Rspamd ratings are not applied correctly to catch-all addresses and temporary aliases

mrclschstr commented 1 year ago

Contribution guidelines

[X] I've read the contribution guidelines and wholeheartedly agree

I've found a bug and checked that ...

[X] ... I understand that not following the below instructions will result in immediate closure and/or deletion of my issue.
[X] ... I have understood that this bug report is dedicated for bugs, and not for support-related inquiries.
[X] ... I have understood that answers are voluntary and community-driven, and not commercial support.
[X] ... I have verified that my issue has not been already answered in the past. I also checked previous issues.

Description

I have a mailbox which is the catch-all destination for a domain (@example.com > info@example.com). For this mailbox I have adjusted the rspamd rating so that messages are only rejected by the server if the spam score is higher than 50.

I noticed that messages sent directly to info@example.com are correctly treated with a spam score of 50. However, mails sent to test@example.com, for example, are still treated with the default score of 15. I have noticed the same behavior with temporary email aliases (temp@example.com). My expectation would have been that the score of 50 also applies to these emails.

I suspect that the error happens in the generation of the rpamd settings maps, which looks like this:

score_infoexamplecom {
  priority = 4;
  rcpt = "/^info[+].*@example.com$/i";
  rcpt = "info@example.com";
  apply "default" {
    actions {
      reject = 50;
      greylist = 7;
      "add header" = 8;
    }
  }
}

The map explains why it does not apply to test@example.com or temp@example.com. However, I am reluctant to do any additions or modifications here as I am very inexperienced with the rspamd rules.

My current workaround for the catch-all addresses is to add frequently used email addresses as direct aliases to the inbox (test@example.com > info@example.com). However, as I want to use a unique email address for each of my online services, this is very time-consuming.

Any help appreciated.

Logs:

I've not found any relevant logs. Please tell me, if you need something specific.

Steps to reproduce:

Create a catch-all alias for a domain @example.com and the mailbox info@example.com
Logon to the mailcow UI using the info@example.com account
Click Spam filter and adjust the red rating indicator to > 50
Send an e-mail to info@example.com and monitor via the rspamd UI (tab History) that the new reject score of 50 is correctly shown
Now send an e-mail to test@example.com and monitor via the rspamd UI (tab History) that the reject score is still 15 (default value)

Note: The same behaviour applies to e-mails that have been sent to a temporary alias address.

Which branch are you using?

master

Operating System:

Ubuntu 22.04 LTS

Server/VM specifications:

8 GB RAM, 4 CPU

Is Apparmor, SELinux or similar active?

No

Virtualization technology:

KVM

Docker version:

24.0.4

docker-compose version or docker compose version:

v2.19.1

mailcow version:

2023-05a

Reverse proxy:

No

Logs of git diff:

No changes besides *.pem files

Logs of iptables -L -vn:

Relevant?

Logs of ip6tables -L -vn:

Relevant?

Logs of iptables -L -vn -t nat:

Relevant?

Logs of ip6tables -L -vn -t nat:

Relevant?

DNS check:

151.101.193.69
151.101.129.69
151.101.65.69
151.101.1.69

milkmaker commented 1 year ago

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs.

yvan-algoo commented 7 months ago

This is also an issue for us. Any suggestion for a fix or workaround would be greatly appreciated.

mrclschstr commented 7 months ago

I have already described the only workaround I currently know in the text above:

My current workaround for the catch-all addresses is to add frequently used email addresses as direct aliases to the inbox (test@example.com > info@example.com).

I would of course prefer a permanent fix 😄

yvan-algoo commented 7 months ago

Thanks @mrclschstr. I hoped for a better workaround, maybe by modifying some configuration file :-)

mailcow / mailcow-dockerized