[Rspamd-Users] Simple rule trouble.

[Tino Hendricks]

Hi Michelle,

maybe there is an easier way but I use a
https://docs.rspamd.com/configuration/composites/
for something similar.

TEST_COMPOSITE {
    expression = "SYMBOL1 and SYMBOL2";
    score = 10.0;
}

So your „SYMBOL1“ would be an ip match
https://docs.rspamd.com/configuration/selectors#data-definition-functions

 SYMBOL1 {
        type = "from";
        filter = "email:ip";
        map = "/etc/rspamd/local.d/SYMBOL1.map";
	score = 0.0, 
    }
and „SYMBOL2“ a header, like

SYMBOL2 {
    type = "content";
    filter = "headers";
    map = "${LOCAL_CONFDIR}/local.d/symbol2.map";
    prefilter = false;
   score = 0.0, 
    regexp = true;
}

„score = 0.0“ because you only want to apply the score, when both criteria match.

Best,

Tino

> Am 09.09.2025 um 14:45 schrieb Michelle Sullivan <michelle at isux.com>:
> 
> Hi All,
> 
> I seem to think I’m being really stupid here but I can’t seem to work out how to do the simplest of tasks in rspamd…. For example I need a rule that looks like the following (pseudo code):
> 
> If sender-IP is NOT in range 10.10.0.0/16 and header-from matches regexp then score = 10.0
> 
> Is there a simple way to do this? 
> 
> Specifically for this example:
> 
> If the incoming IP is NOT in 161.146.0.0/16 and the header From: matches /(ato|mygov|myid|centerlink).*\<.+\@.+\>$/ then score 10.0
> 
> Thanks,
> 
> Michelle
> -- 
> Users mailing list
> Users at lists.rspamd.com
> https://lists.rspamd.com/mailman/listinfo/users

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4401 bytes
Desc: not available
URL: <https://lists.rspamd.com/pipermail/users/attachments/20250909/d538249a/attachment.bin>