[Rspamd-Users] Whitelist overrides - help please?

[Nihad @ RSPAMD maillist]

The part I gave you is not using trie module. It is just simple symbol score override.
If symbol is triggered, it will lower its score by -40. Making accumulated score much lower for messages that rspamd  sees as delivery failure.
 It if that symbol is not triggered you should look at what symbol is triggered and make changes accordingly.

Can you give us a list of the symbols that are affecting message score so it scores as spam?

I am not sure if true module is right way of doing what you wish to do.
Or perhaps I am not understanding what you need.

You can do multimap search that can match certain parts of the message. And it even supports regex.
So you can have a list of addresses or parts of messages that are triggered with one Multimap definition.
This is something I have used with great success to adjust scoring of certain badly configured mail servers.

Multimap that inserts WHITELIST_DELIVERY_FAIL symbol with score of -40 for messages that match user part (user at domain.tld) on messages.


in multimap.conf
WHITELIST_DELIVERY_FAIL {
 type = "header";
 header = "from";
 filter = "email:user";
 map = "/etc/rspamd/local.d/whitelist_delivery_fail.map";
 score = -40.0;
 regexp = true;
}

in whitelist_delivery_fail.map
/daemon-failure/

Not tested, but should work, if my theory is correct. :D

you just need to populate whitelist_delivery_fail.map with valid strings that emails are coming from.


/Nihad
On 17 Jul 2020, 19.41 +0200, User questions <users at lists.rspamd.com>, wrote:
>
> Should I perhaps be trying to do this via a Subject: header check
> instead (and if so, how should I do that)?