Hi, It seems Google Forms is being used to send links to malicious sites and junk. It's making it through because of USER_IN_DEF_DKIM_WL. Is it time to remove Google/Gmail from this rule?
Perhaps a meta that combines USER_IN_DEF_DKIM_WL with BAYES_99 adds the points back? Perhaps just blocking .link domains altogether? Of course we could just add body rules ad infinitum... https://pastebin.com/gqBJa2DB
