Dear Mailcow-Team and Community First of all a huge thanks to you all for your contribution to an easy to install and maintainable full featured email server solution on open source base to use for everybody! 💪 I'm mailcow user since a year and impressed how good and simple the solution works for daily usage. My goal would be to stay long therm here. Unfortunately is there a point which increases doubts. The spam detection rate is terrible bad! My email boxes are getting literally flooded on a daily base. Only minor amount keeps hanging in the junk box. That tarnishes the pleasure to run the mailcow solution long term. Is there a plan and timeline to address this point for instance with AI powered technology? I would help and/or donate for such a plan to make/keep mailcow a good choice for the future. All I found on this topic is this mailcow post => "Rspamd GPT [Plugin"](https://community.mailcow.email/d/4028-rspamd-gpt-plugin) Wish list: - Data Privacy: Option to use Local AI - Green resource-saving design: allowing embedded system to run e.g. trigger AI filter through rspamd threshold (Rspamd GPT Plugin) and using distilled models - Continuous Improvement: Open and transparent community way to share filter experience - System Protection: Blacklist/block connections for repeat offender through help of AI Are there any planned efforts in this directions? Maybe an adapted version of DeepSeek could be an easy option for now?

Honestly, I'm not having issues with spam detection. The rspamd fuzzy was down for some days, but was recently fixed. Maybe that caused some minor bump in spam raise on your side. You can use the GPT plugin (see [rspamd docs](https://rspamd.com/doc/modules/gpt.html)) nowadays without any issues, if you wish to. It does integrate transparently with mailcow. (It also has options to run it with your own ollama installation, if you happen to have one) What also helps to some degree is the [url_redirector rspamd plugin (docs)](https://rspamd.com/doc/modules/url_redirector.html). I do have it enabled, works well. It isn't enabled by default, because it can potentially cause quite some HTTP/S calls for resolving redirections. (which not all users want) Hope this helps

@"pkernstock"#1 Thank you, I saw the GPT plugin option. It's new to me this option supports to run a local AI instance. GPT is famous for it's enormous power consumption. My HW is on embedded level very moderate on power consumption and performance. I don't want to kill my server. Do you have some experience to share? Regarding the url_redirector, is there further documentation on what this exactly does? The rspam docs are too cryptic to me only showing the config coding.

> @"VulcanTom"#p22094 It’s new to me this option supports to run a local AI instance. It was added in a quite recent rspamd commit: https://github.com/rspamd/rspamd/commit/b33cbea86d46015ca0f2ca0eb4182220b9bfa2f3 > @"VulcanTom"#p22094 My HW is on embedded level very moderate on power consumption and performance. I don’t want to kill my server. Do you have some experience to share? On a VM with approx. 20 cores @ 2 GHz a quick "Hello, how are you" takes approx. 15 minutes to reply and around 20 GB of memory or so. On a RTX 3080 Ti, it takes around 5 seconds. > @"VulcanTom"#p22094 Regarding the url_redirector, is there further documentation on what this exactly does? The rspam docs are too cryptic to me only showing the config coding. In a nutshell, it follows redirects of links in an email and then scores the links if they are known bad. In other words, it "resolves" URL shorteners such as `j.mp`

@"pkernstock"#1 Thanks again for your active response. Okay, so the local GPT is not an option at all. I'm looking for something power consumption below 10 watts average during daylong. It's my home server and I do not want to waist power. Maximum possible to use a notebook CPU powered server with peak consumption of 55 watts. Regarding the redirects, this might be an option. I checked most of my spam really has a link in there. Here is an overview of example spam I get. The spam looks very focused coming from a single source. Unfortunately are the source IP addresses alternating otherwise I would simply block them.[upl-image-preview uuid=d152da5f-0462-4505-bfb7-d451972f1cb0 url=https://community.mailcow.email/assets/files/2025-02-12/1739398400-282444-screenshot.png alt={TEXT?}]

@"VulcanTom"#p22096 I had the same problem with these exact SPAM mails. I changed some RSpamd symbols, see this thread: https://community.mailcow.email/d/4411-too-much-spam-going-through-mailcow/2 I changed the following: BAYES_SPAM = 6 (default 4.5) IP_REPUTATION_SPAM = 6 (default 4.5) BAD_REP_POLICIES = 3 (default 2) This decreased the above mails by ~ 90% I have to add: you have to move all of these mails to your Junk folder in order to train the Bayes algorithm, otherwise you won't get the BAYES_SPAM symbol to fire. I think with the current configuration you need 200(?) learned mails

The hint from @"DocFraggle"#1599 in regards to Junk folder is a crucial one. I've been hit with same emails lately, but barely getting these through now (without adjusting outlined symbols). So BAYES seems to be properly trained now.

Dear @"DocFraggle"#1599 and @"pkernstock"#1 Thanks for your prompt reply and support. My server just got updated from Nov-24 release to latest. The default values after the mailcow upgrade where: BAYES_SPAM = 4.5 IP_REPUTATION_SPAM = 4.0 BAD_REP_POLICIES = 2.0 I changed them now as @"DocFraggle"#1599 recommended. I'm curious to see how much spam filtering gets improved and share my feedback after a while of field testing.

Dear @"DocFraggle"#1599 and @"pkernstock"#1 The changed rspam settings are online since almost a week. There is much less spam in my inbox. However, the detection rate is still a kind of poor. As that type of spam emails have so a simple email subject pattern. I would expect a much aggressive learning curve to block them entirely after a short while and not even seeing them in the junk folder anymore. This is unfortunately not the case. Here is an example from 2 days ago: [upl-image-preview uuid=54a47c30-6798-452d-9222-393dfc1c87d5 url=https://community.mailcow.email/assets/files/2025-02-25/1740515254-258462-image.png alt={TEXT?}] A while ago some manual log analysis showed me altering IP addresses as source of this spam terror from same IP subnet of a dutch ISP. Any idea to directly firewall block such IP's after certain re-occurrence of spam terror? E.g. kind of Regex log filter via Fail2Ban? Or similar?

But as per your screenshot, it is in the junk folder. So it's fine? Just ignore it in the spam folder.

Well, the score is extremely low. Some spam of same type do still snake through. Additionally, I don't want think how much "brute force" traffic only this type of spam is causing on my email server. They should become simply blocked, not just nicely archived. On top of that, I'm not a fan to see how intensive my junk/quarantine is getting flooded. Good luck to find a false negative in that spam chaos.

AI-Powered Spam Filtering

stefan21

I rescaled the groups.conf and the settings.php back to -99.0. I left the symbols with -1.0.

I added a rule like this:

whitelist_sogo_userdomain {
priority = 5;
apply “default” {
SOGO_CONTACT = -1.0;
}
symbols [
“SOGO_CONTACT”
]
}

A test email from a sogo contact of a user is scored with -1.0. Seems to work… Maybe somebody else could test this?

stefan21

This approach makes only sense with a few users. Otherwise a system wide setting (see above) should be the first choice.

shafiqnoorzai

👍👍👍👍

« Previous Page