1# 2# MIME validation 3# Some simple rules to find MIME errors common in messages 4# created by bulk mail programs. 5# Typically spam, but may also trap newsletters. 6# Version 1.2 7# by Byteplant GmbH 8# http://www.byteplant.com 9# download latest version here: 10# http://www.nospamtoday.com/download/mime_validate.cf 11# -------------------------------------------------------- 12# Learn more about the NoSpamToday! Anti Spam Filter here: 13# http://www.nospamtoday.com/ 14# -------------------------------------------------------- 15 16# ASCII-0 can crash mail clients. This is an absolute NO! 17rawbody MIME_ASCII0 /\0/ 18describe MIME_ASCII0 Message body contains ASCII-0 character 19score MIME_ASCII0 1.5 20 21# RFC-2822: max message line size is 998 chars + CRLF. 22# This test does not work, because SA seems to break the lines internally. 23#rawbody MIME_LINE_TOO_LONG /.{998}.+/ 24#describe MIME_LINE_TOO_LONG Message body violates RFC-2822 (line too long) 25#score MIME_LINE_TOO_LONG 1.0 26 27# Message body contains single CR or LF character 28# RFC-2822 is a bit ambiguous here, but mail like this 29# usually originates from people that did not read it. 30rawbody __MIME_BAD_CR /\x0D[^\x0A]/ 31# This test always matches, probably because of the newline handling in SA 32#rawbody __MIME_BAD_LF /[^\x0D]\x0A/ 33meta MIME_BAD_LINEBREAK __MIME_BAD_CR 34describe MIME_BAD_LINEBREAK Message body with fishy line breaks 35score MIME_BAD_LINEBREAK 0.5 36 37# Message header contains 8 bit characters. 38# This is a common MIME violation, but even more common for spammers. 39# 8-bit chars are most commonly encountered in From/Subject/To headers. 40header __MIME_8BIT_FROM From:raw =~ /[\x80-\xFF]/ 41header __MIME_8BIT_SUBJECT Subject:raw =~ /[\x80-\xFF]/ 42header __MIME_8BIT_TO To:raw =~ /[\x80-\xFF]/ 43meta MIME_8BIT_HEADER (__MIME_8BIT_TO || __MIME_8BIT_SUBJECT || __MIME_8BIT_FROM) 44describe MIME_8BIT_HEADER Message header contains 8-bit character 45score MIME_8BIT_HEADER 0.3 46