[Rspamd-Users] Simple rule trouble.

[Michelle Sullivan]

> On 10 Sep 2025, at 23:03, Andrew Lewis via Users <users at lists.rspamd.com> wrote:
> 
> Hi Michelle,
> 
> On Tue, 2025-09-09 at 22:45 +1000, Michelle Sullivan wrote:
>> Is there a simple way to do this? 
>> 
>> Specifically for this example:
>> 
>> If the incoming IP is NOT in 161.146.0.0/16 and the header From:
>> matches /(ato|mygov|myid|centerlink).*\<.+\@.+\>$/ then score 10.0
> 
> In general regex rules are the way to do this sort of thing; the
> relevant limitation is inability to work with IP addresses- you might
> add a Lua condition to deal with that. Lua rules and/or selectors are
> useful for more complex requirements.
> 
> -- /etc/rspamd/lua.local.d/regex.lua
> 
> local reconf = config.regexp
> 
> reconf.MY_RULE_1 = {
>  re = [[From=/mygov/H]],
>  condition = function(task)
>    local ip = task:get_from_ip()
>    if not ip and ip:is_valid() then return false end
>    if ip:apply_mask(16):to_string() == '161.146.0.0' then return false
> end
>    return true
>  end,
>  score = 10.0,
> }


Fantastic, perfect for the example (which would solve a chunk of rules I have/want) as they are static.

However, still runs into the issue of I have to deploy them which is change control, peer-review, approval, scheduling then finally 4 hours of someone deploying them which is impractical for something that needs a dynamic response.

Thank you, I will use this for a chunk of stuff for sure.

Regards,

Michelle