Set higher spam score when mail comes from specific ASN

Hawthorn

Hello community,

I have been receiving a lot of spam emails lately that are delivered via ASN 16276. Most of them are not recognized as spam, no matter how often I have moved these emails to the spam folder in the past.

I would like to give these emails an additional spam score of +12, in addition to the other rspamd checks.

I first tried setting this ASN in the file “…/data/conf/rspamd/custom/bad_asn.map” with a score value of 12.

#13335 5 #Cloudflare Inc., United States
#14061 4 #DigitalOcean LLC, United States
16276 12 #OVH SAS, France                                <------
#21100 2 #ITL LLC, Ukraine
#28753 5 #Leaseweb Deutschland GmbH, Germany
#29119 5 #ServiHosting Networks S.L., Spain

But then, however, these emails were completely rejected by rpsamd:
("LOCAL_BL_ASN • Sender's ASN is on the local blacklist (60) [16276])".
They received a score of 60 due to the ASN blacklist (I assume) and they also wouldn’t even appear in the quarantine list. I have no idea where 60 comes from. I thought they would get a score of 12. :-)

Could you please give me a hint? What do I have to do when I only want that these emails get an additional spam score of +12?

ETNyx

Score in map should be multiplied by score settings in multimap.conf settings, so I guess there is 5, not sure if decimals are allowed safest bet will be 2 to get score 2*5=10.

And as always please refer to docs

Yes, there is 5

Hawthorn

Thank you very much ETNyx, I’ve learned something new again! Now I know where the score of 60 comes from: 12 × 5.

Now I am wondering how I can increase the spam score based on the ASN without using this blacklist map.

The problem is the quarantine page says: “Blacklisted elements are excluded from the quarantine.”
So, blacklisted emails do not appear in quarantine at all. And this means I have no way of releasing an email later. It could be that a legitimate email comes in via this ASN.

Thus, using the blacklist is probably not what I’m looking for after all. Does anyone have any suggestions?

ETNyx

This should be, because of specific symbol is set. In your case LOCAL_BL_ASN so I would advise to make own rule using multimap module to not interfere to MC settings, using your own symbol.