Side-use of rspamd from another mail relay/mail processed twice

maltris

Dear community,

I have been a long time user of mailcow but only now bothered registering and asking a question here. For some time I have been running a mailcow instance that is not only used as a closed stack, but side-used by another Postfix mail relay to process mails via milter protocol by the rspamd running inside the mailcow stack.

This generally works fine and improves the other mail relays spam filtering by a lot.

What I noticed is though, that mails get processed twice in rspamd. A couple seconds apart. It is always the same mail, one time from the actual “external” mail relays IP, once from 127.0.0.1 (always the second processing).

I was wondering what the technical reason behind this could be.

Best regards

ETNyx

Consider this workflow. MUA submit to your External Postfix. First spam detection in MC Rspamd. Then you wrote it’s relay server, so message is relayed for delivery to your MC Postfix. There is second spam detection in MC Rspamd and final delivery to recipient in MC.

To untangle this case, you need to analyze your configuration, follow all logs of specific message.

maltris

ETNyx Thats what I would understand. But the external Postfix is unrelated to the mailcow instance and only speaks milter protocol directly with the mailcows rspamd.

ETNyx

Ok I dig into MC git, seems that MC rspamd is using proxy upstream configuration. Based on this, we can hypothesize that what you consider to be the second scan is merely a proxy handover. Make sense whit logging as source of local IP. So if both scans are logged under same message ID I would guess that’s it. And several seconds between logs can be just time to make all work done.

maltris

ETNyx Thats the one! Thank you very much!