[Rspamd-Users] multimap or composites?
list+rspamd at gcore.biz
Fri Aug 12 12:06:07 UTC 2022
> I'm kinda new to rspamd and would like to write some combined rules.
> E.g. : if the client is from private network (RFC1918) or friendly networks (our corporate group) or partners networks, I want to disable some checks like RBLs.
> Looks like both multimap module and composites (is this directly in core rspamd?) allow to combine symbols with conditionals.
with multimap you basically define rules that emit a symbol/score on matching defined criteria (from, to, ip, domain, ...).
With composites you can rescore the email based on a combination of symbols.
Example: you want to allow ip 18.104.22.168 (symbol e.g. CUSTOMER_ALLOW, score -5) but it is also found in RBL_1 (score 8).
The final score would be: -5 + 8 = 3 --> the message may be blocked.
With composites you could define "CUSTOMER_ALLOW AND RBL_1" and emit score 0 for this combination:
The symbols CUSTOMER_ALLOW and RBL_1 would be removed and replaced with composite name and score.
You can match on groups of symbols as well (defined in metrics.conf, ...)
See for more details:
https://rspamd.com/doc/configuration/composites.html (this is in section rspamd configuration, not modules)
It is also possible to disable modules in settings.conf:
There is also a dedicated whitelist module (for dkim/spf):
You could even define rules with lua:
https://rspamd.com/doc/faq.html#why-are-some-symbols-missing-in-the-metric-configuration (and paragraphs below)
Keep in mind that disabling modules or skipping checks early (action accept, ...), may deprive rspamd of learning from the message.
You might want your bayes/neural to learn valid mails from trusted customers as ham, even when found on RBLs.
Over time this will help with classification and it's possible for bayes/neural/reputation/... to autocorrect scores in some way.
More information about the Users