webmail-client/docker/rspamd/local.d/rbl.conf

# Reputation lookups — OPT-IN, and narrowed to three sources (SPEC §C.2).
#
# The module is enabled, but almost every stock list is turned off. What survives
# is deliberate:
#
#   spamhaus     zen.spamhaus.org  — the sending server's IP. The most
#                                    established blocklist there is.
#   SPAMHAUS_DBL dbl.spamhaus.org  — domains found in the message's links.
#   dnswl        list.dnswl.org    — an ALLOW-list: it can only subtract score
#                                    from known-good senders, never add it.
#
# Everything else is off for one of three reasons:
#   - it sends a fingerprint of the message body to a third party (fuzzy, hashbl)
#   - it is a commercial sender-reputation business (senderscore, mailspike)
#   - it does not resolve any more (nixspam: ix.dnsbl.manitu.net returns
#     SERVFAIL from every public resolver as of 2026-09)
#
# Note this only makes the lookups POSSIBLE. Whether they run for a given user
# is decided per-user by settings.conf, driven by the "Allow online reputation
# checks" switch in the plugin's settings page.
enabled = true;

rbls {
  # --- kept -----------------------------------------------------------------
  spamhaus { enabled = true; }
  dnswl { enabled = true; }

  # --- off: commercial reputation businesses --------------------------------
  senderscore { enabled = false; }
  mailspike { enabled = false; }

  # --- off: content fingerprints leave the building -------------------------
  SURBL_HASHBL { enabled = false; }
  RSPAMD_EMAILBL { enabled = false; }
  MSBL_EBL { enabled = false; }

  # --- off: smaller/volunteer lists we did not choose -----------------------
  sem { enabled = false; }
  semIPv6 { enabled = false; }
  virusfree { enabled = false; }
  blocklistde { enabled = false; }
  dnswl_dwl { enabled = false; }

  # --- off: dead zone --------------------------------------------------------
  nixspam { enabled = false; }

  # The URL blocklists are keyed by quoted uppercase names further down the stock
  # file, which is easy to miss — they stayed active through a first pass of this
  # config. Verify with: docker logs rspamd | grep 'added rbl rule'
  "SURBL_MULTI" { enabled = false; }
  "URIBL_MULTI" { enabled = false; }
  "RSPAMD_URIBL" { enabled = false; }
  "SEM_URIBL_UNKNOWN" { enabled = false; }
  "SEM_URIBL_FRESH15_UNKNOWN" { enabled = false; }
}