Questions[rspamd](server)

RSPAMD 3.5.2

Using the multimap module I am rejecting certain email addresses via a blacklist:

multimap.conf

blacklisted_addresses {
    description = "Blacklisted addresses";
    type = "from";
    prefilter = true;
    filter = "email";
    map = "/${LOCAL_CONFDIR}/local.d/blocked_addresses.map";
    action = "reject";
    symbol = "BLACKLISTED_ADDRESS";
    regexp = "false";
}

In blocked_addresses.map I have a list of email addresses, one per line.

I put my own email address in there to test and this worked without any issue. I can see the blacklist working and I got a rejected email back from the mail server:

Error:

554 5.7.1 Matched map: BLACKLISTED_ADDRESS

However, other email addresses are able to get through. Here is one example where I'm trying to reject marketing emails from Amazon.

[email protected]

Can someone please explain this behaviour? How can I debug this further?

Rspamd has many email spam heuristics, and one of them is URI_COUNT_ODD. This heuristic seems to just count how many URIs are in the body of the email, and adds 1 to the score if the number is odd. What is the rationale behind this?

I have my mailserver setup configured based on this guideline (German), with the possibly important detail that I use CentOS 8 as a base OS instead of Debian. Everything works fine, except that I cannot manage to integrate rspamd into my setup.

If I wire up postfix to connect to rspamd by including the following lines in main.cf:

smtpd_milters = inet:localhost:11332
non_smtpd_milters = inet:localhost:11332
milter_protocol = 6
milter_mail_macros =  i {mail_addr} {client_addr} {client_name} {auth_authen}
milter_default_action = accept

and send an email, I see the following error from postfix:

postfix/submission/smtpd[125562]: fatal: host/service localhost/11332 not found: Device or resource busy

The worker-proxy.inc config for rspamd looks like

bind_socket = "localhost:11332";
milter = yes;
timeout = 120s;
upstream "local" {
    default = yes;
    self_scan = yes;
}

If I manually connect to rspamd with telnet, I don't see this error:

# telnet localhost 11332
Trying ::1...
Connected to localhost.
Escape character is '^]'.

So rspamd is listening on the expected port but postfix cannot connect to it, I do not know how to debug this any further and would appreciate any advice on how to proceed. Thanks.

What is the following rate limit bucket means in /etc/rspamd/local.d/ratelimit.conf?

bucket = [{
         burst = 10; 
         rate = "30 / 1min";
         }]

Does it mean like the following?

The bucket capacity is 10 email. And when there are 30 emails sent from an authenticated sender in 1 minute, then the rest 20 emails sent previously and the new emails would be soft rejected.

Additional questions:

• But, how much is the duration of the soft reject?
• What is the soft reject units in seconds or minutes or hours and where can I find them??

Kindly help, thank you!

I want to gradually fade out my spamassassin setup, replacing it with rspamd and I am currently one step away from activating the milter that will actually forward mails to my rspamd instance.

Before I do that I would like to test if rspamd is accidentally being too conservative or too lax. I have modified spam_header in local.d/worker-proxy.inc so it wont override spamassassins output and I upped the reject actions threshold to 30. While this should do it in theory, it would be nice to never reject any mails, just to be on the safe side.

Is there a way to instruct rspamd to never reject mails and only set the spam headers?