[Rspamd-Users] Yet another multimap mystery

[Tino Hendricks]

Hi list,

I’m trying to create a multimap that catches a certain type of SPAM that always features three significant, individual headers.

To reduce it to maximum simplicity and for testing purposes I stripped everything down to a single header which I can’t even get to match.

In my 
/etc/rspamd/local.d/multimap.conf I have (besides other, working maps)

BEWERBUNGEN {
    type = "content";
    filter = "headers";
    map = "${LOCAL_CONFDIR}/known_spam_headers.map";
    prefilter = false;
    score = 10.0;
    regexp = true;
}
(I also tried „filters = full“ to no avail)

with 
/etc/rspamd/local.d//known_spam_headers.map nothing else but

/Return-Path: <hostmaster.*/

rspamadm configdump successfully confirms it’s loaded, but output is

rspamc symbols <theEmail>
Results for file: 1710323151.2603_1.mail:2,S (0.144 seconds)
[Metric: default]
Action: no action
Spam: false
Score: 2.29 / 15.00
Symbol: ARC_NA (0.00)
Symbol: BAD_REP_POLICIES (0.50)
Symbol: BAYES_SPAM (0.09)[55.85%]
Symbol: DKIM_TRACE (0.00)[dom.com:+]
Symbol: DMARC_POLICY_ALLOW (0.00)[domain.com, quarantine]
Symbol: FROM_HAS_DN (0.00)
Symbol: FROM_NEQ_ENVFROM (0.00)[email at domain.com, hostmaster at domain.com]
Symbol: HAS_ATTACHMENT (0.00)
Symbol: HAS_REPLYTO (0.00)[email at domain.com]
Symbol: HFILTER_HOSTNAME_UNKNOWN (2.50)
Symbol: MID_RHS_MATCH_FROM (0.00)
Symbol: MIME_GOOD (-0.10)[multipart/mixed]
Symbol: MIME_HTML_ONLY (0.20)
Symbol: MIME_TRACE (0.00)[0:+, 1:~, 2:~]
Symbol: NEURAL_HAM (-0.00)[-0.980]
Symbol: PREVIOUSLY_DELIVERED (-1.00)[recipient at domain.com]
Symbol: RCPT_COUNT_ONE (0.00)[1]
Symbol: RCVD_COUNT_THREE (0.00)[3]
Symbol: RCVD_NO_TLS_LAST (0.10)
Symbol: RCVD_VIA_SMTP_AUTH (0.00)
Symbol: REPLYTO_EQ_FROM (0.00)
Symbol: R_DKIM_ALLOW (0.00)[domain.com:s=email]
Symbol: TO_DN_NONE (0.00)
Message-ID: hT13V8WfAf0KgOqCEZVcJHLWn0ulmIkQkywyMesneo at domain.com
Urls: []
Emails: ["email at domain.com“]

What am I missing?

Thank you very much.

Tino