Before playing with any configs or FW rules, **FYI** - please read this: https://docs.rspamd.com/blog/2025/10/18/incident-disclosure/ "⚠️ Service Disruption Notice - Public fuzzy service temporarily suspended, expected back in ~1 week thanks to community support. Read full disclosure" "On Saturday, October 18th, 2025, the public Rspamd DNSBL RBL feed and what's more important public fuzzy service was disrupted due to an unexpected server block by our hosting provider, Hetzner." ...

To get this right: what exactly is expected? - is it (only) me who is rspamd's fuzzy server running not in the local rspamd container? Is it by design? - Or - just the error? If the error is expected, IMVHO it should be supressed. Flooding the log with expected errors is not really nice...

Incident Disclosure - Rspamd Public Service Temporary Suspension

stefan21

Before playing with any configs or FW rules,

FYI - please read this: https://docs.rspamd.com/blog/2025/10/18/incident-disclosure/

“⚠️ Service Disruption Notice - Public fuzzy service temporarily suspended, expected back in ₁ week thanks to community support. Read full disclosure”

“On Saturday, October 18th, 2025, the public Rspamd DNSBL RBL feed and what’s more important public fuzzy service was disrupted due to an unexpected server block by our hosting provider, Hetzner.”
…

pkernstock

FWIW - Vsevolod configured his fuzzy to return back 127.0.0.1 for fast-failing to prevent email delivery for being delayed too much due to I/O timeout.

stefan21

Yes - could be the cause of:

got error on IO with server fuzzy1.rspamd.com:11335(127.0.0.1:11335), on read, 111, Connection refused

Why this? Can’t see an error for this query in my OPNsense firewall.
Where to investigate?

pkernstock

The error is because you don’t have rspamd’s fuzzy server running within the local rspamd container. It is expected.

stefan21

To get this right: what exactly is expected?

is it (only) me who is rspamd’s fuzzy server running not in the local rspamd container? Is it by design?
Or - just the error?

If the error is expected, IMVHO it should be supressed. Flooding the log with expected errors is not really nice…

pkernstock

The rspamd fuzzy server is running on rspamd’s servers at fuzzy.rspamd.com, which you posted is currently expectedly down. As I wrote above, its DNS was changed to 127.0.0.1, to fast-fail requests and not to delay email processing in rspamd longer than needed. So failures are expected.

stefan21

Thank’s for clarification.

Flooding logs is not quite elegant…