webmail-client/docker/rspamd/local.d/settings.conf

# Per-user reputation lookups (SPEC §C.2).
#
# The plugin sends a Settings-ID header on every scan, chosen from the user's
# "Allow online reputation checks" switch. These are the two profiles it names.
#
# NOTE the shape: a local.d file contains the CONTENTS of the module's block, not
# the block itself. Wrapping these in `settings { ... }` nests them one level too
# deep and rspamd loads zero profiles while logging "unknown settings id" — which
# is exactly how this setting managed to look wired up while doing nothing.
#
# `id` is what makes a profile selectable by header at all; without it a settings
# block is matched by sender/IP conditions instead and the header is ignored.

# Default: no outbound lookups of any kind.
webmail_offline {
  id = "webmail_offline";
  priority = high;
  apply {
    # Both groups: Spamhaus ZEN and DNSWL score under "rbl", but the domain
    # blocklist (DBL) scores under "surbl". Disabling only "rbl" leaves DBL
    # querying Spamhaus about every link in every message.
    groups_disabled = ["rbl", "surbl"];
  }
}

# Opted in: Spamhaus ZEN + DBL and DNSWL, as narrowed in rbl.conf — on top of
# everything else. Nothing to switch on (those modules are enabled globally;
# only the offline profile turns them off), so this profile changes nothing.
# NOT `groups_enabled`: that means "ONLY these groups", and it left a user who
# allowed online checks with the reputation lookups alone — no Bayes, no content
# rules, every lesson they taught ignored.
webmail_network {
  id = "webmail_network";
  priority = high;
  apply {
    groups_disabled = [];
  }
}