[Rspamd-Users] Ok another one...

[Michelle Sullivan]

> On 15 Sep 2025, at 09:10, Michelle Sullivan <michelle at isux.com> wrote:
> 
> 
> 
>> On 15 Sep 2025, at 02:09, Florian Piekert <floppy at floppy.org> wrote:
>> 
>> E.g. as in my multimap.conf:
>> 
>> The action directive?
>> 
>> BLACKLIST_HARD_SENDER_BLOCKED {
>> extract_from = "mime";
>> type = "from";
>> filter = "email:addr";
>> map = "$LOCAL_CONFDIR/local.d/blacklist.hard.sender.map";
>> message = "The sender is in this host's blacklist. Mail is rejected.";
>> symbol = "BLACKLISTED_SENDER";
>> action = "reject";
>> score = 100.0;
>> one_shot = true;
>> }
>> 
> 
> no, in 2 parts..
> 
> 1/ i need to do it programmatically.
> 2/ i found i could put in for example:
> 
> reject=15; # default
> hard_reject=15; # non overridable
> soft_reject=15; # user can whitelist 
> 
> however if the score is 10, it doesn't matter i select (using task:set_pre_result) soft_reject rspamc returns "add_header"..  however if i push the score to 15, game on can select any of the 3 rejects.


To give actual data:

Sep 14 23:01:01 thunderhawk rspamd[28731]: <ofd5xf>; lua; pd_from_check.lua:63: pd_from_check setting key: rs_frmchk-a4uyknxd81yp185mm5j9
Sep 14 23:01:01 thunderhawk rspamd[28731]: <d9eba8>; lua; pd_from_check.lua:96: pd_from_check setting act=hard-reject, final score=7
Sep 14 23:21:41 thunderhawk rspamd[6850]: <ofd5xf>; lua; pd_from_check.lua:63: pd_from_check setting key: rs_frmchk-a4uyknxd81yp185mm5j9
Sep 14 23:21:41 thunderhawk rspamd[6850]: <b0defc>; lua; pd_from_check.lua:96: pd_from_check setting act=hard-reject, final score=7
Sep 14 23:52:48 thunderhawk rspamd[63632]: <bpxyeu>; lua; pd_from_check.lua:66: pd_from_check setting key: rs_frmchk-a4uyknxd81yp185mm5j9
Sep 14 23:52:48 thunderhawk rspamd[63632]: <7d261c>; lua; pd_from_check.lua:99: pd_from_check setting act=false, final score=0
Sep 14 23:52:54 thunderhawk rspamd[63632]: <bpxyeu>; lua; pd_from_check.lua:66: pd_from_check setting key: rs_frmchk-a4uyknxd81yp185mm5j9
Sep 14 23:53:04 thunderhawk rspamd[63632]: <dfa8f8>; lua; pd_from_check.lua:99: pd_from_check setting act=false, final score=0
Sep 14 23:53:11 thunderhawk rspamd[63632]: <bpxyeu>; lua; pd_from_check.lua:66: pd_from_check setting key: rs_frmchk-a4uyknxd81yp185mm5j9
Sep 14 23:53:11 thunderhawk rspamd[63632]: <c2c0f1>; lua; pd_from_check.lua:99: pd_from_check setting act=add_header, final score=3

Last one, with act=add_header, was this:
root at thunderhawk:/etc/rspamd/lua.local.d# cat ~/pd_check_from_email-test3.eml | rspamc -v
Results for file: stdin (1.39 seconds)
[Metric: default]
Action: greylist
Spam: false
Score: 4.10 / 15.00
Symbol: DATE_IN_PAST (1.00)[10379]
Symbol: DMARC_NA (0.00)[isux.com]
Symbol: FROM_HAS_DN (0.00)
Symbol: MISSING_XM_UA (0.00)
Symbol: PD_FROM_CHECK (3.00)[PD_FROM_CHECK: 3.0 (1.0 * 3)]
Symbol: RCPT_COUNT_ONE (0.00)[1]
Symbol: RCVD_COUNT_ONE (0.00)[1]
Symbol: RCVD_NO_TLS_LAST (0.10)
Symbol: R_DKIM_NA (0.00)
Symbol: R_SPF_NA (0.00)[No domain]
Symbol: TO_DN_NONE (0.00)
Message-ID: 0000000000005f58ff063cfde1e7 at isux.com
Urls: []
Emails: []

root at thunderhawk:/etc/rspamd/lua.local.d# 

And one from the top that has ‘act=hard-reject':
root at thunderhawk:/etc/rspamd/lua.local.d# cat ~/pd_check_from_email-test13.eml | rspamc -v
Results for file: stdin (1.57 seconds)
[Metric: default]
Action: add header
Spam: true
Score: 8.10 / 15.00
Symbol: DATE_IN_PAST (1.00)[10379]
Symbol: DMARC_NA (0.00)[isux.com]
Symbol: FROM_HAS_DN (0.00)
Symbol: MISSING_XM_UA (0.00)
Symbol: PD_FROM_CHECK (7.00)[PD_FROM_CHECK: 7.0 (1.0 * 7)]
Symbol: RCPT_COUNT_ONE (0.00)[1]
Symbol: RCVD_COUNT_ONE (0.00)[1]
Symbol: RCVD_NO_TLS_LAST (0.10)
Symbol: R_DKIM_NA (0.00)
Symbol: R_SPF_NA (0.00)[No domain]
Symbol: TO_DN_NONE (0.00)
Message-ID: 000000000000544FEA883cfde1e76 at isux.com
Urls: []
Emails: []

root at thunderhawk:/etc/rspamd/lua.local.d# 

Code is:

        rspamd_logger.warnx(task, '%s setting act=%s, final score=%s', N, act, points)
        task:insert_result(
          settings.symbol,
          points,
          string.format('%s: %s (%s * %s)', settings.symbol, points, settings.score, multiplier)
        )
 
        if act and not act == "" then
          task:set_pre_result(
            act,
            string.format('%s: %s', settings.symbol, act),
            N
          )
        end

Also tried this:

        rspamd_logger.warnx(task, '%s setting act=%s, final score=%s', N, act, points)
        task:insert_result(
          settings.symbol,
          points,
          string.format('%s: %s (%s * %s)', settings.symbol, points, settings.score, multiplier)
        )
 
        if act and not act == "" then
          task:set_pre_result(
            act,
            string.format('%s: %s', settings.symbol, act),
            N,
            nil,
            nil,
            'process_all'
          )
        end

Which gives identical results.

Note: before anyone comments on setting up actions.conf and specifying scores for each of the custom actions, don’t want to go down that path because I don’t want scores to specify some application specific results… for example I have an action of ‘phishing’ and ‘virus’ which are routed differently to something that gets ‘hard-reject’ and of course I have ‘soft-reject’ which a user can override in their settings to ‘whitelist’ a user/email/subject/anything that we make available… unlike hard-reject that gets separate routing to spam trap/analysis destinations.

Thanks in advance.

Michelle