[Rspamd-Users] multimap or composites?

[Gerald Galster]

Hello,

> I'm kinda new to rspamd and would like to write some combined rules.
> E.g. : if the client is from private network (RFC1918) or friendly networks (our corporate group) or partners networks, I want to disable some checks like RBLs.
> 
> Looks like both multimap module and composites (is this directly in core rspamd?) allow to combine symbols with conditionals.

with multimap you basically define rules that emit a symbol/score on matching defined criteria (from, to, ip, domain, ...).
With composites you can rescore the email based on a combination of symbols.

Example: you want to allow ip 1.2.3.4 (symbol e.g. CUSTOMER_ALLOW, score -5) but it is also found in RBL_1 (score 8).
The final score would be: -5 + 8 = 3  --> the message may be blocked.
With composites you could define "CUSTOMER_ALLOW AND RBL_1" and emit score 0 for this combination:
The symbols CUSTOMER_ALLOW and RBL_1 would be removed and replaced with composite name and score.
You can match on groups of symbols as well (defined in metrics.conf, ...)

See for more details:
https://rspamd.com/doc/modules/multimap.html
https://rspamd.com/doc/modules/multimap.html#multiple-symbol-maps
https://rspamd.com/doc/configuration/composites.html (this is in section rspamd configuration, not modules)

It is also possible to disable modules in settings.conf:
https://rspamd.com/doc/configuration/settings.html
https://rspamd.com/doc/faq.html#integration-questions

There is also a dedicated whitelist module (for dkim/spf):
https://rspamd.com/doc/modules/whitelist.html

You could even define rules with lua:
https://rspamd.com/doc/faq.html#why-are-some-symbols-missing-in-the-metric-configuration (and paragraphs below)

Keep in mind that disabling modules or skipping checks early (action accept, ...), may deprive rspamd of learning from the message.
You might want your bayes/neural to learn valid mails from trusted customers as ham, even when found on RBLs.
Over time this will help with classification and it's possible for bayes/neural/reputation/... to autocorrect scores in some way.

Best regards,
Gerald