[ SEA-GHOST MINI SHELL]

# MailSpike is included in SpamAssassin 3.4+
if (version >= 3.004000)
ifplugin Mail::SpamAssassin::Plugin::DNSEval
## Spam sources
header __RCVD_IN_MSPIKE_B	eval:check_rbl('mspikeb-lastexternal', 'bl.mailspike.net.')
tflags __RCVD_IN_MSPIKE_B	net
reuse  __RCVD_IN_MSPIKE_B

## Ham sources
header __RCVD_IN_MSPIKE_L	eval:check_rbl('mspikeg-firsttrusted', 'wl.mailspike.net.')
tflags __RCVD_IN_MSPIKE_L	net
reuse  __RCVD_IN_MSPIKE_L

##### Reputation compensations
# Definitions - Bad senders
header __RCVD_IN_MSPIKE_Z	eval:check_rbl_sub('mspikeb-lastexternal', '127.0.0.2')
describe __RCVD_IN_MSPIKE_Z	Spam wave participant
tflags __RCVD_IN_MSPIKE_Z	net
reuse __RCVD_IN_MSPIKE_Z

header RCVD_IN_MSPIKE_L5	eval:check_rbl_sub('mspikeb-lastexternal', '127.0.0.10')
describe RCVD_IN_MSPIKE_L5	Very bad reputation (-5)
tflags RCVD_IN_MSPIKE_L5	net
reuse RCVD_IN_MSPIKE_L5

header RCVD_IN_MSPIKE_L4	eval:check_rbl_sub('mspikeb-lastexternal', '127.0.0.11')
describe RCVD_IN_MSPIKE_L4	Bad reputation (-4)
tflags RCVD_IN_MSPIKE_L4	net
reuse RCVD_IN_MSPIKE_L4

header RCVD_IN_MSPIKE_L3	eval:check_rbl_sub('mspikeb-lastexternal', '127.0.0.12')
describe RCVD_IN_MSPIKE_L3	Low reputation (-3)
tflags RCVD_IN_MSPIKE_L3	net
reuse RCVD_IN_MSPIKE_L3

header RCVD_IN_MSPIKE_L2	eval:check_rbl_sub('mspikeb-lastexternal', '127.0.0.13')
describe RCVD_IN_MSPIKE_L2	Suspicious reputation (-2)
tflags RCVD_IN_MSPIKE_L2	net
reuse RCVD_IN_MSPIKE_L2

# Definitions - Good senders
header RCVD_IN_MSPIKE_H5	eval:check_rbl_sub('mspikeg-firsttrusted', '127.0.0.20')
describe RCVD_IN_MSPIKE_H5	Excellent reputation (+5)
tflags RCVD_IN_MSPIKE_H5	nice net
reuse RCVD_IN_MSPIKE_H5

header RCVD_IN_MSPIKE_H4	eval:check_rbl_sub('mspikeg-firsttrusted', '127.0.0.19')
describe RCVD_IN_MSPIKE_H4	Very Good reputation (+4)
tflags RCVD_IN_MSPIKE_H4	nice net
reuse RCVD_IN_MSPIKE_H4

header RCVD_IN_MSPIKE_H3	eval:check_rbl_sub('mspikeg-firsttrusted', '127.0.0.18')
describe RCVD_IN_MSPIKE_H3	Good reputation (+3)
tflags RCVD_IN_MSPIKE_H3	nice net
reuse RCVD_IN_MSPIKE_H3

header RCVD_IN_MSPIKE_H2	eval:check_rbl_sub('mspikeg-firsttrusted', '127.0.0.17')
describe RCVD_IN_MSPIKE_H2	Average reputation (+2)
tflags RCVD_IN_MSPIKE_H2	nice net
reuse RCVD_IN_MSPIKE_H2

# *_L and *_Z may overlap each other, so account for that
meta __RCVD_IN_MSPIKE_LOW	RCVD_IN_MSPIKE_L5 || RCVD_IN_MSPIKE_L4 || RCVD_IN_MSPIKE_L3
tflags __RCVD_IN_MSPIKE_LOW	net

meta RCVD_IN_MSPIKE_ZBI		__RCVD_IN_MSPIKE_Z && !__RCVD_IN_MSPIKE_LOW
tflags RCVD_IN_MSPIKE_ZBI	net

## Meta rules for aggregating good and bad senders
# Bad
meta RCVD_IN_MSPIKE_BL		RCVD_IN_MSPIKE_L5 || RCVD_IN_MSPIKE_L4 || RCVD_IN_MSPIKE_L3 || __RCVD_IN_MSPIKE_Z
describe RCVD_IN_MSPIKE_BL	Mailspike blocklisted
tflags RCVD_IN_MSPIKE_BL	net

# Good
meta RCVD_IN_MSPIKE_WL		RCVD_IN_MSPIKE_H5 || RCVD_IN_MSPIKE_H4 || RCVD_IN_MSPIKE_H3
describe RCVD_IN_MSPIKE_WL	Mailspike good senders
tflags RCVD_IN_MSPIKE_WL	nice net

  endif
endif