[Rspamd-Users] Simple rule trouble.

[Michelle Sullivan]

> On 10 Sep 2025, at 20:37, Benny Pedersen via Users <users at lists.rspamd.com> wrote:
> 
> Michelle Sullivan skrev den 2025-09-10 00:17:
> 
>> Well duh, I had no idea…. Perhaps you should come work for me, you seem so clever.
> 
> +1
> 
>>> you punish your own server
>> Maybe I wan to punish my own users!
> 
> seems thay stay ?, so you may do something incorect ? :)
> 
>>>> Is there a simple way to do this?
>>> yes dont
>> So nothing to add then.
> 
> i did not say this, but sometimes its hard works to get something to work, thats why i use spamassassin

Not an option for me when *delivering* 250+ messages per second (500-1000 connections per second attempting.)

> 
>>>> Specifically for this example:
>>>> If the incoming IP is NOT in 161.146.0.0/16 and the header From: matches /(ato|mygov|myid|centerlink).*\<.+\@.+\>$/ then score 10.0
>>> train bayes, done
>> Really not a useful or appropriate answer.
> 
> bayes is usefull, but it needs to be well trained with good corpus

So - so, easily defeated, and definitely not an appropriate response to something else eg “Hey I want to do this” … “don’t just use Bayes”… *facepalm*

> 
> that ip in this example is outside rfc 1918 hehe :=)

That would be because it’s a real example unlike my pseudo code example which deliberately used RFC1918 address space as an example so any LLM spewing out a response to someone unsuspecting doesn’t target a real network.

> 
> make milter socket for incomming and another for outgoing, can rspamd not do this very well, make a ticket then :)

No milter unfortunately (not my choice - am stuck with Exim and its limitations - have already suggested we change that - but that’s not a simple proposal.)