https://rspamd.com/doc/tutorials/quickstart.html

• postfix
• dovecot-imapd
• valkey oder redis lokal ereichbar

/etc/redis/redis.conf

…
bind 127.0.0.1 ::1
…
maxmemory 500mb
…
maxmemory-policy volatile-ttl
…

systemctl restart redis.service

Paket installieren:

apt install rspamd

Übersicht Konfiguration:

rspamadm configgraph

Konfiguration ausgeben:

rspamadm configdump

Auf welchen Ports lauscht rspamd?

lsof -ac rspamd -Pni -sTCP:LISTEN

Logs:

tail /var/log/rspamd/rspamd.log

rspamadm configwizard checks redis

→ erzeugt:

/etc/rspamd/local.d/redis.conf

write_servers = "localhost";
read_servers = "localhost";

postconf -e 'smtpd_milters = inet:localhost:11332'
postconf -e 'milter_default_action = accept'

Spricht postfix mit rspamd?

tcpdump -A -i lo tcp port 11332

Änderungen am Header loggen:

/etc/postfix/milter_header_checks

/(.+)/ WARN $1

postconf -e 'milter_header_checks = regexp:/etc/postfix/milter_header_checks'

Spam-Mail schicken, dann im Log schauen:

journalctl -f --facility=mail

→ milter-header-warning

milter_header_checks in Produktion wieder aus machen:

postconf -# milter_header_checks

GTUBE

This is the GTUBE, the
	Generic
	Test for
	Unsolicited
	Bulk
	Email
 
If your spam filter supports it, the GTUBE provides a test by which you
can verify that the filter is installed correctly and is detecting incoming
spam. You can send yourself a test mail containing the following string of
characters (in upper case and with no white spaces and line breaks):
 
XJS*C4JDBQADN1.NSBN3*2IDNEN*GTUBE-STANDARD-ANTI-UBE-TEST-EMAIL*C.34X
 
You should send this test mail from an account outside of your network.

swaks -f test@example.com -t ingo@iw-1.lxht.de --body @GTUBE

rspamadm configwizard checks controller

→ erzeugt: /etc/rspamd/local.d/worker-controller.inc

Zugriff auf WebUI:

ssh -L 11334:127.0.0.1:11334 admin@example.com

→ http://localhost:11334/

Doku: https://rspamd.com/doc/modules/dkim_signing.html

rspamadm configwizard checks dkim

• „Use domain from authenticated user for sign“ wählen
• RR in bind zone eintragen
• DMARC RR in bind zone eintragen: _dmarc.example.com TXT „v=DMARC1; p=none; rua=mailto:user1@example.com“

chown _rspamd /var/lib/rspamd/dkim/iw.lxht.de.dkim.key*

Konfiguration prüfen:

dig +short dkim._domainkey.example.com TXT
dig +short _dmarc.example.com TXT
rspamadm configdump dkim_signing

Dienst neu laden:

systemctl reload rspamd.service

Statt dessen mit ed25519 Key

selector=dkim2024
domain=example.com

rspamadm dkim_keygen -s "$selector" -d "$domain" -t ed25519 -k "${selector}-ed25519.private" > "${selector}"-ed25519.txt

dmarc Reports

redis-cli KEYS '*' | grep dmarc_rpt

redis-cli ZRANGE "dmarc_rpt;lxht.de;mailto:tuxilio@tuxi.lxht.de;20250412" 0 -1

rspamadm dmarc_report -n -v 20250412

rspamadm dmarc_report