Documentation request: Spam filter

[boldt]

The whole documentation on https://mailu.io/ does not describe, how the spam filter works or can be used. Maybe it's because I uses SA the last decade.

• Are there any (false positive) mails dropped into the Junk folder by rspamd?
• Does rspamd lean from mails I put into the Junk folder?

My observation: After some days in action, the rspam backend shows only no action or reject.

[kaiyou]

Here are some items, feel free to create a PR that adds some of them to the documentation if you have the time. Most of the lack of documentation is caused by a lack of time.

• rspamd rejects non-compliant messages and viruses (the latter being under discussion) only
• rspamd adds antispam headers to messages
• dovecot is then responsible of classifying messages to the Junk folder based on user preferences, especially the spam tolerance which is basically a threshold on the spam score
• the logic in dovecot is implemented via sieve scripts loaded from the admin API
• the lower your spam tolerance, the more false positive you will find in your junk folder, fine tuning it is the user responsibility since everyone feels differently about the legitimacy of some adds
• moving a message to or from the spam folder triggers the rspamd classifier so rspamd can learn, it mostly saves bayesian rules atm.

[aksdb]

So it would make sense (for every user) to add a sieve rule to move depending on the number of "*" in the X-Spam-Level header, right?

However: I would think the obvious target for these messages would be the "Junk" folder. But wouldn't that immediately retrigger the learning and therefore constantly reinforcing spam learnings, thereby increasing the spam likelyhood everytime you receive a already spam-classified mail?

[liquidat]

@kaiyou Thanks for the details. I am happy to do a documentation PR to add this to the documentation!
Only one question left for me to fully understand this:

the logic in dovecot is implemented via sieve scripts loaded from the admin API

How do we modify those Sieve scripts? Via an imap client connecting to dovecot, or from within the admin interface? I haven't seen an option to do that in the admin interface, but might be too blind to spot it.

[Diman0]

@kaiyou Thanks for the details. I am happy to do a documentation PR to add this to the documentation!
Only one question left for me to fully understand this:

the logic in dovecot is implemented via sieve scripts loaded from the admin API

How do we modify those Sieve scripts? Via an imap client connecting to dovecot, or from within the admin interface? I haven't seen an option to do that in the admin interface, but might be too blind to spot it.

The sieve script is hardcoded in Mailu/core/admin/mailu/internal/templates/default.sieve (in the git project).
The relevant sieve part is:
if spamtest :percent :value "gt" :comparator "i;ascii-numeric" "{{ user.spam_threshold }}"
Basically it converts the score from rspamd to a percentage. Rspamd has a maximum score of 15. For example a score of 10 is 66% (10 / 15). If this score is larger than the user defined spam threshold then the email is marked as read and moved to the spam folder.

Therefore as kaiyou stated, the lower the user defined spam threshold is defined, the higher chance you will get false positives.

[Nebukadneza]

With #1586 merged, i think there was a big leap in documentation regarding spam-filtering — thanks so much to @Diman0 . Thus, i would like to close this issue …