Rspamd: The modern spam filter for Postfix, Dovecot, and professional mail infrastructures.

Why Rspamd Has Become a Standard in Modern Mail Servers

Managing a mail server today isn't simply about installing Postfix, opening the SMTP port, and delivering messages to users' mailboxes. Email is one of the most abused vectors of all: commercial spam, phishing, malware, mass campaigns, spoofed senders, malicious links, suspicious attachments, aggressive newsletters, and botnets that constantly change IP addresses. In this scenario, a traditional anti-spam system based solely on static rules is no longer sufficient.

rspamd was created precisely to meet this need: it's not a simple filter that says "spam" or "not spam," but a true email analysis framework. Each message is evaluated through multiple independent checks, called symbol, each of which contributes to an overall score. Based on this final score, Rspamd suggests an action to the mail server: accept, add headers, apply greylisting, rewrite the subject line, reject, or handle the message according to custom policies.

In a Postfix and Dovecot-based infrastructure, Rspamd represents one of the most interesting components because it works efficiently, integrates well with the SMTP flow, can use Redis for statistics and caching, offers a very useful WebUI for diagnosis and tuning, and allows progressive learning based on both automatic classifications and real user actions.

How Rspamd works in practice

When a message arrives at the server, Postfix can pass it to Rspamd via Milter integration or other scanning methods. Rspamd analyzes the message and returns a structured result: score, activated symbols, recommended action, and, if configured, additional headers. The mail server then decides what to do: deliver the message, mark it as spam, temporarily defer it, or reject it.

The strength is that Rspamd doesn't rely on a single check. A message can receive spam points because it fails SPF, comes from a poorly-reputed IP, contains blacklisted URLs, resembles campaigns already seen using fuzzy matching, is classified as spam by Bayes, or triggers heuristic rules on the content. Likewise, it can receive negative scores if it passes DKIM or DMARC, comes from trusted senders, or matches local whitelists and policies.

This approach makes Rspamd much more flexible than a binary control. There's no single "switch" that decides everything: there's a weighted sum of signals, better suited to handling the real-world complexity of email.

The main features of Rspamd

Rspamd includes numerous features designed for professional environments. The most important are:

• Symbol Scoring: Each control generates one or more symbols with positive or negative weight.
• Configurable actions: no action, add header, greylist, rewrite subject, reject, discard, quarantine, and custom actions where supported.
• Bayesian filtering: Statistical classification based on spam and ham messages learned over time.
• Autolearn: machine learning of messages that are very clearly spam or clearly legitimate.
• Fuzzy matching: Detection of similar, not just identical, messages, useful against spam campaigns with small variations.
• Neural network: neural module to improve recognition based on observed patterns.
• SPF, DKIM, DMARC, and ARC: verification of the main email authentication standards.
• DKIM signing: ability to sign outgoing mail.
• RBL, DNSBL, SURBL and URL reputation: IP, domain, URL and reputation checks.
• Greylisting: temporary deferral of suspicious messages.
• Rate limit: limitation of abnormal behavior or excessive volumes.
• Multimap: custom rules based on local or remote maps.
• Settings for user or domain: Different thresholds and policies based on recipient, sender, IP, domain, or authentication.
• WebUI: graphical interface to consult history, symbols, scores, statistics and configuration.
• Redis: Recommended backend for statistics, caching, Bayes, and scalable configurations.
• Integration with Sieve: Using Rspamd headers to move messages to Junk and collecting feedback via IMAPSieve.

The official documentation describes Rspamd as a modular system, where some core functionality is implemented in C for performance and others in Lua for flexibility and dynamic loading.

Score, symbols, and actions: the heart of Rspamd

One of the most important aspects to understand is the distinction between symbol, score e My Action!The symbol is the result of a check: for example, an SPF failure, a valid DKIM signature, a Bayes match, a suspicious URL, or a fuzzy match. Each symbol has a weight. The sum of the weights produces the final score.

Actions are then decided based on configurable thresholds. A typical configuration might include, for example, greylisting starting at 4 points, add header starting at 6 points, and reject starting at 15 points. The greylisting threshold effectively produces a soft reject action, i.e., a temporary refusal that a legitimate server would have to retry later.

# /etc/rspamd/local.d/actions.conf

actions {
reject = 15;
add_header = 6;
greylist = 4;
}

This model is very useful in production because it allows for a cautious approach. Not everything suspicious needs to be rejected immediately. Some messages can simply be flagged, others temporarily delayed, and still others rejected only when the score is very high.

Fuzzy Matching: Recognizing Similar Campaigns, Not Just Identical Emails

One of the most interesting features of Rspamd is the fuzzy matchingModern spam rarely sends the exact same message to millions of recipients. More often, it changes small portions of text, adds random words, modifies URLs, changes the subject line, or inserts dynamic elements to avoid detection via traditional hashes.

A classic hash works well when two contents are identical. Fuzzy matching, on the other hand, is used to recognize messages. similarRspamd uses a shingle-based approach: the text is divided into overlapping sequences of words, these sequences are hashed, and then probabilistically compared with known patterns. This allows it to detect campaigns that use the same template but introduce small variations to bypass simpler filters.

The module fuzzy_check Queries one or more fuzzy storage workers to see if the message resembles previously classified patterns. The same module can also handle learning, adding new hashes to the storage via rspamc or controller API.

Fuzzy storage is the component that stores fuzzy hashes. It can be local or remote, can be used for separate blacklists and whitelists via flags, and can be updated in a controlled manner. The documentation indicates that fuzzy storage can store hashes and use a match probability from 0 to 1, where 1 represents a complete match.

In practice, fuzzy is particularly useful against:

• massive spam campaigns with nearly identical text;
• phishing that changes small details between one send and the next;
• abusive newsletters or repetitive content;
• automatically generated messages with random variables;
• spam that attempts to evade exact hash checks.

Bayes and AutoLearn: The Filter That Improves Over Time

Rspamd integrates a Bayesian classifier, a statistical system that learns to distinguish between spam and legitimate messages, called ham. The true value of Bayes emerges over time: the more correct and balanced examples the system receives, the better it becomes at recognizing recurring patterns in the email of a given environment.

Learning can be manual, using commands such as rspamc learn_spam e rspamc learn_ham, or automatically via self-learnAutolearn allows Rspamd to learn from messages with very high or very low scores: for example, learning as spam a message above a certain threshold and as ham a message below a negative threshold. The documentation provides parameters such as spam_threshold, ham_threshold, check_balance e min_balance, designed to prevent the classifier from being unbalanced by too many examples of a single class.

# /etc/rspamd/local.d/classifier-bayes.conf

backend = "redis";

autolearn {
spam_threshold = 8.0;
ham_threshold = -1.0;
check_balance = true;
min_balance = 0.9;
}

The most important thing is not to be too aggressive. If you lower the thresholds too much, the system risks learning ambiguous messages. In a professional environment, it's best to automatically learn only the most obvious ones, leaving ambiguous cases to user feedback or manual review.

An often overlooked detail is that autolearning occurs after the final action has been determined and does not serve to change the decision on the message just analyzed: it serves to improve the classifier's future behavior.

Neural networks and advanced learning

In addition to Bayes, Rspamd also includes a neural module. The neural module can train automatically based on the message's verdict or, if configured, based on score thresholds. The concept is similar here: learn from the most representative messages and maintain balance between classes to avoid biased models.

In production, Bayes and neural networks shouldn't be seen as standalone magic. They're powerful tools, but they require good data. If the training is dirty, unbalanced, or based on poorly classified messages, the results will deteriorate. For this reason, it's crucial to design the learning flow well, especially when collecting user feedback.

Why Rspamd works so well with Sieve

Rspamd and Sieve complement each other very well because they work at two different times. Rspamd analyzes and classifies the message; Sieve decides what to do with it in the user's mailbox. This means Rspamd can add headers such as X-Spam o X-Spam-Action, while Sieve can read these headers and automatically move the message to the Junk folder.

In integrations based on rspamc --mime, Rspamd can add headers like X-Spam, X-Spam-Action e X-Spam-Result, which can be used by LDA, Sieve or Procmail to further filter delivery.

require ["fileinto"];

if header :contains "X-Spam" "yes" {
fileinto "Junk";
stop;
}

This separation is very elegant: Rspamd takes care of the anti-spam intelligence, Sieve takes care of the delivery logic. In a multi-user email service, this also allows for differentiation of behavior: some users may want to mark spam, others move it directly, and still others prefer more conservative rules.

IMAPSieve: Turning User Actions into Feedback

The real leap in quality comes with IMAPSieveSieve normally runs during message delivery, but IMAPSieve also allows you to run scripts in response to IMAP events, such as moving an email to a folder. Dovecot, via Pigeonhole, provides the plugin imap_sieve to enable this logic on the IMAP side.

This allows for a very interesting flow: when a user moves a message from the Inbox to the Junk folder, the system can consider it spam feedback. When a user moves a message from Junk to the Inbox, it can consider it ham feedback. A script can then send the message to Rspamd via rspamc learn_spam o rspamc learn_ham, or copy it to review folders for manual review.

Rspamd documents just such an IMAPSieve-based approach to collecting feedback from users when messages are moved to or out of the Junk folder.

protocol imap {
mail_plugins = $mail_plugins imap_sieve
}

plugin {
sieve_plugins = sieve_imapsieve sieve_extprograms
sieve_global_extensions = +vnd.dovecot.pipe
}

To call external programs from Sieve, Dovecot uses the plugin sieve_extprograms, which allows you to invoke administrator-defined programs. This is also important from a security perspective, because users cannot arbitrarily execute any system command.

Rspamd, Postfix and Dovecot: an ideal flow

In a well-designed Linux infrastructure, the flow can be schematized like this:

• Postscreen Filters coarse SMTP connections and bots before Postfix smtpd.
• Postfix receives the message and applies SMTP policies.
• rspamd analyzes content, reputation, headers, signatures and statistical patterns.
• Dovecot LMTP/LDA deliver the message to the mailbox.
• Sieve Move any spam to Junk based on headers.
• IMAPSieve Collects feedback when the user manually moves messages.
• Bayes, fuzzy and neural progressively improve future classification.

This architecture is very effective because it divides tasks. Each component does what it's designed to do: Postfix handles SMTP, Rspamd classifies, Dovecot delivers, Sieve sorts, IMAPSieve collects feedback. The result is a cleaner, more scalable, and easier to diagnose system.

Settings for domain, user and context

One of the most useful features in hosting environments is the ability to apply different settings for domain, recipient, sender, IP, or authentication status. The settings module allows you to modify thresholds, actions, and enabled modules based on specific conditions. This is especially important in multi-tenant environments, where not all customers have the same needs.

A highly sensitive corporate domain may require stricter thresholds; a marketing department may receive many legitimate newsletters and require less aggressive policies; outgoing authenticated users may be handled differently than incoming email from the Internet.

# /etc/rspamd/local.d/settings.conf

azienda_strict {
rcpt = "@azienda.it";
apply {
actions {
reject = 10.0;
add_header = 5.0;
greylist = 3.0;
}
}
}

marketing_relaxed {
rcpt = "@marketing.azienda.it";
apply {
actions {
reject = 20.0;
add_header = 10.0;
greylist = null;
}
}
}

WebUI, logs and operational tuning

Rspamd offers an extremely useful WebUI for email system administrators. From there, you can view analyzed messages, view activated symbols, check scores, review statistics, run training sessions, and understand why a message was considered spam or ham.

This is a huge operational advantage over opaque filters. When a customer reports "this email ended up in spam," the administrator can look at the actual symbols and determine whether the problem stems from SPF, DKIM, DMARC, Bayes, URL reputation, fuzzy filters, RBL, or local rules. Tuning thus becomes evidence-based, not guesswork.

False positives and best practices

An effective antispam system must block a lot of spam, but above all, it must avoid blocking legitimate email. False positives are often more serious than allowed spam, as they can cause the loss of business communications, tickets, orders, invoices, or important notifications.

For this reason, it is advisable to follow some good practices in production:

• use conservative reject thresholds, at least initially;
• mark and move to Junk before rejecting outright;
• enable autolearn only on very reliable scores;
• keep spam/ham training balanced;
• monitor the most recurring symbols in false positives;
• use whitelists and settings only when truly justified;
• do not rely on a single RBL or a single classification criterion;
• Integrate user feedback via IMAPSieve or manual review.

Why is Rspamd suitable for a managed mail service?

In a managed context, Rspamd is particularly interesting because it allows you to offer a modern spam filter without introducing unmanageable complexity. It is fast, modular, observable, and adaptable. It can be configured conservatively to avoid false positives, but also hardened for domains targeted by attacks or phishing.

The combination with Redis allows for efficient statistics and data management. The WebUI facilitates diagnosis and support. Integration with Sieve allows for the translation of spam results into concrete actions in the mailbox. User feedback closes the loop, transforming manual corrections into useful data for the future.

Compared to a purely static anti-spam tool, Rspamd is better suited to real-time email: it changes, learns, combines signals, and allows for granular tuning. It doesn't eliminate the need for proper DNS, SPF, DKIM, DMARC, reverse DNS, and IP reputation configuration, but it becomes the intelligent hub of your email protection.

Conclusion

Rspamd is currently one of the most comprehensive solutions for protecting an email infrastructure based on Linux, Postfix, and Dovecot. Its value lies not only in its ability to recognize spam, but also in its ability to combine scoring, rules, reputation, authentication, Bayes, fuzzy matching, neural networks, domain policies, and user feedback.

Fuzzy matching allows you to detect similar campaigns even when the messages are not identical. Autolearning allows the system to improve over time, provided it is configured with conservative thresholds and proper balancing. Sieve and IMAPSieve transform classification into concrete actions and allow users to contribute to filter improvement simply by moving messages in or out of the Junk folder.

In a managed infrastructure, Rspamd is more than just an anti-spam tool: it's a strategic component of security, quality of service, and business continuity. When properly configured, it reduces noise, improves internal deliverability, simplifies diagnosis, and gives administrators much finer control over email behavior.