[Rspamd-Users] multimap or composites?

[Vu Ngoc VU]

> Date: Fri, 12 Aug 2022 14:06:07
> From: Gerald Galster <list+rspamd at gcore.biz>
> Reply-To: User questions <users at lists.rspamd.com>
> To: User questions <users at lists.rspamd.com>
> Subject: Re: [Rspamd-Users] multimap or composites?
> 
> Hello,
> with multimap you basically define rules that emit a symbol/score on matching defined criteria (from, to, ip, domain, ...).
> With composites you can rescore the email based on a combination of symbols.
>
> Example: you want to allow ip 1.2.3.4 (symbol e.g. CUSTOMER_ALLOW, score -5) but it is also found in RBL_1 (score 8).
> The final score would be: -5 + 8 = 3  --> the message may be blocked.
> With composites you could define "CUSTOMER_ALLOW AND RBL_1" and emit score 0 for this combination:
> The symbols CUSTOMER_ALLOW and RBL_1 would be removed and replaced with composite name and score.
> You can match on groups of symbols as well (defined in metrics.conf, ...)

Hello, thanks for the clarification.
As a newcomer, it's confusing where to configure/rescore messages (metrics, multimap, composites, etc.).
>
> See for more details:
> https://rspamd.com/doc/modules/multimap.html
> https://rspamd.com/doc/modules/multimap.html#multiple-symbol-maps
> https://rspamd.com/doc/configuration/composites.html (this is in section rspamd configuration, not modules)

Yes, I've seen that pages, maybe I failed to understand them, that's why I asked in the mailing-list.

> It is also possible to disable modules in settings.conf:
> https://rspamd.com/doc/configuration/settings.html
> https://rspamd.com/doc/faq.html#integration-questions
>
> There is also a dedicated whitelist module (for dkim/spf):
> https://rspamd.com/doc/modules/whitelist.html

Oh, good catch, I've seen that whitelist module first but I forgot about it. I guess it's a good place to configure partners domains when they have valid DKIM/DMARC.

> You could even define rules with lua:
> https://rspamd.com/doc/faq.html#why-are-some-symbols-missing-in-the-metric-configuration (and paragraphs below)
>
> Keep in mind that disabling modules or skipping checks early (action accept, ...), may deprive rspamd of learning from the message.
> You might want your bayes/neural to learn valid mails from trusted customers as ham, even when found on RBLs.
> Over time this will help with classification and it's possible for bayes/neural/reputation/... to autocorrect scores in some way.

Yes, my feelings about using "accept" or "reject" in multimap was as you mentioned. I would prefer to keep the bayes and neural learning even if I accept these important messages.

Thanks for your answer, appreciated.
For now, I'll try to add custom symbols in multimap and rescore in composites. Maybe later I'll try more complex things.

Best regards,

Vu~