[Rspamd-Users] per-user blacklist implementation

[Szabó Nándor]

Hello list members,

Thanks, the redis+selector successfully adapted to my needs.

My Postfix+Dovecot+LMTP setup the request_header('Delivered-To'), 
request_header('Deliver-To') map doesn't work.

After severel attempts the good map:
   map = "redis+selector://to('smtp'):lower.prepend('userbl:')";


USER_SENDER_BLACKLIST {
   type = "selector";
   selector = "from('smtp').lower;from('mime').lower";
   combinator = "array";
   map = "redis+selector://to('smtp'):lower.prepend('userbl:')";
   prefilter = true;
   score = 10.0;
   description = "Per-user sender blacklist (redis+selector)";
   debug = true;
}

This is the matching Redis data.
# redis-cli HSET userbl:rcpt at mydomain.com backlistaddress at example.com 1

There is still some fine-tuning to be done for handling aliases.

Many thanks,
Nandor



> You should be able to achieve it with redis+selector. We have
> something like the following:
>
> some_multimap {
>    type = "selector";
>    selector = "from('smtp').lower;from('mime').lower"
>    combinator = "array";
>    map = "redis+selector://request_header('Deliver-To'):lower.prepend('list:')";
>    prefilter = true;
>    score = 100000;
>    ...
> }
>
> (combinator needs rspamd 3.14.1, but can also be split into two rules,
> one for each from: smtp, mime, if needed)
>
> Where you set hash values for the listed froms on the list:rcpt keys:
>
> HSET list:rcpt backlistaddress at example.com 1
> HSET list:rcpt whitelistaddress at example.com -1
>
> and, on incoming messages, rspamd will query for both the envelope and
> the mime froms on the hash.
>
> Our internal rspamd api sends the Delivered-To header (that is common
> for groups of aliases, for example).
>
> Should be easy enough to adapt to your needs.
>
> On Sun, Feb 1, 2026 at 5:07 PM Szabó Nándor <medve at wenetto.hu> wrote:
>> Hello list members,
>>
>> I tried to create a per-user blacklist implementation  in rspamd.
>> Key and value stored in Redis: user at domain.hu (rcpt_to) and bad_user(from).
>>
>> - Writing to Redis: this works.
>> Dovecot+sieve custom script does this, using redis-cli.
>> redis-cli HSET "user_senders_blacklist" "user:${RCPT}:${FROM}" 1
>>
>> - Reading from Redis and rspamd scoring.
>> Unfortunately, this does not work at all.
>>
>> I tried two methods:
>> 1) Multimap module
>>
>> USER_SENDER_BLACKLIST {
>>     type = "from";
>>     filter = "email:addr";
>>     map = "redis://user:${rcpt}";
>>     score = 10.0;
>>     description = "Per-user sender blacklist";
>>     debug = true;
>> }
>>
>> It didn't work because multimap can only handle 1-dimensional queries.
>> Doesn't support two-dimensional (rcpt + from) lookups, or dynamic Redis
>> key selection based on ${rcpt}.
>>
>> 2) Own LUA worker module
>> Processes incoming mail and scores it based on Redis reading.
>> Due to Lua API limitations, LUA script does not run.
>> proxy; lua_metric_symbol_callback: call to (RSBL_USER_SENDER) failed
>> (2): /etc/rspamd/lua.local.d/rsbl_user_sender.lua:54: attempt to call
>> method 'get_redis' (a nil value); trace:
>> [1]:{/etc/rspamd/lua.local.d/rsbl_user_sender.lua:54 - <unknown> [Lua]};
>>
>> I am using Debian 12 + packaged rspamd, version 3.14.
>> It turns out that it does not support dynamic Redis READ from Lua.
>> Running your own LUA is only possible with a custom-compiled rspamd
>> package. Is this true?
>>
>> Has anyone managed to create such a user-based blacklist rule?
>>
>> Thanks for support.
>>
>> --
>> Regards
>> Nandor
>>
>> --
>> Users mailing list
>> Users at lists.rspamd.com
>> https://lists.rspamd.com/mailman/listinfo/users