Problems with RSPAMD

Schiedsrichter · Feb 5, 2025

Hello,

I am currently experiencing major issues with my mail server. I have set up a multi-server configuration, which is fundamentally working.

However, I am facing significant problems with emails being marked as spam or, in the worst case, being rejected outright.

When I access my MX server via:
https://mx1.mydomain.de/rspamd/#history,

I see numerous errors such as:

error querying DNS "76.96.76.144.asn.rspamd.com" on 127.0.0.1: server fail

got IO timeout with server fuzzy1.rspamd.com:11335 (135.181.136.158:11335), after 1/1 retransmits

cannot resolve maps.rspamd.com: server fail

I have no idea where else to look for the issue and would really appreciate any help.

Thank you very much!

till · Feb 5, 2025

According to the errors, your system might have issues with DNS resolving. I have not seen these errors on any system yet, therefore I used ChatGPT. The answer is:

These messages generally indicate that rspamd is having trouble obtaining additional information via DNS for various lookup tasks. In other words, parts of its spam‐filtering logic aren’t getting the data they expect from your (or external) DNS servers. Let’s break down each error:

1. Error querying DNS "76.96.76.144.asn.rspamd.com" on 127.0.0.1: server fail
Rspamd uses special DNS queries (in this case, one ending in “.asn.rspamd.com”) to retrieve Autonomous System Number (ASN) information about an IP address (here, 76.96.76.144). A response of “server fail” (often corresponding to a SERVFAIL response) means that your DNS server at 127.0.0.1 did not provide a successful answer. This can happen if:

The local resolver (often Unbound or another caching server) is misconfigured or temporarily overloaded.

The upstream DNS server for these specialized queries is not responding properly.

The DNS service is applying policies (or even network/firewall restrictions) that interfere with these “exotic” queries.

2. Got IO timeout with server fuzzy1.rspamd.com:11335 (135.181.136.158:11335), after 1 retransmits
Rspamd uses an external “fuzzy” service (fuzzy storage) to keep track of message hashes that help in detecting repeated spam. In this case, rspamd attempted to send a UDP packet to fuzzy1.rspamd.com on port 11335 and did not receive a timely reply. Even though a quick network test (for example, with netcat) might show that UDP packets can be sent, timeouts during actual operation can result from:

Temporary network congestion or connectivity issues.

The fuzzy service being momentarily slow or overloaded.

Firewall or NAT rules that interfere with UDP traffic on port 11335.

Misconfiguration in the upstream settings (for example, if the DNS names used to resolve the fuzzy server are not reliably returning the correct IP).

3. Cannot resolve maps.rspamd.com: server fail
Rspamd also downloads “maps” (lists used for spam checks such as whitelists, blacklists, or data for modules) from maps.rspamd.com. A “cannot resolve … server fail” error means that the DNS query for this hostname is failing—again, likely because your local DNS resolver returned an error (SERVFAIL) or couldn’t complete the lookup. The reasons are similar:

Your local resolver (127.0.0.1 in your configuration) may not be handling these requests correctly.

There might be transient network problems or misconfigurations in your DNS setup.

Some public DNS providers or intermediate resolvers might return a “fail” response for these specialized queries.

How to Address These Errors

Review Your DNS Configuration:
Ensure that your local DNS resolver is running correctly and is not overloaded or misconfigured. If you’re using Unbound (or another local resolver), check its logs for any additional errors. It might help to specify one or more reliable external DNS servers in your rspamd configuration rather than relying solely on 127.0.0.1. For example, in your /etc/rspamd/local.d/options.inc you might add:

dns {
timeout = 1s;
sockets = 16;
retransmits = 5;
nameserver = ["8.8.8.8:53:1", "1.1.1.1:53:1"];
}

This forces rspamd to use well‑known public resolvers if your local resolver is problematic.

Check Firewall and Network Settings:
Verify that no firewall rules (on your host or network) block UDP traffic on the ports used by DNS (53) or by the fuzzy service (11335). Even if a manual test with netcat appears to work, production traffic and retransmissions might behave differently.

Monitor the Upstream Services:
Sometimes these errors can be transient. If the remote fuzzy service or maps server is temporarily unresponsive or slow, you might see timeouts. Check the rspamd and system logs to see if the errors are persistent or intermittent.

Consider Adjusting Timeouts:
If your network is slightly slower or the upstream services are occasionally delayed, you might experiment with increasing the DNS timeout and retransmit settings. Be aware that this might delay spam processing if the queries take longer than usual.

In Summary

ASN Query Failure: The DNS query for ASN information is failing (SERVFAIL) when sent to your local resolver.

Fuzzy Service Timeout: Rspamd is not receiving a reply from fuzzy1.rspamd.com within the configured timeout period.

Map Resolution Failure: DNS queries for maps.rspamd.com are not being answered successfully.

Although these errors can look alarming, they often do not completely disable spam filtering. However, they might mean that certain reputation lookups or fuzzy storage functions are not working optimally. Adjusting your DNS configuration and ensuring reliable connectivity can often resolve these issues.

For further details and similar cases, you can see discussions on rspamd mailing lists and community forums (for example, citeturn0search1 and citeturn0search4).

If the issues persist despite these adjustments, you may need to delve deeper into your DNS server configuration or consult your network administrator to ensure that all necessary DNS queries are being handled properly.

Feel free to ask if you need more specific troubleshooting steps or further clarification on any point!
Click to expand...

Log in or Sign up

Problems with RSPAMD

Schiedsrichter New Member HowtoForge Supporter

till Super Moderator Staff Member ISPConfig Developer

Share This Page

Members

Useful Searches