AV-SPAM (Anti-Spam)

The AV-SPAM module provides advanced spam and virus filtering for your BlueOnyx mail server using Rspamd, a modern, high-performance spam filtering engine. This replaces the older SpamAssassin-based solution with a faster, more accurate, and easier-to-configure system.

Note: AV-SPAM is an optional add-on package available from the BlueOnyx shop: https://shop.blueonyx.it/blueonyx/email/av-spam.html

The AV-SPAM settings page is found under Server Management > AV-SPAM. It consists of several tabs that control different aspects of spam filtering.

The General tab contains the main on/off switch:

• Enable AV-SPAM — Master toggle to enable or disable the entire spam filtering system.

When disabled, all spam filtering is bypassed and mail flows through without scanning.

The Scoring tab configures the spam score thresholds and subject line modifications:

• Spam subject tag — Format string for modified subject lines. Use ``%d`` for the spam score and ``%s`` for the original subject. Default: ``*SPAM(%d)* %s``
• Add header score — Score at which an ``X-Spam: YES`` header is added to the message. Default: 5.0
• Reject score — Score at which incoming mail is rejected outright. Default: 15.0
• Greylist score — Score at which greylisting is temporarily applied. Default: 4.0
• Enable X-Spam-Report — Adds a detailed ``X-Spam-Report`` header showing all matching rules and their scores.

Note: Scoring is inherited from server defaults at the Vsite and User level. SiteAdmins can override Vsite scores, and users can override their personal scores.

The Sender Lists tab manages allow/block lists at the server scope:

• Sender IP blacklist / whitelist — Block or allow specific IP addresses or CIDR ranges.
• Sender domain blacklist / whitelist — Block or allow entire sender domains.
• Sender email blacklist / whitelist — Block or allow specific email addresses.

Important: These rules match the SMTP envelope sender (the ``MAIL FROM`` address), not the visible ``From:`` header in the message body. Services like Zoom may send from bounce hosts (e.g., ``bounce-sg.zoom.us``) even though the visible ``From`` shows ``no-reply@zoom.us``.

Note (AV-SPAM v8.1): The configuration syntax for some of these lists was incorrect in earlier versions, which could cause some white- and blacklists to not work as intended. This has been fixed in v8.1.

Sender lists also exist at the Vsite and User scope, allowing SiteAdmins and end users to manage their own allow/block lists.

The GeoIP tab controls country-based filtering:

• Banned countries — Check countries to block all incoming mail from those regions. Default banned countries include high-spam-volume regions.
• Whitelisted countries — Countries that are always allowed, bypassing GeoIP checks.
• GeoIP limits — Server-wide, Vsite-level, and User-level mail volume limits based on geographic origin.
• Enforce limits — Enable automatic suspension when limits are exceeded.

GeoIP data is provided by the Milter-GeoIP component, which tracks country-of-origin for every incoming connection.

The Custom Rules tab provides a scope-aware rule editor:

• Scope — Choose between Server, Vsite, or User scope.
• Rule List — View existing rules with Symbol, Target, Pattern, Score, Description, and Actions columns.
• Rule Editor — Create or edit custom Rspamd rules using multimap expressions or SpamAssassin-style syntax.

Rules are stored in plain text files:

• Server: ``/etc/mail/rspamd/custom_rules.rules``
• Vsite: ``/home/.sites/siteN/wwwroot/rspamd/custom_rules.rules``
• User: ``~username/.rspamd/custom_rules.rules``

User custom rules inherit Vsite enablement, so SiteAdmins can manage user-scoped rules.

The Services tab configures optional Rspamd modules:

• ClamAV integration — Enable virus scanning via ClamAV. Configure host, port, and max scan size.
• DCC (Distributed Checksum Clearinghouse) — Hash-based detection of bulk email, incredibly useful to detect large SPAM runs. (New in AV-SPAM v8.1)
• Rspamd DNS servers — Specify alternate DNS servers that Rspamd should use instead of the ones configured in ``/etc/resolv.conf``. Enter the IP address(es) and optionally the port number in case it isn't 53. Example: ``127.0.0.1:1053``. If left empty, Rspamd uses the default DNS resolvers from ``/etc/resolv.conf``. (New in AV-SPAM v8.1)
• Greylisting — Temporarily defer mail from unknown senders.
• SPF — Verify Sender Policy Framework records.
• DMARC — Enforce Domain-based Message Authentication.
• ARC — Authenticate Received Chain for forwarded mail.
• Bayes — Machine learning based on Redis/Valkey backend.
• IMAPSieve HAM/SPAM learning — Automatic Bayes training via the ``caughtspam`` folder. See Modify User for details on the training process. (New in AV-SPAM v8.1)
• Neural — Neural network classification (disabled by default).
• Fuzzy checks — Fuzzy hash matching against known spam.
• RBL / SURBL / URIBL — Real-time blacklist lookups.
• SPAMRATS RBLs — Real-time IP reputation lists (DNSBLs) that flag addresses associated with spam, compromised servers, or abusive infrastructure. Unlike behavioral lists that track complaint rates, SpamRATS primarily uses automated, infrastructural checks to identify non-legitimate mail servers. The three individual lists can be enabled/disabled separately: SPAMRATS DYNA, SPAMRATS NOPTR, SPAMRATS SPAM. (New in AV-SPAM v8.1)
• Ratelimiting — Connection and message rate limiting with configurable burst, window, and daily maximums.
• Redis/Valkey history — Configure history row count (default: 1000) and expiration (default: 7 days).
• Max message size — Upper limit for scanned messages.
• Scan outbound — Also scan outgoing mail for spam/viruses.

The ``/usr/sausalito/sbin/avspam_init.pl`` script (rewritten in AV-SPAM v8.1) provides quick diagnostics for the AV-SPAM services. It is not required to restart AV-SPAM related services — Systemd and Active Monitor handle that automatically — but it is handy for status checks:

~]# /usr/sausalito/sbin/avspam_init.pl -status
 
AV-SPAM service status
======================
Service                Role         Configured   Enabled      Active
---------------------- ------------ ------------ ------------ --------
Postfix                MTA          yes          enabled      active
Rspamd                 AV-SPAM      yes          enabled      active
ClamAV daemon          AV-SPAM      yes          enabled      active
ClamAV freshclam       AV-SPAM      yes          enabled      active
DCC                    AV-SPAM      yes          enabled      active
Milter-GeoIP           AV-SPAM      yes          enabled      active
IMAPSieve learning     AV-SPAM      yes          enabled      active
Health check timer     AV-SPAM      yes          enabled      active

Available switches: ``-start``, ``-restart``, ``-stop``, ``-status``.

Note: Services disabled in the GUI won't show up to avoid confusion.

After upgrading, the following new options are available in the Services tab. Enabling them is optional, but recommended:

• Enable DCC
• Enable IMAPSieve HAM/SPAM learning
• Use SPAMRATS DYNA
• Use SPAMRATS NOPTR
• Use SPAMRATS SPAM

Settings flow from Server → Vsite → User:

• Server defaults apply to all sites and users unless overridden.
• Vsite overrides allow SiteAdmins to customize settings for their site.
• User overrides allow end users to set personal thresholds and delivery actions.

Empty Vsite/User override objects are expected and correct when nothing has been changed from the server default.

At the user level, the following SPAM delivery actions are available:

• DISABLE — No spam filtering (deliver all mail normally).
• DELIVER — Deliver spam to inbox (with modified subject).
• FILE — Deliver spam to a dedicated folder (requires Procmail).
• DELETE — Discard spam silently.

The system automatically writes or removes ``~user/.procmailrc`` based on the selected action.

• AV-SPAM Rules — View and manage spam filtering rules
• AV-SPAM Stats — View filtering statistics and history