Spam filtering (Rspamd)
Zappocity scores mail from other servers with Rspamd while it arrives, and files it in the inbox or Junk, or refuses it, by the recipient's rules. ClamAV plugs into Rspamd's antivirus module for viruses. What people move into and out of Junk teaches Rspamd, from webmail and from any mail app.
Turning it on
Install Rspamd (and, if you want virus scanning, ClamAV with Rspamd's antivirus module) on the server or one it can reach. Then, in the admin panel under Settings → Spam filtering (Rspamd), or from the command line:
sudo corpsuite spam set enabled:=true url=http://127.0.0.1:11334 password=-- Rspamd address is its controller worker (port 11334 by default), so scoring and learning use one address.
- Controller password is needed for learning. It is stored sealed with the server's key file and never shown again; the panel shows only whether one is set.
- Wait for a score is how long a message waits for Rspamd (5 seconds by default).
- Deliver unscanned while Rspamd cannot be reached (on by default). Off asks senders to try again later instead, so nothing arrives unscanned, but mail is delayed while Rspamd is down.
- Learn sends what users move to Rspamd (on by default).
Changes apply within 30 seconds on every server, at once on the one that saved them. Test connection (or corpsuite spam test) checks the saved settings: that Rspamd answers, how fast, and that the controller takes the password.
What happens to a message
Each recipient has a junk score and a reject score:
| Score | What happens |
|---|---|
| Below the junk score | Delivered as usual. |
| From the junk score | Filed in Junk. |
| From the reject score | Refused for that recipient. |
The scores come from the user's own setting, else their team's, else the platform's (6 and 15 by default). The reject score is set for a whole team; users only choose their junk score.
- Allowed senders (an address, or a domain and its subdomains) are never filed in Junk or refused as spam. Blocked senders always go to Junk. A team's lists apply to everyone in it, on top of each user's own. The envelope sender and the From address are both checked.
- Viruses (Rspamd symbols with
VIRUSin their name, such asCLAM_VIRUS) are refused for everyone, allowed or not. - A message to several people is refused only when every one of them would refuse it; the others that would get it in Junk. This matches how DMARC failures are handled, because SMTP has one answer per message.
- Every scanned message gets
X-Spam-Status,X-Spam-ScoreandX-Spam-Actionheaders, which filters can use. The same headers coming from the sender are removed first, so nobody can mark their own mail as clean.
Mail between users of this server is not scanned.
Learning
Moving a message into Junk teaches Rspamd it is spam; moving it out of Junk to any folder but Trash teaches it it is not. This works for webmail, for mail apps over IMAP (moving or copying into Junk) and for anything using JMAP. Mail the server itself files in Junk teaches nothing. Lessons are sent every 30 seconds with the user's address as Deliver-To, so Rspamd's per-user statistics work when you turn them on in Rspamd. While Rspamd is down they wait, for up to a day.
Teams and users
- A team's owners and admins set the team's scores and lists on the team's page (Spam), in the domain admin panel or the admin panel. From the command line:
corpsuite tenant spam set acme junkScore:=5 block:='["spammy.example"]'. - Users set their own junk score and lists in webmail under Settings → Spam; administrators can with
corpsuite mailbox spam set.
For developers
GET/PATCH /v1/spam-settings, /v1/tenants/{tenantId}/spam-policy and /v1/tenants/{tenantId}/accounts/{accountId}/spam-policy in api/openapi.yaml, and GET/PUT /api/mail/spam-policy in api/webmail.yaml. Reports: /v1/spam-reports, /v1/tenants/{tenantId}/spam-reports/... and POST /api/mail/report.
Reporting spam and phishing
On an open message, or on ticked ones, Report spam and Report phishing send a copy to the team's administrators and move the message to Junk (which also teaches the filter). Reporting works without Rspamd too.
Reports appear:
- for a team's owners and admins under Reported spam and phishing on the team's page in the domain admin panel;
- for the platform operator under Reports in the admin panel, from every tenant.
For each report you can:
- Save .eml: download the message as it arrived, with all its headers, to look at it safely or pass it on. The panel never shows the message itself, since it may be a phishing page.
- Remove everywhere: move every copy of the message in the team (found by its Message-ID) to each person's Junk. Use it when phishing reached several people.
- Note and Resolve (or Reopen): the note is for administrators only; resolving records who did it.
Each report keeps the reporter, the sender, the subject, the spam score and the Authentication-Results header the message arrived with. A user can make 200 reports a day. From the command line: corpsuite tenant reports acme, tenant report quarantine acme ID, tenant report set acme ID status=resolved and spam reports for every tenant.