Rspamd

Rspamd's multimap module can match the sending server's address against a list fetched over HTTPS, and add to the spam score when it matches. Rspamd refreshes HTTP maps by itself.

Set it up

1. Add a multimap rule in /etc/rspamd/local.d/multimap.conf:

   ISIPSAFE_LISTED {
     type = "ip";
     map = "https://isipsafe.com/api/v1/blocklist?key=sl_your_key_here&format=txt&confidenceMinimum=75";
     description = "Sending server is on the isIPsafe blocklist";
     score = 4.0;
   }

   type = "ip" checks the address of the server that connected to you, which is what the list is about.
2. Reload with systemctl reload rspamd. Watch for the symbol in the web UI's history, or with rspamc symbols < message.eml.

Start with a moderate score and look at what it catches before raising it. Listed senders are mostly compromised hosts and spam bots that also attack other services; raising confidenceMinimum in the URL makes the rule stricter about what counts.

To report spam sources in the other direction, use fail2ban on your MTA (Postfix) or the bulk upload.

Need a hand?

If something here does not work with your version of Rspamd, or you have improved it, tell us. We update these pages with what people send.

Rspamd and its logo are trademarks of their respective owners. isipsafe is not affiliated with or endorsed by them.