name or Reply-To mismatch. |
| BODY_SCAM_LANGUAGE | up to +5 | Scam phrases (inheritance, lottery, crypto investment...). |
| BODY_SEXTORTION | +6 | Sextortion / extortion wording. |
| BODY_ZERO_WIDTH | +2 | Many invisible zero-width characters (filter evasion). |
| BODY_MONEY_AMOUNTS | +0.8 | Many large money amounts. |
| HTML_HIDDEN_TEXT | +2 | Lots of hidden HTML text (padding to fool filters). |
| HTML_IMAGE_ONLY | +1.5 | Image-only message with almost no text. |
| HTML_SCRIPT | +2 | HTML body contains script. |
| HTML_FORM | +2.5 | HTML body contains a form. |
| HTML_FRAGMENT | +0.4 | HTML part without html/body structure. |
| QR_PHISH | +3 | Asks the reader to scan a QR code (quishing moves the link to a phone). |
| CALLBACK_PHISH | +4 | Fake invoice / subscription asking the reader to call a phone number (callback / TOAD scam). |
| BEC_SHORT_OPENER | +2 | Short free-mail message making a request - the typical BEC opener. |
| MIME_MALFORMED | +1 | Broken MIME structure. |
Bayes (learning)
| Rule | Points | Meaning |
|---|---|---|
| BAYES_99 | +3.5 | Bayes spam probability at least 99%. |
| BAYES_95 | +2.5 | Bayes spam probability 95-99%. |
| BAYES_80 | +1 | Bayes spam probability 80-95%. |
| BAYES_20 | -0.3 | Bayes ham probability 80-95%. |
| BAYES_05 | -1 | Bayes ham probability 95-99%. |
| BAYES_00 | -2 | Bayes ham probability at least 99%. |
AI review
| Rule | Points | Meaning |
|---|---|---|
| AI_CLEAN | down to -2.5 | The model judged the message clean with high confidence. |
| AI_CLEAN_WEAK | 0 | The model said clean, but not confidently (no score change). |
| AI_SPAM | up to +7 | The model judged it spam (risk x confidence). |
| AI_SCAM | up to +7 | The model judged it a scam (advance fee, sextortion, crypto fraud). |
| AI_PHISH | up to +10 | The model judged it phishing. |
| AI_BEC | up to +10 | The model judged it business email compromise. |
| AI_MALWARE | up to +10 | The model judged it a malware lure. |
AI points = base (10 for phishing / BEC / malware, 7 for spam / scam) x risk/100 x (0.4 + 0.6 x confidence) x the llm.weight setting.