Can I just take the names of the rules?
e.g. at least two checks should fire:
meta MULTIPLE_TESTS (( RAZOR2_CF_RANGE_51_100 + RAZOR2_CHECK +
URIBL_ABUSE_SURBL) > 1)
score MULTIPLE_TESTS 1
found in
X-Spam-Status: No, score=5.908 tagged_above=2 required=6.31
tests=[DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1,
DKIM_VALID_EF=-0.1, DMARC_PASS=-0.001, FSL_BULK_SIG=0.001,
HTML_MESSAGE=0.001, RAZOR2_CF_RANGE_51_100=2.43, RAZOR2_CHECK=1.729,
SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_ABUSE_SURBL=1.948]
Why is your score threshold for spam 6.31? By default it is 5, and that
message would have been spam.
The meta you suggest would have fired and added a point, but only because
the combined score for the rules it mentions added up to > 1.0. Since every
single one has a score > 1.0, the rule would have fired if any single one or
any combination of those rules fired. Is that what you intended? It would
not have fired if you had picked SPF_HELO_NONE, SPF_PASS, and FSL_BULK_SIG,
as that only adds up to 0.003.
Most commonly a meta for "multiple rules fired" would have used the &&
operator, for instance:
meta MY_MANY_RULES SPF_HELO_NONE && SPF_PASS && FSL_BULK_SIG
describe MY_MANY_RULES Several random rules hit
score MY_MANY_RULES 1
