[Rspamd-Users] Simple rule trouble.

[Andrew Lewis]

Hi Michelle,

On Tue, 2025-09-09 at 22:45 +1000, Michelle Sullivan wrote:
> Is there a simple way to do this? 
> 
> Specifically for this example:
> 
> If the incoming IP is NOT in 161.146.0.0/16 and the header From:
> matches /(ato|mygov|myid|centerlink).*\<.+\@.+\>$/ then score 10.0

In general regex rules are the way to do this sort of thing; the
relevant limitation is inability to work with IP addresses- you might
add a Lua condition to deal with that. Lua rules and/or selectors are
useful for more complex requirements.

-- /etc/rspamd/lua.local.d/regex.lua

local reconf = config.regexp

reconf.MY_RULE_1 = {
  re = [[From=/mygov/H]],
  condition = function(task)
    local ip = task:get_from_ip()
    if not ip and ip:is_valid() then return false end
    if ip:apply_mask(16):to_string() == '161.146.0.0' then return false
end
    return true
  end,
  score = 10.0,
}

https://docs.rspamd.com/modules/regexp/
https://docs.rspamd.com/developers/writing_rules/
https://docs.rspamd.com/developers/examples
https://docs.rspamd.com/configuration/selectors/

Best,
-AL.