# SenderBase information <http://www.senderbase.org/dnsresponses.html>
# these are experimental example rules

# sa.senderbase.org for SpamAssassin queries
# query.senderbase.org for other queries
header __SENDERBASE eval:check_rbl_txt('sb', 'sa.senderbase.org.')
tflags __SENDERBASE net

# S23 = domain daily magnitude, S25 = date of first message from this domain
header SB_NEW_BULK      eval:check_rbl_sub('sb', 'sb:S23 > 6.2 && (time - S25 < 120*86400)')
describe SB_NEW_BULK        Sender domain is new and very high volume
tflags SB_NEW_BULK      net

# S5 = category, S40 = IP daily magnitude, S41 = IP monthly magnitude
# note: accounting for rounding, "> 0.3" means at least a 59% volume spike
header SB_NSP_VOLUME_SPIKE  eval:check_rbl_sub('sb', 'sb:S5 =~ /NSP/ && S41 > 3.8 && S40 - S41 > 0.3')
describe SB_NSP_VOLUME_SPIKE    Sender IP hosted at NSP has a volume spike
tflags SB_NSP_VOLUME_SPIKE  net

header SB_DOMAIN_VOLUME_SPIKE  eval:check_rbl_sub('sb', 'sb:S23 - S24 > 0.5')
describe  SB_DOMAIN_VOLUME_SPIKE  Sender Domain has a volume spike
tflags SB_DOMAIN_VOLUME_SPIKE  net

header SB_IP_VOLUME_SPIKE   eval:check_rbl_sub('sb', 'sb:S40 - S41 > 0.35')
describe  SB_IP_VOLUME_SPIKE  IP has a volume spike
tflags SB_IP_VOLUME_SPIKE  net

header SB_IP_DOMAIN_VOLUME_SPIKE  eval:check_rbl_sub('sb', 'sb:S40 - S41 > 0.35 && S23 - S24 > 0.5')
describe SB_IP_DOMAIN_VOLUME_SPIKE Sender and IP have a volume spike
tflags SB_IP_DOMAIN_VOLUME_SPIKE  net
score SB_IP_DOMAIN_VOLUME_SPIKE 2