# SpamBouncer Known Legitimate Personal eMail Sources
#
#  This section whitelists email from known legitimate sources, and
#  particularly order information coming from legitimate businesses
#  and email from legitimate non-profit organizations that may
#  get service from less-than-whitehat ISPs.
#
#  I also whitelist specific order information coming from
#  businesses that do mainsleaze spamming and are otherwise
#  blocked by the SpamBouncer.
#
#  Anything whitelisted in this section will not be filtered
#  further, so I whitelist narrowly.  That means that, unless a
#  company or non-profit has a strict non-spamming policy that
#  it enforces, I will only whitelist specific email addresses
#  that are used for non-spam purposes.
#
#  I will, however, whitelist entire domains when their policies
#  and behavior show them to be good guys. :)


# Amazon
:0
* ^Received:.*from [a-z][a-z0-9]*\.amazon\.com.*\[207\.171\.(1[6-8][0-9]|19[0-1])\.[0-9][0-9]?[0-9]?\]
* ^From:.*(account-update)@amazon\.com([^a-z0-9\.]|$)
{ KNOWNLEGIT=yes }


# Barnes & Noble
:0
* ^Received:.*from [a-z][a-z0-9]*\.amazon\.com.*\[208\.237\.178\.[0-9][0-9]?[0-9]?\]
* ^From:.*(service)@barnesandnoble\.com([^a-z0-9\.]|$)
{ KNOWNLEGIT=yes }


# Billpoint
:0
* ^Received:.*from [a-z][a-z0-9]*\.ebay\.com \([a-z][a-z0-9]*\.ebay\.com \[216\.3[2-5]\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\]\)
* ^Received:.*from [a-z][a-z0-9]*\.billpoint\.com \([a-z][a-z0-9]*\.billpoint\.com \[10\.3\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\]\)
* ^From:.*billpoint@billpoint\.com([^a-z0-9\.]|$)
{ KNOWNLEGIT=yes }


# Dell Order info
:0
* ^Subject: (Dell Order Information|\
             Dell Order Shipment Confirmation)
* ^Received: .*[^0-9a-z]dell\.com([^a-z0-9\.]|$)
* ^(From|Sender).*[^0-9a-z]dell\.com([^a-z0-9\.]|$)
{ KNOWNLEGIT=yes }


# eBay
#
# Sort out legitimate eBay stuff.  There are spammers that forge
# legitimate eBay addresses, so I don't just assume the From: line
# means it came from eBay.
#
:0
* ^Received: from (([a-z][a-z0-9]*\.)?[a-z][a-z0-9]*\.ebay\.com \(([a-z][a-z0-9]*\.)?[a-z][a-z0-9]*\.ebay\.com \[66\.135\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\]\)|\
                  [a-z][a-z0-9]*\.ebay\.com \(([a-z][a-z0-9]*\.)?[a-z][a-z0-9]*\.ebay\.com \[216\.3[2-5]\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\]\))
* ^From:.*(aw-confirm|bidconfirm|endofauction|endofitem|savedsearches)@ebay\.(com|co\.de|co\.uk)([^a-z0-9\.]|$)
* ^X-eBay-MailTracker:
{ KNOWNLEGIT=yes }


# Equifax
#
:0
* ^Received: from ([a-z][a-z0-9]*\.)?[a-z][a-z0-9]*\.equifax\.com[ ]?\((really )?\[216\.46\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\]\)
* ^From:.*member\.benefits@equifax\.com([^a-z0-9\.]|$)
{ KNOWNLEGIT=yes }


# Klingon Language Institute
#
:0
* ^Received:.*from .*\[64\.81\.214\.101\]\)
* ^From:.*kli\.org([^a-z0-9\.]|$)
* ! ^Mailing-List:
{ KNOWNLEGIT=yes }


# Powell's Bookstore
#
:0
* (^Received:.*from [a-z][a-z0-9]*\.powells\.com \([a-z][a-z0-9]*\.powells\.com \[204\.245\.236\.[0-9][0-9]?[0-9]?\]\)|\
   ^Received:.*from [a-z][a-z0-9]*\.powells\.com \([a-z][a-z0-9]*\.powells\.com \[206\.163\.11\.[0-9][0-9]?[0-9]?\]\))
* ^From:.*powells\.com([^a-z0-9\.]|$)
{ KNOWNLEGIT=yes }


# UPS
#
:0
* ^Received:.*from [a-z][a-z0-9]* \([a-z][a-z0-9\.]*\.ups\.com \[153\.2\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\]\)
* ^From:.*(auto-notify|pkginfo)@ups\.com([^a-z0-9\.]|$)
{ KNOWNLEGIT=yes }


# VeriSign/NetworkSolutions
#
#  Verisign definitely spams, and is one of the more abusive spammers out
#  there.  It also has legitimate customers and sends legitimate email.
#  Where possible, I whitelist sources of known legitimate email within
#  Verisign.  It will not always be possible, since VeriSign changes domain
#  names, moves servers around, and does not notify me (or other maintainers
#  of spam filters) when it does so.
#
:0
* ^Received:.*(from [a-z][a-z0-9\.]*\.(networksolutions|verisign)-em\.com \(63\.71\.102\.[0-9][0-9]?[0-9]?(:[0-9]+)?\)|\
               from [a-z][a-z0-9\.]*\.peoplesupport\.com \(HELO [a-z][a-z0-9\.]*\.peoplesupport\.com\) \(216.34.217.[0-9][0-9]?[0-9]?\))
* ^From:.*((migration)@verisign\.com([^a-z0-9\.]|$)|\
           (custserv)@netsol\.com([^a-z0-9\.]|$))
{ KNOWNLEGIT=yes }


:0
* KNOWNLEGIT ?? yes
{
 :0 f
 | ${FORMAIL} -A"X-SBPass: Known Legitimate eMail"

 :0
 { WHITELIST=yes }
}



# SpamBouncer Known Legitimate Bulk eMail Sources
#
#  This section whitelists email from known legitimate mailing lists,
#  lists that do not spam, and that properly confirm subscriptions.
#  In other words, this is a list of good guys who aren't spammers. :)
#  If your mailing list or ISP are listed here, don't worry.  You
#  aren't being labeled a spammer -- quite the contrary.
#
:0
* ^(By:|Cc:|From.|list-[0-9a-z][-_0-9a-z]:|Mailing-List:|Reply-To:|Sender:).*[^0-9a-z](.*@(bible|moses)\.acu\.edu([^a-z0-9\.]|$)|\
              .*@public\.lists\.apple\.com([^a-z0-9\.]|$)|\
              .*@lists\.besties\.com([^a-z0-9\.]|$)|\
              freematt@coil\.com([^a-z0-9\.]|$)|\
              .*@lists\.debian\.org([^a-z0-9\.]|$)|\
              owner-iep@dublin13\.com([^a-z0-9\.]|$)|\
              owner-freebsd-announce@FreeBSD\.org([^a-z0-9\.]|$)|\
              owner-.*@inf\.ed\.ac\.uk([^a-z0-9\.]|$)|\
              .*@.*eff\.org([^a-z0-9\.]|$)|\
              info@emigrant\.ie([^a-z0-9\.]|$)|\
              firewalls.*@lists\.gnac\.net([^a-z0-9\.]|$)|\
              news@infobeat\.com([^a-z0-9\.]|$)|\
              news@jazzconnect\.com([^a-z0-9\.]|$)|\
              kli-.*@.*kli\.org([^a-z0-9\.]|$)|\
              spam-l@peach\.ease\.lsoft\.com([^a-z0-9\.]|$)|\
              .*@.*mozilla\.org([^a-z0-9\.]|$)|\
              sendpage-hackers@net\.ohio-state\.edu([^a-z0-9\.]|$)|\
              .*@list\.ora\.com([^a-z0-9\.]|$)|\
              .*@.*python\.org([^a-z0-9\.]|$)|\
              procmail@informatik\.rwth-aachen\.de([^a-z0-9\.]|$)|\
              .*@lists\.skylist\.net([^a-z0-9\.]|$)|\
              .*@lists\.spambouncer\.org([^a-z0-9\.]|$)|\
              campus@vu\.org([^a-z0-9\.]|$)|\
              webring@.*webring-inc\.com([^a-z0-9\.]|$)|\
              .*@lists\.wired\.com([^a-z0-9\.]|$))
{ KNOWNLEGITBULK=yes }


# SFFnet Automailer
:0
* ^X-Mailer: SFF Net Automailer
* ^(From|Received|Sender).*[^0-9a-z](greyware\.com([^a-z0-9\.]|$)|\
                       sff\.net([^a-z0-9\.]|$))
{ KNOWNLEGITBULK=yes }


:0
* KNOWNLEGITBULK ?? yes
{
 :0 f
 | ${FORMAIL} -A"X-SBPass: Known Legitimate Bulk eMail"

 :0
 { WHITELIST=yes }

 :0
 { BULKTAG=yes }
}


# HABEAS -- The Habeas User's List (HUL)
#
# Email from servers on the Habeas User's List can be whitelisted,
# just as if you'd listed the domain in your NOBOUNCE # or
# LEGITLISTS files.
#
:0
* HABEASVERIFIED ?? yes
{
 :0
 * $!FIRSTEXIP ?? 000.000.000.000
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${FIRSTEXREVIP}.hul.habeas.com` }

  :0
  * $ REVCHECKIP ?? 127\.0\.0\.2
  {
   :0 f
   | ${FORMAIL} -A"X-SBRule: IP ${FIRSTEXIP} is in the HUL"

   :0
   { HBSHUL=yes }
  }
 }

 :0
 * $!SECONDEXIP ?? 000.000.000.000
 * $!SECONDEXIP ?? ${FIRSTEXIP}
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${SECONDEXREVIP}.hul.habeas.com` }

  :0
  * $ REVCHECKIP ?? 127\.0\.0\.2
  {
   :0 f
   | ${FORMAIL} -A"X-SBRule: IP ${SECONDEXIP} is in the HUL"

   :0
   { HBSHUL=yes }
  }
 }

 :0
 * $!THIRDEXIP ?? 000.000.000.000
 * $!THIRDEXIP ?? ${FIRSTEXIP}
 * $!THIRDEXIP ?? ${SECONDEXIP}
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${THIRDEXREVIP}.hul.habeas.com` }

  :0
  * $ REVCHECKIP ?? 127\.0\.0\.2
  {
   :0 f
   | ${FORMAIL} -A"X-SBRule: IP ${THIRDEXIP} is in the HUL"

   :0
   { HBSHUL=yes }
  }
 }

 :0
 * $!FOURTHEXIP ?? 000.000.000.000
 * $!FOURTHEXIP ?? ${FIRSTEXIP}
 * $!FOURTHEXIP ?? ${SECONDEXIP}
 * $!FOURTHEXIP ?? ${THIRDEXIP}
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${FOURTHEXREVIP}.hul.habeas.com` }

  :0
  * $ REVCHECKIP ?? 127\.0\.0\.2
  {
   :0 f
   | ${FORMAIL} -A"X-SBRule: IP ${FOURTHEXIP} is in the HUL"

   :0
   { HBSHUL=yes }
  }
 }
}

:0
* HBSHUL ?? yes
{
 :0 f
 | ${FORMAIL} -A"X-SBPass: Habeas (Verified)"

 :0
 { WHITELIST=yes }
}
