Docs / Obsidian Suite / Reference

Detection rule reference

Every finding that can appear in a message's Why list. Points add up to the message score; see How filtering works. Several rules name the specific item that triggered them (the domain, file or phrase) in their description on the message page.

Jump to: Allow / block lists · Sender authentication (SPF, DKIM, DMARC, ARC) · Spamhaus reputation · Antivirus · Attachments · Links · Impersonation · Content and headers · Bayes (learning) · AI review

Allow / block lists

Rule	Points	Meaning
`ALLOWLIST`	0	Sender matched an allow-list entry. Spam scoring is bypassed (but not virus checks or a DMARC p=reject failure).
`BLOCKLIST`	+100	Sender, domain or IP matched a block-list entry; the 'blocked' action applies.

Sender authentication (SPF, DKIM, DMARC, ARC)

Rule	Points	Meaning
`SPF_PASS`	-0.3	The connecting server is authorised by the envelope sender's SPF record.
`SPF_FAIL`	+3	SPF hard fail (-all): the connecting server is explicitly NOT allowed to send for that domain.
`SPF_SOFTFAIL`	+1	SPF soft fail (~all): the domain does not vouch for this server.
`SPF_PERMERROR`	+0.5	The sender's SPF record is broken.
`DKIM_INVALID`	+1.5	The message carries DKIM signatures but none verify (altered in transit or forged).
`DMARC_PASS`	-1	SPF or DKIM passed and aligned with the From domain.
`DMARC_FAIL_REJECT`	+7	DMARC failed and the From domain publishes p=reject - a likely spoof.
`DMARC_FAIL_QUARANTINE`	+5	DMARC failed and the domain publishes p=quarantine.
`DMARC_FAIL_NONE`	+1.5	DMARC failed; the domain only monitors (p=none).
`DMARC_FAIL_ARC_PASS`	+0.5	DMARC failed but a valid ARC chain shows a trusted forwarder (mailing list, M365) changed the message.
`AUTH_NONE`	+1	No SPF pass, no DKIM and no DMARC record at all - an unauthenticated sender.
`SPOOF_INTERNAL_DOMAIN`	+6	From claims one of YOUR domains but arrived from outside without passing authentication.

Spamhaus reputation

Rule	Points	Meaning
`SPAMHAUS_ZEN_SBL`	+6	Connecting IP is on the Spamhaus Block List (known spam source).
`SPAMHAUS_ZEN_CSS`	+5	Connecting IP is on the CSS list (snowshoe / low-reputation bulk sender).
`SPAMHAUS_ZEN_XBL`	+7	Connecting IP is a compromised or botnet-infected host.
`SPAMHAUS_ZEN_DROP`	+10	IP is in a hijacked / criminal netblock (DROP).
`SPAMHAUS_ZEN_PBL`	+3	IP is an end-user address that should send through its provider, not directly (only scored on the connecting hop).
`SPAMHAUS_DBL_SPAM`	+5	A sender, HELO, rDNS or link domain is a known spam domain.
`SPAMHAUS_DBL_PHISH`	+8 (x1.3 for links)	A domain in the message is a known phishing domain.
`SPAMHAUS_DBL_MALWARE`	+8 (x1.3 for links)	A domain serves malware.
`SPAMHAUS_DBL_BOTNET`	+8	A domain is a botnet command-and-control server.
`SPAMHAUS_DBL_ABUSED_SPAM`	+2	A legitimate but abused domain seen in spam.
`SPAMHAUS_DBL_ABUSED_REDIRECTOR`	+2.5	An abused URL shortener / redirector.
`SPAMHAUS_DBL_ABUSED_PHISH`	+5	A legitimate domain currently hosting phishing.
`SPAMHAUS_DBL_ABUSED_MALWARE`	+5	A legitimate domain currently hosting malware.
`SPAMHAUS_DBL_ABUSED_BOTNET`	+5	A legitimate domain abused for botnet C&C.
`SPAMHAUS_ZRD`	+2 to +3.5	Zero Reputation Domain: the domain was first seen less than 24 hours ago.
`SPAMHAUS_HBL_EMAIL`	+6	The sender / Reply-To address itself is on the Hash Blocklist.
`SPAMHAUS_HBL_FILE_MALICIOUS`	+12	An attachment's SHA-256 is known malware (treated as a virus).
`SPAMHAUS_HBL_FILE_SUSPICIOUS`	+4	An attachment's hash is suspicious.
`SPAMHAUS_HBL_CRYPTOWALLET`	+5	A cryptocurrency wallet in the body is known for fraud.

IP rules score 60% of their points when the listed address is an earlier relay rather than the connecting server. Domains checked: header From, envelope sender, Reply-To, HELO, reverse DNS and up to 60 link hosts.

Antivirus

Rule	Points	Meaning
`AV_VIRUS`	+50	ClamAV found a virus / malware signature. The message is a virus verdict (admin-only).
`AV_CONTENT_SIG`	+4 / +6	A Sanesecurity / unofficial content signature (spam or phishing, not a virus) matched.
`AV_SCAN_ERROR`	+0.5	ClamAV could not fully scan part of the message (e.g. encrypted or oversized container).
`AV_TOO_LARGE`	+0.5	Message larger than the ClamAV size limit; not virus scanned.

The antivirus is ClamAV with additional third-party content signatures.

Attachments

Rule	Points	Meaning
`ATTACH_BLOCKED_EXT`	+8	Attachment type is on the policy's blocked list (attachment policy violation).
`ATTACH_DOUBLE_EXT`	+4	Disguised double extension such as invoice.pdf.exe.
`ATTACH_NAME_TRICK`	+5	File name uses right-to-left override or whitespace padding to hide the real extension.
`ATTACH_EXEC_DISGUISED`	+10	The content is an executable (PE/ELF/LNK) whatever the name says.
`ATTACH_TYPE_MISMATCH`	+3	The file claims a harmless type (e.g. .pdf) but is really an archive or HTML.
`ATTACH_HTML`	+1.5	An HTML file is attached (common phishing wrapper).
`ATTACH_HTML_SMUGGLING`	+7	HTML attachment builds a file in the browser (atob/Blob/createObjectURL) - HTML smuggling.
`ATTACH_HTML_CREDFORM`	+7	HTML attachment contains a login / password form.
`ATTACH_OFFICE_MACRO`	+4 and up	Office document with VBA macros; more points for auto-run and suspicious keywords.
`ATTACH_OLE_OBJECT`	+2	Office document embeds an OLE object.
`ATTACH_RTF_EXPLOIT`	+6	RTF with auto-updating OLE objects (Equation Editor exploit pattern).
`ATTACH_ONENOTE`	+5	OneNote file (a common malware delivery vehicle).
`ATTACH_DISK_IMAGE`	+6	ISO / IMG disk image (used to bypass Mark-of-the-Web).
`ARCHIVE_ENCRYPTED`	+5	Password-protected archive that cannot be scanned.
`ARCHIVE_PASSWORD_IN_BODY`	+4	The password for that archive is in the message - classic malware delivery.
`ARCHIVE_SINGLE_EXEC`	+3	Archive containing a single blocked-type file.
`ARCHIVE_TOO_DEEP`	+3	Archives nested deeper than the policy allows.
`ARCHIVE_CORRUPT`	+1.5	A ZIP that cannot be opened.
`ARCHIVE_7Z`	+1	7-Zip archive (contents are not unpacked; ClamAV still scans it).
`ARCHIVE_RAR`	+1	RAR archive (contents are not unpacked; ClamAV still scans it).
`PDF_JAVASCRIPT`	+3	PDF contains JavaScript.
`PDF_LAUNCH`	+6	PDF has a /Launch action that can run programs.
`PDF_EMBEDDED_FILE`	+2	PDF embeds another file.
`PDF_OPENACTION`	+1	PDF runs an action when opened.
`PDF_XFA`	+1	PDF uses XFA forms.
`PDF_LINK_LURE`	+1.5	A small PDF whose content is essentially one link (phishing lure).

Links

Rule	Points	Meaning
`URL_DATA_URI`	+3	A link is a data: URI carrying its own payload.
`URL_JAVASCRIPT`	+3	A javascript: link.
`URL_IP_HOST`	+2.5	Link to a raw IP address instead of a domain.
`URL_PUNYCODE`	+2	Internationalised (punycode) domain - often a homoglyph lookalike.
`URL_SHORTENER`	+1	URL shortener hides the real destination.
`URL_FREE_HOSTING`	+1.5	Link to free / anonymous hosting frequently used for phishing pages (web.app, pages.dev, ipfs, blob storage...).
`URL_SUSPICIOUS_TLD`	+0.8	Domain in a high-abuse top-level domain.
`URL_USERINFO`	+3	URL uses user@host syntax to disguise the real host.
`URL_BRAND_IMPERSONATION`	+3	A link host uses a brand name (microsoft, paypal, docusign...) but is not that brand.
`URL_LOOKALIKE_ORG`	+5	A link domain imitates one of YOUR domains.
`URL_TEXT_MISMATCH`	+3	The visible link text shows one domain but the link goes to another.
`URL_FORM_EXTERNAL`	+3	An HTML form in the message posts to an external site.
`URL_REDIRECTOR`	+1.5	An open redirector link forwards to another site.
`URL_MANY_HOSTS`	+0.5	More than 25 different link hosts.

Impersonation

Rule	Points	Meaning
`VIP_DISPLAY_NAME`	+6	External sender uses the display name of one of your VIP users.
`DISPLAY_NAME_ADDRESS_MISMATCH`	+3	Display name contains an email address different from the real sender.
`DISPLAY_NAME_ORG_DOMAIN`	+2.5	External sender puts your domain name in the display name.
`DISPLAY_NAME_MIXED_SCRIPT`	+2	Display name mixes alphabets (e.g. Cyrillic letters in a Latin name).
`DISPLAY_NAME_BRAND`	+2.5	Display name claims a brand the sending domain does not belong to.
`FROM_LOOKALIKE_ORG`	+7	Sender domain imitates one of your domains (typo, homoglyph or added word).
`FROM_LOOKALIKE_BRAND`	+5	Sender domain imitates a well-known brand's domain.
`REPLYTO_MISMATCH`	+1 / +2	Replies would go to a different domain than the sender (+2 when it is a free-mail account).
`FIRST_TIME_SENDER`	+0.3	First message from this address to the organization (no earlier clean mail, never written to).

Content and headers

Rule	Points	Meaning
`HDR_NO_DATE`	+1	Missing Date header.
`HDR_DATE_FUTURE`	+1.5	Date header more than a day in the future.
`HDR_DATE_PAST`	+0.8	Date header more than a week old.
`HDR_DATE_INVALID`	+1	Date header cannot be parsed.
`HDR_NO_MESSAGE_ID`	+1.2	Missing Message-ID header.
`HDR_NO_FROM`	+2.5	Missing or unparseable From address.
`HDR_UNDISCLOSED`	+0.7	No visible recipients (BCC blast).
`HDR_MANY_RECIPIENTS`	+0.8	More than 30 visible recipients.
`HDR_SPAMWARE_MAILER`	+2.5	X-Mailer names a known bulk-spam tool.
`SUBJ_EMPTY`	+0.6	Empty subject.
`SUBJ_ALL_CAPS`	+1	Subject written entirely in capitals.
`SUBJ_EXCITED`	+0.7	Excessive punctuation in the subject.
`SUBJ_FAKE_REPLY`	+1.5	Subject starts with RE:/FW: but the message is not part of any thread.
`SUBJ_HAS_RECIPIENT`	+0.7	Subject contains the recipient's name (personalised lure).
`BULK_MAIL`	+1	Newsletter / marketing mail (List-Unsubscribe, ESP headers, Precedence: bulk). Drives the 'bulk' verdict.
`BODY_PHISH_LANGUAGE`	up to +4.5	Credential-phishing phrases (verify your account, password expires, shared a document...).
`BODY_BEC_LANGUAGE`	up to +6	Payment / urgency request phrases (wire transfer, gift cards, change of bank details...). Weighted up for free-mail, VIP-name or Reply-To mismatch.
`BODY_SCAM_LANGUAGE`	up to +5	Scam phrases (inheritance, lottery, crypto investment...).
`BODY_SEXTORTION`	+6	Sextortion / extortion wording.
`BODY_ZERO_WIDTH`	+2	Many invisible zero-width characters (filter evasion).
`BODY_MONEY_AMOUNTS`	+0.8	Many large money amounts.
`HTML_HIDDEN_TEXT`	+2	Lots of hidden HTML text (padding to fool filters).
`HTML_IMAGE_ONLY`	+1.5	Image-only message with almost no text.
`HTML_SCRIPT`	+2	HTML body contains script.
`HTML_FORM`	+2.5	HTML body contains a form.
`HTML_FRAGMENT`	+0.4	HTML part without html/body structure.
`QR_PHISH`	+3	Asks the reader to scan a QR code (quishing moves the link to a phone).
`CALLBACK_PHISH`	+4	Billing wording (invoice, charge, renewal, refund, unauthorized) next to a toll-free number the reader is asked to call (callback / TOAD scam).
`BEC_SHORT_OPENER`	+2	Short free-mail message making a request - the typical BEC opener.
`MIME_MALFORMED`	+1	Broken MIME structure.

Bayes (learning)

Rule	Points	Meaning
`BAYES_99`	+3.5	Bayes spam probability at least 99%.
`BAYES_95`	+2.5	Bayes spam probability 95-99%.
`BAYES_80`	+1	Bayes spam probability 80-95%.
`BAYES_20`	-0.3	Bayes ham probability 80-95%.
`BAYES_05`	-1	Bayes ham probability 95-99%.
`BAYES_00`	-2	Bayes ham probability at least 99%.

AI review

Rule	Points	Meaning
`AI_CLEAN`	down to -2.5	The model judged the message clean with high confidence. Never delivers mail the rules would quarantine or reject.
`AI_CLEAN_WEAK`	0	The model said clean, but not confidently (no score change).
`AI_SPAM`	up to +7	The model judged it spam (risk x confidence).
`AI_SCAM`	up to +7	The model judged it a scam (advance fee, sextortion, crypto fraud).
`AI_PHISH`	up to +10	The model judged it phishing.
`AI_BEC`	up to +10	The model judged it business email compromise.
`AI_MALWARE`	up to +10	The model judged it a malware lure.

AI points are a base (10 for phishing, BEC and malware; 7 for spam and scam) multiplied by the model's risk (0-100, as a fraction) and by its confidence.