Configure Spam Filtering#

Improve spam detection by configuring rspamd overrides and DNS-based blocklists.

Problem#

The default rspamd configuration provides basic spam filtering, but does not include:

  • DNS-based Real-time Blackhole Lists (RBLs) like Spamhaus

  • Remote fuzzy hash checking against known spam databases

  • Optimized scoring thresholds

In Kubernetes environments, RBL lookups fail because kube-dns forwards queries to public resolvers (e.g. Cloudflare, Google) which are blocked by RBL providers like Spamhaus.

Solution Overview#

cdk8s-mailu addresses this with:

  1. Unbound DNS sidecar - A recursive DNS resolver running alongside rspamd that sends queries directly to authoritative DNS servers

  2. Rspamd configuration overrides - Stricter thresholds, RBL lists, and remote fuzzy servers via ConfigMap

How It Works#

The RspamdConstruct automatically deploys:

  • An Unbound container as a sidecar in the rspamd pod

  • ConfigMaps with rspamd overrides mounted at /overrides/

  • A DNS override (options.inc) pointing rspamd to 127.0.0.1:53 (Unbound)

        graph LR
    A[Incoming Mail] --> B[Postfix]
    B -->|milter| C[rspamd]
    C -->|DNS queries| D[Unbound Sidecar]
    D -->|recursive| E[Spamhaus]
    D -->|recursive| F[Barracuda]
    D -->|recursive| G[Spamcop]
    D -->|forward| H[kube-dns]
    H -->|.cluster.local| I[K8s Services]

DNS Configuration#

The Unbound sidecar can be configured via the dns config option:

dns:
  kubeDnsIp: "10.43.0.10"      # kube-dns ClusterIP (K3S default)
  unboundImage: "mvance/unbound:1.22.0"  # Pinned image version

Default Behavior#

Without explicit dns configuration, Unbound uses:

  • 10.43.0.10 as kube-dns for .cluster.local forwarding

  • Recursive resolution for all other queries (including RBL lookups)

  • QNAME minimization disabled (required by Spamhaus)

Rspamd Overrides#

The following overrides are applied automatically:

Scoring Thresholds (actions.conf)#

reject = 12     # Reject messages with score >= 12 (default: 15)
add_header = 5  # Add X-Spam header at score >= 5 (default: 6)
greylist = 3    # Greylist at score >= 3 (default: 4)

Bayes Auto-Learning (classifier-bayes.conf)#

autolearn {
  spam_threshold = 5.0   # Learn as spam at score >= 5 (default: 6)
  ham_threshold = -1.0   # Learn as ham at score <= -1 (default: -0.5)
}

Remote Fuzzy Servers (fuzzy_check.conf)#

Checks incoming mail hashes against rspamd.com’s global fuzzy database of known spam.

RBL Blocklists (rbl.conf)#

  • Spamhaus ZEN (SBL + XBL + PBL) - IP-based blocklist

  • Spamhaus DBL - Domain-based blocklist (DKIM, URLs, emails)

  • Barracuda RBL - IP-based blocklist

  • Spamcop - IP-based blocklist

Troubleshooting#

RBL Lookups Not Working#

Verify Unbound is running and resolving correctly:

# Check both containers are running
kubectl get pods -n mailu -l app.kubernetes.io/component=rspamd

# Test RBL resolution via Unbound
kubectl exec -n mailu deploy/rspamd -c unbound -- \
  drill @127.0.0.1 2.0.0.127.zen.spamhaus.org

Too Many False Positives#

If legitimate mail is being flagged:

  1. Increase the reject threshold (e.g. to 15)

  2. Lower the greylist threshold sensitivity

  3. Check rspamd web UI for which symbols triggered

Kubernetes DNS Still Working#

Verify that .cluster.local resolution works through Unbound:

kubectl exec -n mailu deploy/rspamd -c rspamd -- \
  nslookup redis.mailu.svc.cluster.local 127.0.0.1

See Also#