[Rspamd-Users] Reject force_action based on symbol and score

[Philip Iezzi]

Hi there,

I am trying to write a force_action module reject rule based on a symbol and spam score, something like:

rules {
  REJECT_SPAMMY_FORWARDING {
    action = "reject";
    expression = "IS_FORWARDING & ${score} > 4.0"; # pseudo expression, don't copy!
  }
}

while IS_FORWARDING symbol would be defined in multimaps (and forwardings.inc.local would contain recipient email addresses that are forwarded to external ones):

IS_FORWARDING {
    type = "rcpt";
    map = "/etc/rspamd/local.d/maps.d/forwardings.inc.local";
}

The idea:
Reject at a lower score than usual (defined in local.d/actions.conf as reject score) for recipients that are forwardings and will not get filtered by final destination mailbox Sieve rule. As we only filter on Dovecot mailbox level based on X-Spam-Level header, and want the customer to have full control over the relevant spam score, we cannot lower the global reject score.

I don't know about the expression syntax to check for score, as this does not seem to be documented anywhere. I am running latest Rspamd 2.7 on Debian Buster. In Rspamd 1.7 Changelog, it says:
> [Feature] Add ability to match score in force_actions module

... which sounds exactly like what I need.

Any help is greatly appreciated!

Cheers,
Philip