lukasandClaude Opus 5
76beb9d527
The "Allow online reputation checks" setting did nothing. It saved a value, the
plugin sent a Settings-ID header, and the engine ignored it — the profiles that
header named were never written. Three separate faults had to be fixed before
one checkbox changed one score:
- the profiles did not exist
- a settings block is only selectable by header if it declares an `id`
- a local.d file holds the CONTENTS of a module block, not the block; the
outer `settings { }` wrapper nested them a level too deep and rspamd logged
"loaded 0 elements of settings"
Proven rather than assumed, using Spamhaus's documented dbltest.com:
webmail_offline -> no reputation symbols
webmail_network -> DBL_SPAM fires
Which lookups exist at all is narrowed in rbl.conf to the three chosen:
Spamhaus ZEN (sending IP), Spamhaus DBL (domains in links), DNSWL (an
allow-list, which can only subtract score). Everything else is off — commercial
sender-reputation businesses, and anything that sends a fingerprint of the
message body to a third party. NiX Spam was dropped after checking: its zone
returns SERVFAIL from every public resolver, so it could only ever have added
failing lookups.
The URL blocklists are keyed by quoted uppercase names deeper in the stock
config and survived a first pass of this work; the comment says how to verify.
Help text now names the services and says what they learn, rather than vaguely
warning about "third-party servers".
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018SqJYt7jD7oUEkoY68sBZo
34 lines
1.2 KiB
Plaintext
34 lines
1.2 KiB
Plaintext
# Per-user reputation lookups (SPEC §C.2).
|
|
#
|
|
# The plugin sends a Settings-ID header on every scan, chosen from the user's
|
|
# "Allow online reputation checks" switch. These are the two profiles it names.
|
|
#
|
|
# NOTE the shape: a local.d file contains the CONTENTS of the module's block, not
|
|
# the block itself. Wrapping these in `settings { ... }` nests them one level too
|
|
# deep and rspamd loads zero profiles while logging "unknown settings id" — which
|
|
# is exactly how this setting managed to look wired up while doing nothing.
|
|
#
|
|
# `id` is what makes a profile selectable by header at all; without it a settings
|
|
# block is matched by sender/IP conditions instead and the header is ignored.
|
|
|
|
# Default: no outbound lookups of any kind.
|
|
webmail_offline {
|
|
id = "webmail_offline";
|
|
priority = high;
|
|
apply {
|
|
# Both groups: Spamhaus ZEN and DNSWL score under "rbl", but the domain
|
|
# blocklist (DBL) scores under "surbl". Disabling only "rbl" leaves DBL
|
|
# querying Spamhaus about every link in every message.
|
|
groups_disabled = ["rbl", "surbl"];
|
|
}
|
|
}
|
|
|
|
# Opted in: Spamhaus ZEN + DBL and DNSWL, as narrowed in rbl.conf.
|
|
webmail_network {
|
|
id = "webmail_network";
|
|
priority = high;
|
|
apply {
|
|
groups_enabled = ["rbl", "surbl"];
|
|
}
|
|
}
|