Detection rule reference
Every finding that can appear in a message's Why list. Points add up to the message score (see How filtering works). Several rules report the specific item that triggered them (the domain, file or phrase) in their description on the message page.
Jump to: lists · auth · spamhaus · dnsbl · antivirus · attachments · urls · impersonation · heuristics · bayes · reputation · ai
Allow / block lists
| Rule | Points | Meaning |
|---|---|---|
| ALLOWLIST | 0 | Sender matched an allow-list entry. Spam scoring is bypassed (but not virus checks or a DMARC p=reject failure). |
| BLOCKLIST | +100 | Sender, domain or IP matched a block-list entry; the 'blocked' action applies. |
Sender authentication (SPF, DKIM, DMARC, ARC)
| Rule | Points | Meaning |
|---|---|---|
| SPF_PASS | -0.3 | The connecting server is authorised by the envelope sender's SPF record. |
| SPF_FAIL | +3 | SPF hard fail (-all): the connecting server is explicitly NOT allowed to send for that domain. |
| SPF_SOFTFAIL | +1 | SPF soft fail (~all): the domain does not vouch for this server. |
| SPF_PERMERROR | +0.5 | The sender's SPF record is broken. |
| DKIM_INVALID | +1.5 | The message carries DKIM signatures but none verify (altered in transit or forged). |
| DMARC_PASS | -1 | SPF or DKIM passed and aligned with the From domain. |
| DMARC_FAIL_REJECT | +7 | DMARC failed and the From domain publishes p=reject - a likely spoof. |
| DMARC_FAIL_QUARANTINE | +5 | DMARC failed and the domain publishes p=quarantine. |
| DMARC_FAIL_NONE | +1.5 | DMARC failed; the domain only monitors (p=none). |
| DMARC_FAIL_ARC_PASS | +0.5 | DMARC failed but a valid ARC chain shows a trusted forwarder (mailing list, M365) changed the message. |
| AUTH_NONE | +1 | No SPF pass, no DKIM and no DMARC record at all - an unauthenticated sender. |
| SPOOF_INTERNAL_DOMAIN | +6 | From claims one of YOUR domains but arrived from outside without passing authentication. |
Spamhaus reputation
| Rule | Points | Meaning |
|---|---|---|
| SPAMHAUS_ZEN_SBL | +6 | Connecting IP is on the Spamhaus Block List (known spam source). |
| SPAMHAUS_ZEN_CSS | +5 | Connecting IP is on the CSS list (snowshoe / low-reputation bulk sender). |
| SPAMHAUS_ZEN_XBL | +7 | Connecting IP is a compromised or botnet-infected host. |
| SPAMHAUS_ZEN_DROP | +10 | IP is in a hijacked / criminal netblock (DROP). |
| SPAMHAUS_ZEN_PBL | +3 | IP is an end-user address that should send through its provider, not directly (only scored on the connecting hop). |
| SPAMHAUS_DBL_SPAM | +5 | A sender, HELO, rDNS or link domain is a known spam domain. |
| SPAMHAUS_DBL_PHISH | +8 (x1.3 for links) | A domain in the message is a known phishing domain. |
| SPAMHAUS_DBL_MALWARE | +8 (x1.3 for links) | A domain serves malware. |
| SPAMHAUS_DBL_BOTNET | +8 | A domain is a botnet command-and-control server. |
| SPAMHAUS_DBL_ABUSED_SPAM | +2 | A legitimate but abused domain seen in spam. |
| SPAMHAUS_DBL_ABUSED_REDIRECTOR | +2.5 | An abused URL shortener / redirector. |
| SPAMHAUS_DBL_ABUSED_PHISH | +5 | A legitimate domain currently hosting phishing. |
| SPAMHAUS_DBL_ABUSED_MALWARE | +5 | A legitimate domain currently hosting malware. |
| SPAMHAUS_DBL_ABUSED_BOTNET | +5 | A legitimate domain abused for botnet C&C. |
| SPAMHAUS_ZRD | +2 to +3.5 | Zero Reputation Domain: the domain was first seen less than 24 hours ago (DQS key required). |
| SPAMHAUS_HBL_EMAIL | +6 | The sender / Reply-To address itself is on the Hash Blocklist (DQS key required). |
| SPAMHAUS_HBL_FILE_MALICIOUS | +12 | An attachment's SHA-256 is known malware (treated as a virus). |
| SPAMHAUS_HBL_FILE_SUSPICIOUS | +4 | An attachment's hash is suspicious. |
| SPAMHAUS_HBL_CRYPTOWALLET | +5 | A cryptocurrency wallet in the body is known for fraud. |
IP rules score 60% of their points when the listed IP is an earlier relay rather than the connecting server. Domains checked: header From, envelope sender, Reply-To, HELO, reverse DNS and up to 60 link hosts. ZRD and HBL need a DQS key.
Other blocklists
| Rule | Points | Meaning |
|---|---|---|
| ABUSIX_BLACK | +3 | Abusix Mail Intelligence: sent mail to Abusix spam traps. |
| ABUSIX_LOWREP | +1.5 | Abusix Mail Intelligence: low reputation (sends near spam-trap hits). |
| ABUSIX_MANUAL | +3 | Abusix Mail Intelligence: listed by Abusix analysts. |
| ABUSIX_EXPLOIT | +3 | Abusix Mail Intelligence: compromised host, botnet, open proxy or Tor exit. |
| ABUSIX_POLICY | +0.5 | Abusix Mail Intelligence: end-user address (generic reverse DNS). |
| ABUSIX_DBL_LISTED | +3 | Abusix Mail Intelligence: domain seen in spam. |
| ABUSIX_DBL_NEW | +1 | Abusix Mail Intelligence: newly observed domain. |
| ABUSIX_DBL_SHORTENED | +3 | Abusix Mail Intelligence: reached through a listed short link. |
| BARRACUDA_LISTED | +2 | Barracuda Reputation Block List: poor sender reputation. |
| MAILSPIKE_WAVE | +2 | Mailspike: part of a spam wave right now. |
| MAILSPIKE_L5 | +2 | Mailspike: very bad reputation. |
| MAILSPIKE_L4 | +1.5 | Mailspike: bad reputation. |
| MAILSPIKE_L3 | +1 | Mailspike: low reputation. |
| MAILSPIKE_L2 | +0.5 | Mailspike: suspicious reputation. |
| SPAMCOP_LISTED | +1.5 | SpamCop: reported as a spam source. |
| SURBL_PH | +4 | SURBL: phishing site. |
| SURBL_MW | +4 | SURBL: malware site. |
| SURBL_CR | +2.5 | SURBL: cracked (hijacked) site. |
| SURBL_ABUSE | +2.5 | SURBL: spam / abuse domain. |
| SURBL_DM | +0.5 | SURBL: disposable mail domain. |
| URIBL_BLACK | +2.5 | URIBL: spam domain (black). |
| URIBL_RED | +1 | URIBL: domain in new spam (red). |
| URIBL_GREY | +0.5 | URIBL: bulk sender domain (grey). |
| SPAMHAUS_DROPLIST | +4 | Spamhaus DROP: hijacked or criminal netblock. |
| BLOCKLISTDE_LISTED | +1 | blocklist.de mail attackers: attacked mail servers in the last 48 hours. |
| URLHAUS_URL | +4 | abuse.ch URLhaus: link is a known malware download. Scored only when a link's exact address is on the feed. |
| URLHAUS_HOST | +2 | abuse.ch URLhaus: link's host served malware in the last 30 days. The link itself is not on the feed, but other links on its host are (never for shared platforms). |
| OPENPHISH_URL | +4 | OpenPhish community feed: link is a known phishing page. Scored only when a link's exact address is on the feed. |
| OPENPHISH_HOST | +2 | OpenPhish community feed: link's host carries known phishing pages. The link itself is not on the feed, but other links on its host are (never for shared platforms). |
IP lists check the connecting server only (DROP also earlier relays, at 60%). Domain lists check the header From, the envelope sender and up to 20 link domains, never shared platforms such as Gmail or Microsoft 365. Outbound and internal mail only gets the downloaded feeds. One hit per list and item; lists that share data sources are capped together (dnsbl.group_caps). See Blocklists.
Antivirus (ClamAV)
| Rule | Points | Meaning |
|---|---|---|
| AV_VIRUS | +50 | ClamAV found a virus / malware signature. The message is a virus verdict (admin-only). |
| AV_CONTENT_SIG | +4 / +6 | A Sanesecurity content signature matched: spam / scam (+4) or phishing (+6) text, links or images, not a virus. |
| AV_RISKY_FILE | +8 | A Sanesecurity Foxhole or Badmacro signature matched: a risky file type inside an archive, or a document with auto-run macros. Enough to quarantine, but not a virus verdict. |
| AV_SCAN_ERROR | +0.5 | ClamAV could not fully scan part of the message (e.g. encrypted or oversized container). |
| AV_TOO_LARGE | +0.5 | Message larger than the ClamAV size limit; not virus scanned. |
Attachments
| Rule | Points | Meaning |
|---|---|---|
| ATTACH_BLOCKED_EXT | +8 | Attachment type is on the policy's blocked list (attachment policy violation). |
| ATTACH_DOUBLE_EXT | +4 | Disguised double extension such as invoice.pdf.exe. |
| ATTACH_NAME_TRICK | +5 | File name uses right-to-left override or whitespace padding to hide the real extension. |
| ATTACH_EXEC_DISGUISED | +10 | The content is an executable (PE/ELF/LNK) whatever the name says. |
| ATTACH_TYPE_MISMATCH | +3 | The file claims a harmless type (e.g. .pdf) but is really an archive or HTML. |
| ATTACH_HTML | +1.5 | An HTML file is attached (common phishing wrapper). |
| ATTACH_HTML_SMUGGLING | +7 | HTML attachment builds a file in the browser (atob/Blob/createObjectURL) - HTML smuggling. |
| ATTACH_HTML_CREDFORM | +7 | HTML attachment contains a login / password form. |
| ATTACH_OFFICE_MACRO | +4 and up | Office document with VBA macros; more points for auto-run and suspicious keywords. |
| ATTACH_OLE_OBJECT | +2 | Office document embeds an OLE object. |
| ATTACH_RTF_EXPLOIT | +6 | RTF with auto-updating OLE objects (Equation Editor exploit pattern). |
| ATTACH_ONENOTE | +5 | OneNote file (a common malware delivery vehicle). |
| ATTACH_DISK_IMAGE | +6 | ISO / IMG disk image (used to bypass Mark-of-the-Web). |
| ARCHIVE_ENCRYPTED | +5 | Password-protected archive that cannot be scanned. |
| ARCHIVE_PASSWORD_IN_BODY | +4 | The password for that archive is in the message - classic malware delivery. |
| ARCHIVE_SINGLE_EXEC | +3 | Archive containing a single blocked-type file. |
| ARCHIVE_TOO_DEEP | +3 | Archives nested deeper than the policy allows. |
| ARCHIVE_CORRUPT | +1.5 | A ZIP that cannot be opened. |
| ARCHIVE_7Z | +1 | 7-Zip archive (contents are not unpacked; ClamAV still scans it). |
| ARCHIVE_RAR | +1 | RAR archive (contents are not unpacked; ClamAV still scans it). |
| PDF_JAVASCRIPT | +3 | PDF contains JavaScript. |
| PDF_LAUNCH | +6 | PDF has a /Launch action that can run programs. |
| PDF_EMBEDDED_FILE | +2 | PDF embeds another file. |
| PDF_OPENACTION | +1 | PDF runs an action when opened. |
| PDF_XFA | +1 | PDF uses XFA forms. |
| PDF_LINK_LURE | +1.5 | A small PDF whose content is essentially one link (phishing lure). |
Links
| Rule | Points | Meaning |
|---|---|---|
| URL_DATA_URI | +3 | A link is a data: URI carrying its own payload. |
| URL_JAVASCRIPT | +3 | A javascript: link. |
| URL_IP_HOST | +2.5 | Link to a raw IP address instead of a domain. |
| URL_PUNYCODE | +2 | Internationalised (punycode) domain - often a homoglyph lookalike. |
| URL_SHORTENER | +1 | URL shortener hides the real destination. |
| URL_FREE_HOSTING | +1.5 | Link to free / anonymous hosting frequently used for phishing pages (web.app, pages.dev, ipfs, blob storage...). |
| URL_SUSPICIOUS_TLD | +0.8 | Domain in a high-abuse top-level domain. |
| URL_USERINFO | +3 | URL uses user@host syntax to disguise the real host. |
| URL_BRAND_IMPERSONATION | +3 | A link host uses a brand name (microsoft, paypal, docusign...) but is not that brand. |
| URL_LOOKALIKE_ORG | +5 | A link domain imitates one of YOUR domains. |
| URL_TEXT_MISMATCH | +3 | The visible link text shows one domain but the link goes to another. |
| URL_FORM_EXTERNAL | +3 | An HTML form in the message posts to an external site. |
| URL_REDIRECTOR | +1.5 | An open redirector link forwards to another site. |
| URL_MANY_HOSTS | +0.5 | More than 25 different link hosts. |
Impersonation
| Rule | Points | Meaning |
|---|---|---|
| VIP_DISPLAY_NAME | +6 | External sender uses the display name of one of your VIP users. |
| DISPLAY_NAME_ADDRESS_MISMATCH | +3 | Display name contains an email address different from the real sender. |
| DISPLAY_NAME_ORG_DOMAIN | +2.5 | External sender puts your domain name in the display name. |
| DISPLAY_NAME_MIXED_SCRIPT | +2 | Display name mixes alphabets (e.g. Cyrillic letters in a Latin name). |
| DISPLAY_NAME_BRAND | +2.5 | Display name claims a brand the sending domain does not belong to. |
| FROM_LOOKALIKE_ORG | +7 | Sender domain imitates one of your domains (typo, homoglyph or added word). |
| FROM_LOOKALIKE_BRAND | +5 | Sender domain imitates a well-known brand's domain. |
| REPLYTO_MISMATCH | +1 / +2 | Replies would go to a different domain than the sender (+2 when it is a free-mail account). |
| FIRST_TIME_SENDER | +0.3 | First message from this address to the organization (no earlier clean mail, never written to). |
Content and headers
| Rule | Points | Meaning |
|---|---|---|
| HDR_NO_DATE | +1 | Missing Date header. |
| HDR_DATE_FUTURE | +1.5 | Date header more than a day in the future. |
| HDR_DATE_PAST | +0.8 | Date header more than a week old. |
| HDR_DATE_INVALID | +1 | Date header cannot be parsed. |
| HDR_NO_MESSAGE_ID | +1.2 | Missing Message-ID header. |
| HDR_NO_FROM | +2.5 | Missing or unparseable From address. |
| HDR_UNDISCLOSED | +0.7 | No visible recipients (BCC blast). |
| HDR_MANY_RECIPIENTS | +0.8 | More than 30 visible recipients. |
| HDR_SPAMWARE_MAILER | +2.5 | X-Mailer names a known bulk-spam tool. |
| SUBJ_EMPTY | +0.6 | Empty subject. |
| SUBJ_ALL_CAPS | +1 | Subject written entirely in capitals. |
| SUBJ_EXCITED | +0.7 | Excessive punctuation in the subject. |
| SUBJ_FAKE_REPLY | +1.5 | Subject starts with RE:/FW: but the message is not part of any thread. |
| SUBJ_HAS_RECIPIENT | +0.7 | Subject contains the recipient's name (personalised lure). |
| BULK_MAIL | +1 | Newsletter / marketing mail (List-Unsubscribe, ESP headers, Precedence: bulk). Drives the 'bulk' verdict. |
| BODY_PHISH_LANGUAGE | up to +4.5 | Credential-phishing phrases (verify your account, password expires, shared a document...). |
| BODY_BEC_LANGUAGE | up to +6 | Payment / urgency request phrases (wire transfer, gift cards, change of bank details...). Weighted up for free-mail, VIP-name or Reply-To mismatch. |
| BODY_SCAM_LANGUAGE | up to +5 | Scam phrases (inheritance, lottery, crypto investment...). |
| BODY_SEXTORTION | +6 | Sextortion / extortion wording. |
| BODY_ZERO_WIDTH | +2 | Many invisible zero-width characters (filter evasion). |
| BODY_MONEY_AMOUNTS | +0.8 | Many large money amounts. |
| HTML_HIDDEN_TEXT | +2 | Lots of hidden HTML text (padding to fool filters). |
| HTML_IMAGE_ONLY | +1.5 | Image-only message with almost no text. |
| HTML_SCRIPT | +2 | HTML body contains script. |
| HTML_FORM | +2.5 | HTML body contains a form. |
| HTML_FRAGMENT | +0.4 | HTML part without html/body structure. |
| QR_PHISH | +3 | Asks the reader to scan a QR code (quishing moves the link to a phone). |
| CALLBACK_PHISH | +4 | Billing wording (invoice, charge, renewal, refund, unauthorized) next to a toll-free number the reader is asked to call (callback / TOAD scam). |
| BEC_SHORT_OPENER | +2 | Short free-mail message making a request - the typical BEC opener. |
| MIME_MALFORMED | +1 | Broken MIME structure. |
Bayes (learning)
| Rule | Points | Meaning |
|---|---|---|
| BAYES_99 | +3.5 | Bayes spam probability at least 99%. |
| BAYES_95 | +2.5 | Bayes spam probability 95-99%. |
| BAYES_80 | +1 | Bayes spam probability 80-95%. |
| BAYES_20 | -0.3 | Bayes ham probability 80-95%. |
| BAYES_05 | -1 | Bayes ham probability 95-99%. |
| BAYES_00 | -2 | Bayes ham probability at least 99%. |
Reputation (your own evidence)
| Rule | Points | Meaning |
|---|---|---|
| REP_SUSPICIOUS | +2.5 | One of the message's senders, domains or links has a reputation score of 30-59 from evidence across your organizations. |
| REP_BAD | +8 | An entity of the message scores 60-84 (confirmed by an administrator or seen by several organizations). Quarantines on its own at the default threshold. |
| REP_MALICIOUS | +12 | An entity of the message scores 85-100, or an administrator blocked it on the Reputation page. |
| REP_FUZZY | up to +9 | The text matches the fingerprint of a message an administrator confirmed as spam, phishing, BEC or malware (points x similarity). Spam fingerprints only match the organization that reported them. |
At most one reputation rule per message: the worst-scoring entity. Points are settings (Settings › Reputation). See Reputation.
AI review
| Rule | Points | Meaning |
|---|---|---|
| AI_CLEAN | down to -2.5 | The model judged the message clean with high confidence. Never delivers mail the rules would quarantine or reject. |
| AI_CLEAN_WEAK | 0 | The model said clean, but not confidently (no score change). |
| AI_SPAM | up to +7 | The model judged it spam (risk x confidence). |
| AI_SCAM | up to +7 | The model judged it a scam (advance fee, sextortion, crypto fraud). |
| AI_PHISH | up to +10 | The model judged it phishing. |
| AI_BEC | up to +10 | The model judged it business email compromise. |
| AI_MALWARE | up to +10 | The model judged it a malware lure. |
AI points = base (10 for phishing / BEC / malware, 7 for spam / scam) x risk/100 x (0.4 + 0.6 x confidence) x the llm.weight setting.