[Rspamd-Users] Control rspamd depending on subject content

[Gerald Galster]

> Hello,
> To avoid annoying spam that gets through Rspamd, I wrote this script
> 
> #!/bin/bash +x 
> if [ ! $UID = 0 ] 
> then 
>       /usr/bin/su - 
> fi 
> /usr/bin/echo "$1" >> /etc/rspamd/local.d/maps.d/sender_domain_blacklist.map 
> /usr/bin/systemctl restart rspamd.service
> 
> which unfortunately still has to be fed with the domains manually.
> Most emails have typical phrases such as “r_ezept-frei”, “Rezept-frei”, “pharmacy”, Pharma” 
> in the subject.
> Can Rspamd be configured similarly to the script shown so that a reject is triggered 
> immediately depending on special terms in the subject?

See https://rspamd.com/doc/modules/multimap.html

Example:

/etc/rspamd/local.d/multimap.conf

BLOCK_SUBJECT {
        type = "header";
        header = "Subject";
        map = "https:// or file:// [1]";
        multi = true;
        regexp = true;
        prefilter = true;
        action = "reject";
        # message = "Spammy subject blocked";
        # score = 1.0;
}

--> action = "reject" will reject immediately, otherwise score will be added


[1] Content of map file:
# /regex/ SYMBOL:SCORE
/Bitcoin-Effekt/ BLOCK_SUBJECT:4.5


/etc/rspamd/local.d/metrics.conf

symbol "BLOCK_SUBJECT" {
        weight = 1.0;
}

Best regards,
Gerald