[Rspamd-Users] Simple rule trouble.

[Michelle Sullivan]

Thank you, was trying to avoid doing this way, had already seen it but given I have a lot of rules I need to implement similarly I don’t want 2000+ map files… That said majority of the rules I need are regexes for specific things and a bunch of IPs/Networks (its less usual to need just one like in my example) and the regexes don’t need a map… but it seems like a basic functional thing one needs that is elusive on an easy way.  Another example is:

If Header1 contains Pattern1 and ( Header2 contains Pattern2 or Header 3 exists ) then score = 10.0

Again can be done with composites.. but wouldn’t scale all that well and even less so with me as I have 50+ servers (minimum) across multiple regions auto-scaling and an onerous config deployment process (we’re working on that - but 4 hours minimum to get a new configuration live.)

Regards,

Michelle

(Yes am about to get paid support, just waiting for legal team etc)


> On 9 Sep 2025, at 23:57, Tino Hendricks via Users <users at lists.rspamd.com> wrote:
> 
> Hi Michelle,
> 
> maybe there is an easier way but I use a
> https://docs.rspamd.com/configuration/composites/
> for something similar.
> 
> TEST_COMPOSITE {
>    expression = "SYMBOL1 and SYMBOL2";
>    score = 10.0;
> }
> 
> So your „SYMBOL1“ would be an ip match
> https://docs.rspamd.com/configuration/selectors#data-definition-functions
> 
> SYMBOL1 {
>        type = "from";
>        filter = "email:ip";
>        map = "/etc/rspamd/local.d/SYMBOL1.map";
> 	score = 0.0, 
>    }
> and „SYMBOL2“ a header, like
> 
> SYMBOL2 {
>    type = "content";
>    filter = "headers";
>    map = "${LOCAL_CONFDIR}/local.d/symbol2.map";
>    prefilter = false;
>   score = 0.0, 
>    regexp = true;
> }
> 
> „score = 0.0“ because you only want to apply the score, when both criteria match.
> 
> Best,
> 
> Tino
> 
>> Am 09.09.2025 um 14:45 schrieb Michelle Sullivan <michelle at isux.com>:
>> 
>> Hi All,
>> 
>> I seem to think I’m being really stupid here but I can’t seem to work out how to do the simplest of tasks in rspamd…. For example I need a rule that looks like the following (pseudo code):
>> 
>> If sender-IP is NOT in range 10.10.0.0/16 and header-from matches regexp then score = 10.0
>> 
>> Is there a simple way to do this? 
>> 
>> Specifically for this example:
>> 
>> If the incoming IP is NOT in 161.146.0.0/16 and the header From: matches /(ato|mygov|myid|centerlink).*\<.+\@.+\>$/ then score 10.0
>> 
>> Thanks,
>> 
>> Michelle
>> -- 
>> Users mailing list
>> Users at lists.rspamd.com
>> https://lists.rspamd.com/mailman/listinfo/users
> 
> -- 
> Users mailing list
> Users at lists.rspamd.com
> https://lists.rspamd.com/mailman/listinfo/users