describe FROM_ALL_NUMS From numeric address (except US/Canada phones)
# faked addresses tend to come from big public sites, but avoid overlap
header __ADDR_NUMS_AT_BIGSITE ALL =~ /^(?:To|From|Cc|Reply-To):\s{0,20}<?\S{0,20}\d{5,}\S{0,20}\@(?:bigfoot|email|excite|hotmail|juno|msn|yahoo)\.(?:com|net|org)/mi
describe X_ORIG_IP_NOT_IPV4 X-Originating-IP doesn't look like IPv4 address
# match the format of a legit X-Auth-Warning header, and hit on fake ones
# normal: "e4e.oac.uci.edu: foo owned process doing -bs"
# fake: "bzgrdag, upaeqehv"
header X_AUTH_WARN_FAKED X-Authentication-Warning !~ /(?:set sender to \S{2,80} using -f|owned process doing -bs|claimed to be|didn.t use HELO protocol)/ [if-unset: host.example.com: foo owned process doing -bs]