[Rspamd-Users] mark spam in subject, any side effects?

[Paul Zillmann]

Hello Lutz,

have you checked to documentation and FAQ?
A lot of your questions are answered there.

Am 13.08.22 um 12:10 schrieb lutz.niederer at gmx.net:
> Hi,
>
> just moving to rspamd and everything is new.  I have to say that I still have many problems with the config paradigm, structure, variables, etc.
>
> I would like to implement our spam filtering in a way that modifies the subject line for mails that exceed a specific first spam threshold.
> We need the subject line because we use a unified inbox.  Beyond a second (pretty high) threshold, spam mail should simply be discarded silently.
> We are using postfix milter.
>
> First question is, how do I implement these two thresholds and the actions?  To be honest I currently have no clue.

Take a look here: [1]

> Second.  If we add the tag to the subject, does this have any impact on learning spam?  Does rspamd know and remember that it added the [SPAM xx] itself?
> The prefix to the subject should look like this:   [SPAM score]    like    [SPAM 8.0]
> Below eg 4.0 it should not add any prefix to the subject, but still add the score to another header (see 3.).

Well, [SPAM is a small term that would be ignored. It's the same with 
common letters.
My spam mails use the letter e a lot - therefor any mail with the letter 
e used a lot is spam?
Obviously not.

> Third.  We need to add a header with the score as number, like X-Spam-Value: 4.0

Since you use the milter protocol, you should look here: [2]

> Fourth.  If we found the mail as false negative we would use sieve to not only notify rspamd and move to the spam folder but to also modify the subject line to mark the mail visibly as spam (unified inbox).  In that case rspamd will learn that this mail is spam, where rspamd though it is no spam.  But what about the addition of the [SPAM xx]?  Will it learn that spam mails will have [SPAM xx]?  This would not be true.  How could this be managed?
> This case is different from rspamd detected mail as spam, added the header itself and we filtered it to spam folder.  If we see it is not spam, [SPAM xx] will be deleted, means subject line will be deleted and newly added to the end by sieve.  If one decides that it should be spam, [SPAM xx] will be added again, rspamd will be notified and mail gets moved to spam again.  I believe this would work.  But the question is, what happens to mails that sieve marks as spam afterwards by adding the tag to the subject if rspamd has seen this mail as not being spam.

How does the question differ from #2?

>
> I thank you very much!
> -lutzn
>
>
>

1: https://rspamd.com/doc/faq.html#what-are-rspamd-actions
2: https://rspamd.com/doc/modules/milter_headers.html

Sincerely,
Paul