[Rspamd-Users] DMARC quarantine + subject rewrite force action

[Matt Saladna]

Hi all,

rspamd rewrites + adds headers to mail that comes in identified as spam 
(score >= 8), which works fine for everything but 
DMARC_POLICY_QUARANTINE. Adding a subject rewrite when 
DMARC_POLICY_QUARANTINE retains the X-Spam-Flag header, but does not 
rewrite the action.

Here's the relevant configuration via configdump:

actions {
     add_header = null;
     reject = 25;
     rewrite_subject = 8;
     subject = "[SPAM] (%d) %s";
     greylist = 4;
}

milter_headers {
     custom {
         x-spam-score = <<EOD
return function(task, common_meta)
   local sc = common_meta['metric_score'] or task:get_metric_score()
   -- return no error
   return nil,
   -- header(s) to add
   {['X-Spam-Score'] = string.format('%.2f', sc[1])},
   -- header(s) to remove
   {['X-Spam-Score'] = 1},
   -- metadata to store
   {}
end

EOD;
     }
     use [
         "x-spam-score",
         "spam-header",
     ]
     extended_spam_headers = true;
     routines {
         spam-header {
             header = "X-Spam-Flag";
             value = "Yes";
         }
     }
}

dmarc {
     actions {
         reject = "reject";
         quarantine = "add_header";
     }
     reporting = false;
}

force_actions {
     rules {
         DMARC_REWRITE_SUBJECT {
             honor_action [
                 "add header",
             ]
             action = "rewrite subject";
             subject = "[DMARC] (%d) %s";
             expression = "DMARC_POLICY_QUARANTINE";
         }
     }
}

Sample header of spam that also triggered DMARC_POLICY_QUARANTINE:

Subject: Refi  Rate--Advisor  -  -Free
X-Spamd-Result: default: False [23.95 / 25.00];
	 ...
	 R_DKIM_NA(0.00)[];
	 ASN(0.00)[asn:16578, ipnet:69.94.143.0/24, country:US];
	 ONCE_RECEIVED(0.10)[];
	 ARC_NA(0.00)[];
	 DMARC_POLICY_QUARANTINE(1.50)[grittyblue.webcam : No valid SPF, No valid DKIM,quarantine];
X-Spam-Score: 23.95
X-Spam-Flag: Yes

As I understand honor_action will retain the "add header" call, so 
"rewrite subject" should also fire rewriting the subject to [DMARC] 
(<score>) <subject>?

- Matt