<inputclass="md-option"data-md-color-media="(prefers-color-scheme: light)"data-md-color-scheme="default"data-md-color-primary="indigo"data-md-color-accent="indigo"aria-label="Switch to dark mode"type="radio"name="__palette"id="__palette_1">
<labelclass="md-header__button md-icon"title="Switch to dark mode"for="__palette_2"hidden>
<inputclass="md-option"data-md-color-media="(prefers-color-scheme: dark)"data-md-color-scheme="slate"data-md-color-primary="indigo"data-md-color-accent="blue"aria-label="Switch to light mode"type="radio"name="__palette"id="__palette_2">
<labelclass="md-header__button md-icon"title="Switch to light mode"for="__palette_1"hidden>
<ahref="https://github.com/docker-mailserver/docker-mailserver/edit/master/docs/content/config/security/rspamd.md"title="Edit this page"class="md-content__button md-icon">
<pclass="admonition-title">The current state of Rspamd integration into DMS</p>
<p>Recent pull requests have stabilized integration of Rspamd to a point that we encourage users to test the feature. We are confident that there are no major bugs in our integration that make using Rspamd infeasible. Please note that there may still be (breaking) changes ahead as integration is still work in progress!</p>
<p>We expect to stabilize this feature with version <code>v12.1.0</code>.</p>
<p>Rspamd is a <ahref="https://rspamd.com/">"fast, free and open-source spam filtering system"</a>. DMS integrates Rspamd like any other service. You will need to enable Rspamd (via <code>ENABLE_RSPAMD=1</code>) manually as it is disabled by default.</p>
<p>We provide a very simple but easy to maintain setup of Rspamd. If you want to have a look at the default configuration files for Rspamd that DMS packs, navigate to <ahref="https://github.com/docker-mailserver/docker-mailserver/tree/master/target/rspamd"><code>target/rspamd/</code> inside the repository</a>. Please consult the <ahref="#the-default-configuration">section "The Default Configuration"</a> section down below for a written overview.</p>
<p>If you want to adjust Rspamd's configuration, have a look at the <ahref="#providing-custom-settings-overriding-settings">"Providing Custom Settings & Overriding Settings" section</a> down below.</p>
<divclass="admonition note">
<pclass="admonition-title">AMD64 vs ARM64</p>
<p>We are currently doing a best-effort installation of Rspamd for ARM64 (from the Debian backports repository for Debian 11). The current version difference is two minor versions (AMD64 is at version 3.4, ARM64 at 3.2 [13th Feb 2023]).</p>
<p>Maintainers noticed only few differences, some of them with a big impact though. For those running Rspamd on ARM64, we recommend <ahref="#with-the-help-of-a-custom-file">disabling</a> the <ahref="https://rspamd.com/doc/modules/dkim_signing.html">DKIM signing module</a> if you don't use it.</p>
<h3id="mode-of-operation"><aclass="toclink"href="#mode-of-operation">Mode of Operation</a></h3>
<p>The proxy worker operates in <ahref="https://rspamd.com/doc/workers/rspamd_proxy.html#self-scan-mode">self-scan mode</a>. This simplifies the setup as we do not require a normal worker. You can easily change this though by <ahref="#providing-custom-settings-overriding-settings">overriding the configuration by DMS</a>.</p>
<p>DMS does not set a default password for the controller worker. You may want to do that yourself. In setup where you already have an authentication provider in front of the Rspamd webpage, you may add <code>secure_ip = "0.0.0.0/0";</code> to <code>worker-controller.inc</code> to disable password authentication inside Rspamd completely.</p>
<p>You can find a list of all Rspamd modules <ahref="https://rspamd.com/doc/modules/">on their website</a>.</p>
<h4id="disabled-by-default"><aclass="toclink"href="#disabled-by-default">Disabled By Default</a></h4>
<p>DMS disables certain modules (clickhouse, elastic, greylist, neural, reputation, spamassassin, url_redirector, metric_exporter) by default. We believe these are not required in a standard setup, and they would otherwise needlessly use system resources.</p>
<p>You can choose to enable ClamAV, and Rspamd will then use it to check for viruses. Just set the environment variable <code>ENABLE_CLAMAV=1</code>.</p>
<p>The <ahref="https://rspamd.com/doc/modules/rbl.html">RBL module</a> is enabled by default. As a consequence, Rspamd will perform DNS lookups to a variety of blacklists. Whether an RBL or a DNSBL is queried depends on where the domain name was obtained: RBL servers are queried with IP addresses extracted from message headers, DNSBL server are queried with domains and IP addresses extracted from the message body [<ahref="https://forum.eset.com/topic/25277-dnsbl-vs-rbl-mail-security/?do=findComment&comment=119818">source</a>].</p>
<divclass="admonition danger">
<pclass="admonition-title">Rspamd and DNS Block Lists</p>
<p>When the RBL module is enabled, Rspamd will do a variety of DNS requests to (amongst other things) DNSBLs. There are a variety of issues involved when using DNSBLs. Rspamd will try to mitigate some of them by properly evaluating all return codes. This evaluation is a best effort though, so if the DNSBL operators change or add return codes, it may take a while for Rspamd to adjust as well.</p>
<p>If you want to use DNSBLs, <strong>try to use your own DNS resolver</strong> and make sure it is set up correctly, i.e. it should be a non-public &<strong>recursive</strong> resolver. Otherwise, you might not be able (<ahref="https://www.spamhaus.org/faq/section/DNSBL%20Usage#365">see this Spamhaus post</a>) to make use of the block lists.</p>
</div>
<h3id="missing-in-the-current-implementation"><aclass="toclink"href="#missing-in-the-current-implementation">Missing in the Current Implementation</a></h3>
<p>We currently lack easy integration for <ahref="https://rspamd.com/doc/modules/dkim_signing.html">DKIM signing outgoing mails</a>. We use OpenDKIM though which works just as well. If you want to use Rspamd for DKIM signing, you need to provide all settings yourself and probably also set the environment variable <code>ENABLE_OPENDKIM=0</code>. Rspamd will still check for valid DKIM signatures for incoming mail by default.</p>
<h2id="providing-custom-settings-overriding-settings"><aclass="toclink"href="#providing-custom-settings-overriding-settings">Providing Custom Settings & Overriding Settings</a></h2>
<p>DMS brings sane default settings for Rspamd. They are located at <code>/etc/rspamd/local.d/</code> inside the container (or <code>target/rspamd/local.d/</code> in the repository). If you want to change these settings and / or provide your own settings, you can</p>
<ol>
<li>place files at <code>/etc/rspamd/override.d/</code> which will override Rspamd settings and DMS settings</li>
<li>(re-)place files at <code>/etc/rspamd/local.d/</code> to override DMS settings and merge them with Rspamd settings</li>
<p>Note that when also <ahref="#with-the-help-of-a-custom-file">using the <code>rspamd-commands</code> file</a>, files in <code>override.d</code> may be overwritten in case you adjust them manually and with the help of the file.</p>
</div>
<h3id="with-the-help-of-a-custom-file"><aclass="toclink"href="#with-the-help-of-a-custom-file">With the Help of a Custom File</a></h3>
<p>DMS provides the ability to do simple adjustments to Rspamd modules with the help of a single file. Just place a file called <code>rspamd-modules.conf</code> into the directory <code>docker-data/dms/config/</code> (which translates to <code>/tmp/docker-mailserver/</code> in the container). If this file is present, DMS will evaluate it. The structure is <em>very</em> simple. Each line in the file looks like this:</p>
<li><code>disable-module</code>: disables the module with name <code>ARGUMENT1</code></li>
<li><code>enable-module</code>: explicitly enables the module with name <code>ARGUMENT1</code></li>
<li><code>set-option-for-module</code>: sets the value for option <code>ARGUMENT2</code> to <code>ARGUMENT3</code> inside module <code>ARGUMENT1</code></li>
<li><code>set-option-for-controller</code>: set the value of option <code>ARGUMENT1</code> to <code>ARGUMENT2</code> for the controller worker</li>
<li><code>set-option-for-proxy</code>: set the value of option <code>ARGUMENT1</code> to <code>ARGUMENT2</code> for the proxy worker</li>
<li><code>set-common-option</code>: set the option <code>ARGUMENT1</code> that <ahref="https://rspamd.com/doc/configuration/options.html">defines basic Rspamd behaviour</a> to value <code>ARGUMENT2</code></li>
<li><code>add-line</code>: this will add the complete line after <code>ARGUMENT1</code> (with all characters) to the file <code>/etc/rspamd/override.d/<ARGUMENT1></code></li>
</ol>
<divclass="admonition note">
<pclass="admonition-title">File Names & Extensions</p>
<p>For command 1 - 3, we append the <code>.conf</code> suffix to the module name to get the correct file name automatically. For commands 4 - 6, the file name is fixed (you don't even need to provide it). For command 7, you will need to provide the whole file name (including the suffix) yourself!</p>
</div>
<p>You can also have comments (the line starts with <code>#</code>) and blank lines in <code>rspamd-modules.conf</code> - they are properly handled and not evaluated.</p>
<divclass="admonition tip">
<pclass="admonition-title">Adjusting Modules This Way</p>
<p>These simple commands are meant to give users the ability to <em>easily</em> alter modules and their options. As a consequence, they are not powerful enough to enable multi-line adjustments. If you need to do something more complex, we advise to do that <ahref="#manually">manually</a>!</p>
<p>This subsection gives information about the integration of <ahref="https://abusix.com/">Abusix</a>, "a set of blocklists that work as an additional email security layer for your existing mail environment". The setup is straight-forward and well documented:</p>
<ol>
<li><ahref="https://app.abusix.com/signup">Create an account</a></li>
<li>Retrieve your API key</li>
<li>Navigate to the <ahref="https://docs.abusix.com/abusix-mail-intelligence/gbG8EcJ3x3fSUv8cMZLiwA/getting-started/dmw9dcwSGSNQiLTssFAnBW#rspamd">"Getting Started" documentation for Rspamd</a> and follow the steps described there</li>
<li>Make sure to change <code><APIKEY></code> to your private API key</li>
</ol>
<p>We recommend mounting the files directly into the container, as they are rather big and not manageable with the <ahref="#with-the-help-of-a-custom-file">modules script</a>. If mounted to the correct location, Rspamd will automatically pick them up.</p>
<p>While <em>Abusix</em> can be integrated into Postfix, Postscreen and a multitude of other software, we recommend integrating <em>Abusix</em> only into a single piece of software running in your mail server - everything else would be excessive and wasting queries. Moreover, we recommend the integration into suitable filtering software and not Postfix itself, as software like Postscreen or Rspamd can properly evaluate the return codes and other configuration.</p>
<scriptid="__config"type="application/json">{"base":"../../..","features":["navigation.tabs","navigation.top","navigation.expand","navigation.instant","content.code.annotate"],"search":"../../../assets/javascripts/workers/search.b97dbffb.min.js","translations":{"clipboard.copied":"Copied to clipboard","clipboard.copy":"Copy to clipboard","search.config.lang":"en","search.config.pipeline":"trimmer, stopWordFilter","search.config.separator":"[\\s\\-]+","search.placeholder":"Search","search.result.more.one":"1 more on this page","search.result.more.other":"# more on this page","search.result.none":"No matching documents","search.result.one":"1 matching document","search.result.other":"# matching documents","search.result.placeholder":"Type to start searching","search.result.term.missing":"Missing","select.version.title":"Select version"},"version":{"provider":"mike"}}</script>
