rspamd blacklists

[DinosaurDad]

Hi, I use docker-mailserver for my personal domain. Absolutely love it, and I really like the addition of rspamd. I've upgraded to 12.1.0 and find it to work quite well.

My domain was receiving a bunch of emails that spoof my domain (via mostly yahoo and gmail) and the messages are trying to look like they were coming from my domain to my domain. Somehow almost all of them were scoring just below the rejection threshold, even though I have my DNS dmarc policy set to reject. I was able to add an rspamd dmarc blacklist rule with the webui by adding a line to dmarc_whitelist.inc.local:

mydomainhere.com both:2.0

Maybe there's a better way to configure this, but for me it works really well, and now these spoofed messages are being rejected immediately instead of piling up in the junk folder.

Most of the rest of my persistent spam woes would be well served by local blacklists that I would like to maintain with the webui. Some are from specific domains, others from specific email addresses, and then there are messages that are coming to specific garbage email addresses that collect in my overflow account. It looks like blacklists could solve all of these.

I'm new to rspamd, and don't really want to screw up mailserver. I found the following thread that looks like it's on target, generically for rspamd:

https://gist.github.com/kvaps/25507a87dc287e6a620e1eec2d60ebc1

My question is: what's the right way to incorporate a custom local blacklist configuration into rspamd within mailserver, or can this be officially added as a companion to the current whitelist configuration? Ideally, the .inc files are added to the webui for easy editing.

[casperklein]

My domain was receiving a bunch of emails that spoof my domain

If you haven't already done it, you should setup a SPF DNS record.

[DinosaurDad]

Thanks. The issue is not my SPF or DKIM. They have been correctly set up for years. My dmarc is verified and works. My new rule is properly discarding any attempts to spoof it. No problem there.

What I haven't resolved is that I am repeatedly getting emails from some domains (not mine), sender addresses, or to specific recipients, and rspamd is not rejecting them. I want to just blacklist them. Not sure how to properly do that because docker-mailserver supports whitelists but not blacklists.

[casperklein]

You can reject/discard mails based on their header.

For example, I've this in my user-patches.sh

echo '/^Subject:.*Viagra.*/ DISCARD fuckspam' >> /etc/postfix/maps/header_checks.pcre

[DinosaurDad]

Thanks! This helps. I was hoping to do it with rspamd to keep the history easily visible, but the ultimate goal is to deal with the messages. I will have a decent list of rejections, so I put together a script with a heredoc for ease of maintenance:

dms/config/user-patches.sh:

# DISCARD, REJECT, etc based on headers
HEADER_PCRE=/etc/postfix/maps/header_checks.pcre
MSG_01="blocked by header checks"

touch $HEADER_PCRE
tee -a $HEADER_PCRE <<EOF
/^From:.*somecampaignspammer.*/ REJECT $MSG_01
/^From:.*someotherspammer*/ REJECT $MSG_01
EOF