This plugin checks the message headers and body for email addresses belonging to free email services, based on the domains configured with freemail_domains. It is most useful for detecting forged reply-to setups, such as when the From: address is a free mail address but the Reply-To address is a different free mail address - a common sign of fraud and phishing campaigns.
The checks cover the From: headers (including Resent-From and the envelope-from address), the Reply-To header, and the message body. The forged reply-to test compares the free mail addresses found in the From: headers and body against the Reply-To address; when they differ, the rule fires.
Addresses or domains listed in freemail_welcomelist are ignored by the checks. In SpamAssassin 4.0 this setting was renamed from freemail_whitelist to freemail_welcomelist; the old name still works interchangeably until SpamAssassin 4.1.
When a rule lists four scores: the first applies when neither the Bayesian classifier nor network tests are in use, the second when only network tests are in use, the third when only the Bayesian classifier is in use and the fourth when both are in use.
| Area | Rule name | Description | Default scores |
|---|---|---|---|
| header | FREEMAIL_FROM |
Sender email is freemail | 0.001 |
| header | FREEMAIL_FORGED_REPLYTO |
Reply to is forged | 1.199 2.503 1.204 2.095 |
| header | FREEMAIL_ENVFROM_END_DIGIT |
Envelope-from freemail username ends in digit | 0.25 |
| header | FREEMAIL_REPLYTO_END_DIGIT |
Reply-To freemail username ends in digit | 0.25 |
| meta | FREEMAIL_REPLYTO |
Reply-To/From or Reply-To/body contain different freemails | 1.0 |
| meta | FREEMAIL_REPLY |
From and body contain different freemails | 1.0 |