Antispam: make the reputation switch real, limited to Spamhaus and DNSWL

The "Allow online reputation checks" setting did nothing. It saved a value, the
plugin sent a Settings-ID header, and the engine ignored it — the profiles that
header named were never written. Three separate faults had to be fixed before
one checkbox changed one score:

  - the profiles did not exist
  - a settings block is only selectable by header if it declares an `id`
  - a local.d file holds the CONTENTS of a module block, not the block; the
    outer `settings { }` wrapper nested them a level too deep and rspamd logged
    "loaded 0 elements of settings"

Proven rather than assumed, using Spamhaus's documented dbltest.com:
  webmail_offline -> no reputation symbols
  webmail_network -> DBL_SPAM fires

Which lookups exist at all is narrowed in rbl.conf to the three chosen:
Spamhaus ZEN (sending IP), Spamhaus DBL (domains in links), DNSWL (an
allow-list, which can only subtract score). Everything else is off — commercial
sender-reputation businesses, and anything that sends a fingerprint of the
message body to a third party. NiX Spam was dropped after checking: its zone
returns SERVFAIL from every public resolver, so it could only ever have added
failing lookups.

The URL blocklists are keyed by quoted uppercase names deeper in the stock
config and survived a first pass of this work; the comment says how to verify.

Help text now names the services and says what they learn, rather than vaguely
warning about "third-party servers".

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018SqJYt7jD7oUEkoY68sBZo

docker/rspamd/local.d/rbl.conf

@@ -1,10 +1,55 @@
-# DISABLED BY DEFAULT (SPEC §C.2, acceptance 6).
-# rbl performs third-party lookups derived from message content — hashes
-# of the body, the URLs it contains, the sending IP. For a self-hosted personal
-# server that is a privacy leak the user did not ask for, so the module is off
-# and the engine makes no outbound connections at all.
+# Reputation lookups — OPT-IN, and narrowed to three sources (SPEC §C.2).
 #
-# Turning this on is an operator decision, not a per-message one: set
-# enabled = true here, restart rspamd, and only then does the plugin's
-# network_checks setting have anything to enable.
-enabled = false;
+# The module is enabled, but almost every stock list is turned off. What survives
+# is deliberate:
+#
+#   spamhaus     zen.spamhaus.org  — the sending server's IP. The most
+#                                    established blocklist there is.
+#   SPAMHAUS_DBL dbl.spamhaus.org  — domains found in the message's links.
+#   dnswl        list.dnswl.org    — an ALLOW-list: it can only subtract score
+#                                    from known-good senders, never add it.
+#
+# Everything else is off for one of three reasons:
+#   - it sends a fingerprint of the message body to a third party (fuzzy, hashbl)
+#   - it is a commercial sender-reputation business (senderscore, mailspike)
+#   - it does not resolve any more (nixspam: ix.dnsbl.manitu.net returns
+#     SERVFAIL from every public resolver as of 2026-09)
+#
+# Note this only makes the lookups POSSIBLE. Whether they run for a given user
+# is decided per-user by settings.conf, driven by the "Allow online reputation
+# checks" switch in the plugin's settings page.
+enabled = true;
+
+rbls {
+  # --- kept -----------------------------------------------------------------
+  spamhaus { enabled = true; }
+  dnswl { enabled = true; }
+
+  # --- off: commercial reputation businesses --------------------------------
+  senderscore { enabled = false; }
+  mailspike { enabled = false; }
+
+  # --- off: content fingerprints leave the building -------------------------
+  SURBL_HASHBL { enabled = false; }
+  RSPAMD_EMAILBL { enabled = false; }
+  MSBL_EBL { enabled = false; }
+
+  # --- off: smaller/volunteer lists we did not choose -----------------------
+  sem { enabled = false; }
+  semIPv6 { enabled = false; }
+  virusfree { enabled = false; }
+  blocklistde { enabled = false; }
+  dnswl_dwl { enabled = false; }
+
+  # --- off: dead zone --------------------------------------------------------
+  nixspam { enabled = false; }
+
+  # The URL blocklists are keyed by quoted uppercase names further down the stock
+  # file, which is easy to miss — they stayed active through a first pass of this
+  # config. Verify with: docker logs rspamd | grep 'added rbl rule'
+  "SURBL_MULTI" { enabled = false; }
+  "URIBL_MULTI" { enabled = false; }
+  "RSPAMD_URIBL" { enabled = false; }
+  "SEM_URIBL_UNKNOWN" { enabled = false; }
+  "SEM_URIBL_FRESH15_UNKNOWN" { enabled = false; }
+}