disable spamfilter (rspamd) for a single mailbox

Discussion in 'ISPConfig 3 Priority Support' started by tr909192, Aug 7, 2023.

  1. tr909192

    tr909192 Member HowtoForge Supporter

    is there a way to completelly disable the spamfilter of a particular mailbox? We tried setting the domain spamfilter to "not enabled" and the mailbox spamfilter to "inherit from domain" in ispconfig. Reading the logs we seen that rspamd continued checking the incoming mails and flagging them as spam, but apparently in an inconsistent way (sometimes rspamd only writes a couple lines in the header and nothing else, other times it does a full check and eventually flags the mail as spam)

  2. till

    till Super Moderator Staff Member ISPConfig Developer

    Set Spamfilter in the mailbox to not enabled.
  3. pyte

    pyte Well-Known Member HowtoForge Supporter

    Thats just how rspamd works. It does not display every result from every check all the time, as that would bloat the header. rpsmad only shows the result, most likly in X-SPAM-RESULT Header and the main checks that added a scoring, if enabled.
  4. tr909192

    tr909192 Member HowtoForge Supporter

    The problem here is that there is no that option on the mailbox.
    See the screenshot attached, we have only these options (aside the custom one that we have created for some customers), plus the one that inherit the domains setup.
    So basically we have:
    - we can't disable the spamfilter on the mailbox;
    - if we put "inherit from domain" options on the mailbox, and the domain has the spamfilter disabled, rspamd still filter the mail for this domain (and mailbox);
    - if we put "wants all spam" on the mailbox, we still have rspamd that check and filter these email for this mailbox.

    Are we sure that exist a way to disable completely rspamd from a mailbox?
    Here we are on a pretty standard installation (with autoinstaller), aside the custom policy created.


    Attached Files:

  5. Taleman

    Taleman Well-Known Member HowtoForge Supporter

    ISPConfig manual version 3 states on page 124:
  6. till

    till Super Moderator Staff Member ISPConfig Developer

    You have to set it to non-paying or uncensored in the mailbox. This sets the spam score to a very high level to ensure it is not marked as spam. Mails must be passed to Rspamd as Rspamd is not only a spam filter, it also provides antivirus protection, dkim signing etc. of course, you can also create a new policy named disabled if you want to have an entry with this name in the select box and then configure the policy to have a very high spam level like 999 to effectively disable spam filtering.
  7. tr909192

    tr909192 Member HowtoForge Supporter

    Thank you both, but as far as I can see both "wants all spam" and "uncensored" have the same rspamd score (to 999.00).
    Attach both screenshot.
    So also with the before "wants all spam" on the headers of the mail filtered by rspamd i have got:

    X-Spam-Level: ********
    X-Spam-Status: Yes, score=8.61
    Authentication-Results: XXXXXXX
            dkim=pass header.d=mlsend.com header.s=ml header.b=fZXcm2jK;
            spf=pass (XXXXXXX: domain of bounce-i8z3-XXXXXXX designates XXXXXXX as permitted sender) smtp.mailfrom=bounce-i8z3-XXXXXXX;
    X-Spamd-Bar: ++++++++
    X-Spam: Yes
    Now I set "uncensored" (for both maildomain and mailbox) but i'm not expecting different result.
    Should I?

    Attached Files:

  8. till

    till Super Moderator Staff Member ISPConfig Developer

    This is fine, as emails will not get scored as spam. So the question is, why an email with:

    X-Spam-Status: Yes, score=8.61

    Gets scored as spam. So you are basically asking the wrong question. The question is not how to disable spam scoring (which you did already by choosing a policy with score 999). The question is why Rspamd scores this message as spam when you set the spam threshold to 999 as the spam score of this message is way below what you set as spam level.

    Which spam policy have you set on the domain level and which score does it has? And also was this email sent to the exact email address of this mailbox, or was it maybe sent to another address on your server (which means that the policy of the original recipient address was applied).
  9. tr909192

    tr909192 Member HowtoForge Supporter

    wise words, ty.

    On the domain before the policy was set to "- not enabled -" (for the domain do exist that option).
    Is it possible that "- not enabled -" mean some default policy?
    Now i have set "uncensored" for both domain and mailbox.

    About the destination of the mail, yes it was the mailbox itself.
  10. till

    till Super Moderator Staff Member ISPConfig Developer

    Not enabled means that the defaults of Rspamd apply, but these defaults should get overridden by the policy you set for the mailbox. So we now have to dig a bit deeper into the Rspamd config to see if either ISPConfig has bot written the config or if Rspamd somehow ignores it for whatever reason.

    But before we begin, you are using latest ISPConfig version or at least 3.2.10? Because we had Rspamd issues in some of the older releases.
  11. tr909192

    tr909192 Member HowtoForge Supporter

    on that node we have ispconfig 3.2.8p1 (is planned to be updated on the next weeks). So basically is by far better to update on the latest because probabily the rspamd on my version as some strange issue on his working on i suppose...
  12. tr909192

    tr909192 Member HowtoForge Supporter

    In the mean time i have found probably the cause of the mail moved on junk folder. It's because the customer flagged the "move in junk" for the spammed email. So this triggered sieve to that:

    # Move spam to spam folder
    if anyof (header :is ["X-Spam", "X-Spam-Flag"] "Yes", header :matches "X-Spam-Status" "Yes, *") {
      fileinto :create "Junk";
      # Stop here so that we do not reply on spams
    that is coherent with the above header.
    For now i have disabled that configuration, but asap we will update that node on the latest ispconfig 3.2.11

    thank you for the support for now.
    Th0m likes this.

Share This Page