# SenderBase information <http://www.senderbase.org/dnsresponses.html>
# these are experimental example rules
# sa.senderbase.org for SpamAssassin queries
# query.senderbase.org for other queries
header __SENDERBASE eval:check_rbl_txt('sb', 'sa.senderbase.org.')
tflags __SENDERBASE net
# S23 = domain daily magnitude, S25 = date of first message from this domain
header SB_NEW_BULK eval:check_rbl_sub('sb', 'sb:S23 > 6.2 && (time - S25 < 120*86400)')
describe SB_NEW_BULK Sender domain is new and very high volume
tflags SB_NEW_BULK net
# S5 = category, S40 = IP daily magnitude, S41 = IP monthly magnitude
# note: accounting for rounding, "> 0.3" means at least a 59% volume spike
header SB_NSP_VOLUME_SPIKE eval:check_rbl_sub('sb', 'sb:S5 =~ /NSP/ && S41 > 3.8 && S40 - S41 > 0.3')
describe SB_NSP_VOLUME_SPIKE Sender IP hosted at NSP has a volume spike
tflags SB_NSP_VOLUME_SPIKE net
header SB_DOMAIN_VOLUME_SPIKE eval:check_rbl_sub('sb', 'sb:S23 - S24 > 0.5')
describe SB_DOMAIN_VOLUME_SPIKE Sender Domain has a volume spike
tflags SB_DOMAIN_VOLUME_SPIKE net
header SB_IP_VOLUME_SPIKE eval:check_rbl_sub('sb', 'sb:S40 - S41 > 0.35')
describe SB_IP_VOLUME_SPIKE IP has a volume spike
tflags SB_IP_VOLUME_SPIKE net
header SB_IP_DOMAIN_VOLUME_SPIKE eval:check_rbl_sub('sb', 'sb:S40 - S41 > 0.35 && S23 - S24 > 0.5')
describe SB_IP_DOMAIN_VOLUME_SPIKE Sender and IP have a volume spike
tflags SB_IP_DOMAIN_VOLUME_SPIKE net
score SB_IP_DOMAIN_VOLUME_SPIKE 2