[Rspamd-Users] Problem with rspamd behaviour when interpreting whitelisting

[G.W. Haywood]

Hi there,

On Sun, 27 Oct 2024, Albrecht Backhaus via Users wrote:

> I use some maps to whitelist or blacklist certain domains. In my multimap 
> configuration I have entered “email:domain” as a filter for those maps.
>
> Now I lately have the following phenomenon:
>
> For example, if I whitelist the following domain in my maps: "test.org" and 
> receive an email from a domain "somethingtest.org", this domain is considered 
> whitelisted by rspamd obviously because it has the "test.org" at the end, 
> which from my point of view is wrong.
>
> Here is a part of my multimap.conf and an example whitelisting map
>
> sender_header_from_whitelisted_domain {
>            type ="header";
>            header = "from";
>            filter = "email:domain";
>            map = "file:///etc/rspamd/local.d/maps.d/whitelist_from_domain.map";
>            regexp = true;
>            symbol = "HEADER_SENDER_FROM_WHITELISTED_DOMAIN";
> }
>
> /etc/rspamd/local.d/maps.d/whitelist_from_domain.map
> # whitelisted domains
> test.org
>
> I use this configuration for a long time now and never recognized that 
> behavior before.
>
> Have I overseen something ?

Try setting

regex = false

instead of

regex = true

HTH

-- 

73,
Ged.