Is this incoming message actually spam, and what should happen to it?

scores the message against regex, statistical (Bayes), and external-service rules and hands back a verdict the mail server can act on — reject, tag, or modify — along with any suggested modifications like a spam header

Which sender domains are lying about who they are?

checks DKIM signatures and DMARC alignment against the message, reporting authentication failures the mail server can act on

Why did a particular message get flagged or let through?

breaks the verdict down into the individual rules and their weights that fired on that message, so the score can be traced back to a cause

Is a linked-to destination actually where it claims to lead?

resolves redirect chains before scoring, following intermediate hops rather than judging the outward-facing link alone

Are these two spam runs actually the same campaign reworded?

compares fuzzy hashes and, for HTML mail, reuse of the same template even when the embedded links differ, flagging matches under a phishing-template symbol

Is a scan hanging because of a slow rule or a slow worker?

reports which async events and symbols are still pending when a scan exceeds its time budget, pointing at the stalled component instead of just the timeout

Rspamd release history — The Cyber Toolchain

docs update Oct 22, 2026 · issue 116

Rspamd patch release adds ARC trust fixes, browser-accurate HTML parsing, merged RBL queries, and force_actions priorities.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Introduces browser-accurate HTML parsing for more faithful rendering fidelity in spam analysis.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds merged RBL queries to consolidate DNS-based blocklist lookups.
Adds priority support for force_actions to control action precedence.

Introduces browser-accurate HTML parsing for more faithful rendering fidelity in spam analysis.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

2 more in Everything

docs update Oct 22, 2026 · issue 116

New detection Cryptocurrency wallet address detection

docs update Oct 22, 2026 · issue 116

Rspamd 4.2.3 adds RBL check merging, fixes force_actions composite ordering, and upgrades Lua pre-result APIs⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ USE IT

Opt a specific RBL rule out of check merging so it retains per-check symbol insertions and the old scoring behaviour.

/etc/rspamd/local.d/rbl.conf

rbls {
  my_rbl {
    merge_checks = false;
  }
}

Identify which RBL rules have multiple checks before upgrading, to assess scoring impact from the new merge behaviour.

$ rspamadm configdump rbl | grep -A5 'checks'

Adds default_merge_checks = true to RBL config, deduplicating DNS queries when multiple checks resolve the same name and merging their labels into one comma-separated option (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ example.com:dkim,url).
Adds per-rule merge_checks = false override in local.d/rbl.conf to restore one symbol insertion per check for specific RBL rules.
Adds priority setting to force_actions rules, accepting low, normal, high, and critical values to control which rule wins when multiple rules match.
Upgrades table-form task:set_pre_result({...}) to default to normal priority (instead of low) and to apply all combined flags such as flags = 'least,no_smtp_message' rather than only the first.

Adds default_merge_checks = true to RBL config, deduplicating DNS queries when multiple checks resolve the same name and merging their labels into one comma-separated option (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ example.com:dkim,url).
Adds per-rule merge_checks = false override in local.d/rbl.conf to restore one symbol insertion per check for specific RBL rules.
Adds priority setting to force_actions rules, accepting low, normal, high, and critical values to control which rule wins when multiple rules match.

1 more in Everything

└──▷ BREAKING ON UPGRADE

!default_merge_checks = true is now the default in RBL config: custom RBL rules with multiple checks whose symbols are not one_shot (e.g. checks = ["from", "received"]) will score lower when more than one check matches the same IP or domain.
!RBL symbol options now emit comma-separated labels in a single option (e.g. example.com:dkim,url) instead of separate options per check — any log parsers, dashboards, or Lua code reading task:get_symbol() option strings must be updated to split on commas.
!require_symbols rules that previously never ran will now execute and insert symbols whenever all listed symbols are present.
!return_codes/return_bits Lua patterns that were previously compared literally (and never matched) are now matched as patterns.
!dkim_match_from with dkim_domainonly = false now requires an exact full d= match against the From domain (querying the full d=), reversing the previous eSLD comparison behaviour; dkim_domainonly = true now matches any d= sharing the same eSLD.
!Table-form task:set_pre_result({...}) now defaults to normal priority instead of low — callers that relied on low priority must explicitly add priority = 0.
!task:has_pre_result() now returns the custom action's own name as its second value instead of the string custom — code comparing against custom must be updated.

4.2.3 Oct 21, 2026 · issue 116

Rspamd 4.2.3 adds priority-ranked force_actions postfilters, unix_time metadata export, and a richer Lua task API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ GET THIS VERSION

$ git clone --branch 4.2.3 https://github.com/rspamd/rspamd.git
# already have the repo? check out this version:
$ git checkout 4.2.3

└──▷ USE IT

Preserve per-check RBL symbol scoring after upgrading, when your composite rules depend on seeing one insertion per matched RBL entry.

/etc/rspamd/local.d/rbl.conf

rbl {
  # ... existing RBL config ...
  merge_checks = false;
}

Include unix timestamps in exported message metadata for easier downstream log correlation.

/etc/rspamd/local.d/metadata_exporter.conf

metadata_exporter {
  # ... existing exporter config ...
  general {
    unix_time = true;
  }
}

Adds priority setting to force_actions rules that depend on composites, promoting them to postfilters and exposing the rank as a priority:N symbol option.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds merge_checks = false config key to RBL to retain one symbol insertion per check instead of merging duplicate DNS queries into a single result.
Adds unix_time field to general metadata in metadata_exporter.
task:has_pre_result() in the Lua API now returns the action name (instead of its type) plus its flags.

Adds priority setting to force_actions rules that depend on composites, promoting them to postfilters and exposing the rank as a priority:N symbol option.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

3 more in Everything

└──▷ BREAKING ON UPGRADE

!phishtank.rspamd.com is now disabled by default; setups relying on Phishtank lookups will silently lose that check unless re-enabled.
!RBL duplicate DNS queries are now merged into a single symbol insertion, so a rule scores only once per matched value instead of once per check. Set merge_checks = false to restore the previous per-check scoring behaviour.
!RBL: the dkim_domainonly flag under dkim_match_from was inverted; eSLDs were compared when dkim_domainonly was off. The logic is now corrected, which may change which DKIM-domain RBL matches fire.

docs update Oct 11, 2026 · issue 102

New supported platform Ubuntu Resolute (26.04) packages
Retired supported platform Debian bullseye and Ubuntu focal (20.04) packages discontinued

└──▷ BREAKING ON UPGRADE

!Debian bullseye and Ubuntu focal (20.04) no longer receive new packages; the last version published for bullseye is 4.1.5, and focal has been removed from the repository.

docs update Oct 11, 2026 · issue 102

Rspamd 4.2.2 adds multi-currency crypto-wallet detection and fixes metadata_exporter schema validation, known_senders TTL enforcement, and milter_headers scoping.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Inspect part digests as computed by 4.2.2 before re-learning fuzzy samples, to confirm hashes have changed after the MIME boundary fix.

$ rspamadm mime stat -F /path/to/message.eml

Prevent known_senders entries from ever expiring after upgrading, preserving the pre-4.2.2 behaviour where senders are kept indefinitely.

local.d/known_senders.conf

max_ttl = 0;

Restore x-spamd-bar for local and authenticated mail after milter_headers begins honouring skip_local/skip_authenticated for that header.

local.d/milter_headers.conf

local_headers = ["x-spamd-bar"];
authenticated_headers = ["x-spamd-bar"];

Replaces rules/bitcoin.lua with rules/crypto.lua, adding new detection symbols CRYPTO_ADDR_CHECK, LITECOIN_ADDR, DOGECOIN_ADDR, TRON_ADDR, XRP_ADDR, ZCASH_ADDR, CARDANO_ADDR, COSMOS_ADDR, STELLAR_ADDR, TON_ADDR (checksum-verified), plus format-only symbols ETHEREUM_ADDR_MAYBE and MONERO_ADDR_MAYBE; LEAKED_PASSWORD_SCAM (score 7.0) now fires for every checksum-verifiable currency, not Bitcoin only.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds schema validation on load in metadata_exporter for the built-in backends (http, send_mail, redis_pubsub, redis_stream, redis_list, json_raw_tcp): rules with unknown keys or wrong-typed values are now disabled rather than silently accepted; the module is disabled if no valid rule remains.
Activates reply_sender_privacy, reply_sender_privacy_alg, reply_sender_privacy_prefix, and reply_sender_privacy_length in both the replies and known_senders modules, which previously read these options under the wrong config prefix and ignored them.
Scopes x-spamd-bar in milter_headers to skip_local and skip_authenticated; to keep the header for local or authenticated mail, add local_headers = ["x-spamd-bar"]; / authenticated_headers = ["x-spamd-bar"]; to the milter_headers config.
Changes MIME part and message digests for all non-base64-encoded parts in multipart messages (RFC 2046 boundary handling); rspamadm mime stat -F /path/to/message.eml now prints part digests as computed by 4.2.2.

Replaces rules/bitcoin.lua with rules/crypto.lua, adding new detection symbols CRYPTO_ADDR_CHECK, LITECOIN_ADDR, DOGECOIN_ADDR, TRON_ADDR, XRP_ADDR, ZCASH_ADDR, CARDANO_ADDR, COSMOS_ADDR, STELLAR_ADDR, TON_ADDR (checksum-verified), plus format-only symbols ETHEREUM_ADDR_MAYBE and MONERO_ADDR_MAYBE; LEAKED_PASSWORD_SCAM (score 7.0) now fires for every checksum-verifiable currency, not Bitcoin only.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

4 more in Everything

└──▷ BREAKING ON UPGRADE

!rules/bitcoin.lua has been removed; any custom Lua configuration that loads it directly (e.g. a modified rules/rspamd.lua) will fail to load — change references to rules/crypto.lua.
!metadata_exporter rules that contain unknown keys or wrong-typed values for the built-in backends (http, send_mail, redis_pubsub, redis_stream, redis_list, json_raw_tcp) are now disabled on startup instead of running with the bad key ignored; check logs for rule <name>: invalid configuration -> rule DISABLED and fix local.d/metadata_exporter.conf.
!In known_senders zset mode (use_bloom = false), the first new sender recorded after upgrading to 4.2.2 will remove every entry whose first-seen score is older than max_ttl (default 30d), causing those senders to receive UNKNOWN_SENDER instead of KNOWN_SENDER until they send again.
!If reply_sender_privacy = true was set in local.d/replies.conf or local.d/known_senders.conf, reply sets and known-sender sets written by older versions are no longer found because keys are now built from hashed addresses; INC_MAIL_KNOWN_LOCALLY and INC_MAIL_KNOWN_GLOBALLY stop matching earlier correspondents until users send new mail.
!x-spamd-bar in milter_headers is now suppressed for loopback, private-network, and authenticated-user messages (because skip_local and skip_authenticated are both true by default); Sieve rules or mail-client filters that relied on x-spamd-bar being present on those messages will stop seeing it.
!MIME part and message digests change for all non-base64-encoded parts in multipart messages; fuzzy hashes learned before the upgrade no longer match, and digest-based deduplication or joins across the upgrade boundary (e.g. in ClickHouse Digest column, Elasticsearch) will produce incorrect results.
!LEAKED_PASSWORD_SCAM (score 7.0) now fires for all checksum-verifiable currencies, not only Bitcoin; sites that tuned scores or composites assuming Bitcoin-only behaviour will see changed scoring for multi-currency scam messages.

4.2.2 Oct 10, 2026 · issue 102

Adds richer metadata_exporter templating with custom variables, multipart email alerts, schema validation, and new Lua API helpers for header folding and SMTP negotiation.

└──▷ GET THIS VERSION

$ git clone --branch 4.2.2 https://github.com/rspamd/rspamd.git
# already have the repo? check out this version:
$ git checkout 4.2.2

Adds mail_from, mail_to, helo, channel, and stream_key fields plus selector expansion and custom variables to metadata_exporter rules.
Adds email_parts to metadata_exporter to compose multipart email alerts with plain and HTML parts grouped into multipart/alternative, with automatic RFC 2047 encoding for non-ASCII headers.
Validates metadata_exporter rules against a schema so that configtest fails on an invalid rule.
Adds util.fold_header_unstructured to the Lua API for folding unstructured headers per RFC 5322.
Adds an smtp newline normalization mode to rspamd_text in the Lua API.

+3 more show less

Adds EHLO and 8BITMIME negotiation with HELO fallback to lua_smtp, downgrading 8-bit messages to 7-bit when the server does not advertise 8BITMIME.
New detectionAdds add_from_string to lua_crypto_addresses to feed text recovered from attachments into the bounded wallet-address scanner.
Adds crypto_addresses() selector extractor to expose detected wallet addresses.

8 details in Everything

└──▷ BREAKING ON UPGRADE

!The CRLF before a boundary delimiter no longer counts as part of the preceding MIME part — message digests and non-base64 part digests change for all multipart messages, so anything keyed on those values will not match values computed by versions before 4.2.2.

docs update Sep 18, 2026 · issue 078

Rspamd: Adds rspamadm configdump -e flag to dump the computed symbol execution order for the new single-scheduler dependency graph.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Inspect the new unified execution plan to verify symbol ordering and stage assignments after upgrading or adding custom rules.

$ rspamadm configdump -e

Adds count_scan section to fuzzy worker config, with tunable pass interval (default 4 hours), SCAN COUNT (default 1000), and duty cycle (default 10%), replacing the broken <prefix>_count Redis counter with a periodic SCAN-based keyspace walk.
Adds lua_content { svg { ... } } config block to control per-task budget and timeout for SVG content extraction.
Adds new R_DKIM_ALIGNED symbol (weight -0.1) to separately score DKIM signatures that are aligned with the author domain; R_DKIM_ALLOW weight reduced from -0.2 to -0.1.
Extends task:inject_part() to accept 'html' as a part type, routing injected content through the full HTML parser for URL, feature, and CTA-link extraction.
Adds XLSX and PPTX content extraction to the bounded OOXML pipeline, covering shared strings, worksheets, Excel 4.0 macrosheets, DrawingML, slide notes, and auto-executing defined names (Auto_Open).

+4 more show less

Adds bounded DOCX content extraction with the extraction core rewritten in C++ and unprocessable attachments flagged rather than silently ignored.
Adds a public suffix lookup component performing longest-suffix hostname matching against the effective TLDs file, replacing the multipattern/hyperscan path and honouring ! exception rules.
Replaces per-class symbol schedulers with a single execution plan computed at cache initialisation, visible via rspamadm configdump -d and rspamadm configdump -e; introduces suppressed and skipped item states.
Switches two-pass URL discovery in free text to a static-matcher multipattern plus dot-anchored suffix probing, eliminating the 10,500-pattern hyperscan database (previously 1.3 s to compile, 6.5 MiB serialised).

Adds count_scan section to fuzzy worker config, with tunable pass interval (default 4 hours), SCAN COUNT (default 1000), and duty cycle (default 10%), replacing the broken <prefix>_count Redis counter with a periodic SCAN-based keyspace walk.
Adds lua_content { svg { ... } } config block to control per-task budget and timeout for SVG content extraction.
Adds new R_DKIM_ALIGNED symbol (weight -0.1) to separately score DKIM signatures that are aligned with the author domain; R_DKIM_ALLOW weight reduced from -0.2 to -0.1.
Adds XLSX and PPTX content extraction to the bounded OOXML pipeline, covering shared strings, worksheets, Excel 4.0 macrosheets, DrawingML, slide notes, and auto-executing defined names (Auto_Open).
Adds a public suffix lookup component performing longest-suffix hostname matching against the effective TLDs file, replacing the multipattern/hyperscan path and honouring ! exception rules.

+1 more show less

Replaces per-class symbol schedulers with a single execution plan computed at cache initialisation, visible via rspamadm configdump -d and rspamadm configdump -e; introduces suppressed and skipped item states.

3 more in Everything

└──▷ BREAKING ON UPGRADE

!The single symbol scheduler replaces per-class schedulers; symbol dependency ordering and stage assignment change — a prefilter that previously pulled a filter into the prefilter stage now correctly executes after it, which may alter scan results on custom rule sets.
!Public suffix lookup now honours ! exception rules that were previously skipped; a host that is itself a public suffix now resolves to the whole host rather than a shorter suffix, changing URL and RBL query behaviour.
!Two-pass URL discovery replaces the hyperscan-based TLD multipattern database; URL detection results may differ from previous versions.
!The multimap top filter now returns the full public suffix (e.g. com.au) instead of only the last label (au); maps using this filter must be updated to list full suffixes before upgrading.
!RBL URL composition maps are now matched by the new rspamd_tld_lookup rule set instead of per-TLD regexp buckets; wildcard and exception handling changes as described.
!Fuzzy Redis hash counts are no longer maintained by the update script; the <prefix>_count key is no longer incremented/decremented on add/delete. Negative counters from older versions are reported as 0 until the first SCAN pass completes.
!R_DKIM_ALLOW weight changes from -0.2 to -0.1; the new R_DKIM_ALIGNED symbol carries the other -0.1. Installations that tuned R_DKIM_ALLOW must revisit both symbols together.

docs update Sep 18, 2026 · issue 078

Rspamd adds public suffix lookup, single symbol scheduler, Office/SVG content extraction, and bounded parsing of untrusted input.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Adds public suffix lookup capability for domain classification and analysis.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Introduces a single symbol scheduler for improved rule execution control.
Adds content extraction support for Office documents and SVG files.
Introduces bounded parsing of untrusted input to limit resource consumption on malicious content.

4 details in Everything

docs update Sep 18, 2026 · issue 078

Rspamd: Adds url:get_public_suffix() selector transform, the get_public_suffix selector, and the rspamd_tld_lookup Lua module for rules that need exact public-suffix semantics.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Audit multimap rules that use filter = 'top' before upgrading, to find map files that need bare multi-label labels replaced with full suffixes.

$ grep -rn 'filter *= *"top"' /etc/rspamd/local.d/ /etc/rspamd/override.d/

Verify that TLD resolution returns the correct eSLD for domains under PSL exception rules after the upgrade.

$ rspamadm lua -e 'print(require("rspamd_util").get_tld("www.city.kobe.jp"))'

Restore per-IP fuzzy storage tracking for the default key and cap it at 1024 entries after the lazy-statistics change makes it opt-in.

/etc/rspamd/local.d/worker-fuzzy.inc

max_ips_per_key = 1024;

Adds max_ips_per_key worker-level and per-key config option to restore per-source IP tracking in fuzzy storage, which is now lazy and off by default for the default key.
Adds stats_sample key inside count_scan {} to control sampled storage statistics (weights per flag, shingles, creation age buckets) published under <prefix>_stats and exposed via /fuzzystat and rspamadm fuzzystat.
Adds ucl.untrusted_parser() for use in Lua modules parsing network replies, with individually overridable caps (max_string_length, depth 64, 1 million elements, 16 MB strings).
Reworks TLD resolution to probe label suffixes against a flat hash map with full public suffix list semantics, honouring PSL ! exception rules that were previously silently skipped.
Changes filter = "top" in multimap to return the actual public suffix from the suffix list instead of only the last label of the eSLD, fixing conflation of multi-label suffixes like co.uk.

+7 more show less

Enforces RFC 7208 §4.5: domains publishing more than one v=spf1 record now return permerror instead of being evaluated on whichever record the resolver answered first.
Replaces per-class schedulers with a single execution plan computed at init, allowing prefilters to legitimately depend on filters and rejecting invalid dependency edges at configuration time.
Applies ignore_passthrough filters correctly after a pre-result so that task:set_pre_result() no longer skips the filters stage.
Upgrades ClickHouse schema to version 12, adding bloom-filter data-skipping indexes (granularity 4) on MessageId, From, MimeFrom, IP, Urls.Tld, Attachments.Digest, and Subject.
Bounds UCL parsing of untrusted input: depth 64, 1 million elements, 1 KB keys, 16 MB strings, and min(96 * inlen + 256KB, 64MB) of tree — covering checkv3, controller, and proxy body parsers.
Fuzzy storage key policy now applies source policy after decryption, so a request with a valid customer key is no longer dropped by a static or dynamic IP ban.
Per-source fuzzy statistics output gains ips_inserted and ips_overflow fields; a table whose evictions exceed eight times its cap within an hour is dropped and the key is flagged.

Adds max_ips_per_key worker-level and per-key config option to restore per-source IP tracking in fuzzy storage, which is now lazy and off by default for the default key.
Adds stats_sample key inside count_scan {} to control sampled storage statistics (weights per flag, shingles, creation age buckets) published under <prefix>_stats and exposed via /fuzzystat and rspamadm fuzzystat.
Adds ucl.untrusted_parser() for use in Lua modules parsing network replies, with individually overridable caps (max_string_length, depth 64, 1 million elements, 16 MB strings).

9 more in Everything

└──▷ BREAKING ON UPGRADE

!filter = "top" in multimap now returns the full public suffix (e.g. co.uk) instead of the last label (uk); map files listing bare multi-label labels like au, uk, br, jp must be updated to the full suffixes they intend.
!Domains publishing more than one v=spf1 record now receive permerror instead of a pass/fail; such mail also changes DMARC outcome. Audit and merge duplicate SPF records before upgrading.
!V=SPF1 now counts as an SPF record (case-insensitive match per RFC), and v=spf10 no longer counts as one.
!R_DKIM_ALLOW score changes from -0.2 to -0.1; rules or thresholds tuned around the old score must be recalibrated (add R_DKIM_ALIGNED at -0.1 to restore the original total for aligned mail).
!Invalid rspamd_config:register_dependency() edges (e.g. a connfilter or prefilter depending on a filter in the wrong stage) are now rejected at configuration time and dropped, rather than being silently accepted.
!Fuzzy hash count resets to 0 after upgrade and remains 0 until the first count_scan SCAN pass completes (up to 4 hours by default); monitoring thresholds on <prefix>_count must be re-baselined.
!Per-source fuzzy statistics are now off by default for the default key; operators relying on per-IP tracking for the default key must set max_ips_per_key and add an explicit max_ips extension in the keys file.
!UCL untrusted parsing now rejects request bodies with strings exceeding 16 MB or nesting deeper than 64 levels; checkv3, controller, and proxy requests previously accepted with such payloads are now rejected.
!Fuzzy storage IP bans no longer block clients holding a valid customer key; operators who used IP bans to cut off such clients must revoke or expire the key itself instead.
!TLD resolution now honours PSL ! exception rules and resolves a host that is itself a public suffix to the whole host; domain allowlist/blocklist entries keyed on eSLD under an exception rule may match a different key after upgrade.

4.2.0 Sep 18, 2026 · issue 078

Rspamd 4.2.0 adds SVG/OOXML content extraction, public suffix Lua API, fuzzy storage health UI, and untrusted UCL parsing limits.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ GET THIS VERSION

$ git clone --branch 4.2.0 https://github.com/rspamd/rspamd.git
# already have the repo? check out this version:
$ git checkout 4.2.0

└──▷ TRY IT

Query the live health of all configured fuzzy storages from the command line to verify reachability before a maintenance window.

$ curl -s http://localhost:11334/plugins/fuzzy/status | python3 -m json.tool

Pull sampled fuzzy storage statistics — including per-source IP counts — to audit hash-count accuracy after migrating from the old counter-based approach.

$ rspamadm fuzzystat

Cap per-key source IP tracking in the fuzzy storage to limit memory use on high-traffic deployments.

ucl

max_ips_per_key = 256;

key {
  id = "<your-key-id>";
  max_ips = 64;
}

Exposes public suffix list semantics to Lua as rspamd_tld_lookup(), url:get_public_suffix() with match flags, and the get_public_suffix selector transform, supporting wildcards, exceptions, and ICANN/private splits.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds ucl.untrusted_parser(), parser:set_limits(), and parser:get_limits() Lua API calls for bounded parsing of untrusted UCL/JSON/msgpack network input (controller and proxy bodies, checkv3 metadata).
Adds fuzzy storage health monitoring via fuzzy_check.ping_storage_all and the /plugins/fuzzy/status API endpoint, with per-server liveness marks, down badges, and an on-demand Check button in the WebUI.
Reports sampled fuzzy storage statistics from count scans (count_scan.stats_sample) in /fuzzystat and via rspamadm fuzzystat, with configurable per-source IP caps (max_ips_per_key, per-key max_ips).
Extracts SVG attachment content and smuggling indicators as new symbols: SVG_CONTENT, SVG_SCRIPT, SVG_FOREIGN_OBJECT, SVG_DATA_URI, SVG_FORM.

+10 more show less

Extracts XLSX and PPTX relationship-level facts as new symbols: OOXML_MACROS, OOXML_OLE_OBJECT, OOXML_REMOTE_TEMPLATE, OOXML_EXTERNAL_DATA.
Adds DKIM From-alignment reporting as a dedicated R_DKIM_ALIGNED symbol, decided in the DKIM module.
Adds redis_list pusher support to metadata_exporter.
Adds CSS compound selector and combinator evaluation, supporting div.mainbox, div p, div > p, h1 + p, and h1 ~ p patterns.
Adds lua_aliases mailbox identity and equivalent domain classes for comparing addresses.
Adds ClickHouse data-skipping indexes for point lookups at schema version 12.
Adds upstream pinning for lua_redis requests.
Enables HTML parts to be injected from Lua so decoded payloads pass through the regular HTML parser.
WebUI Status servers table gains three-state health, per-server details rows, load and latency columns, version and config drift indicators, a Writable badge, and an All SERVERS cluster row.
WebUI Bayes panel gains a learns balance bar and a min_learns status badge.

Exposes public suffix list semantics to Lua as rspamd_tld_lookup(), url:get_public_suffix() with match flags, and the get_public_suffix selector transform, supporting wildcards, exceptions, and ICANN/private splits.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds ucl.untrusted_parser(), parser:set_limits(), and parser:get_limits() Lua API calls for bounded parsing of untrusted UCL/JSON/msgpack network input (controller and proxy bodies, checkv3 metadata).
Adds fuzzy storage health monitoring via fuzzy_check.ping_storage_all and the /plugins/fuzzy/status API endpoint, with per-server liveness marks, down badges, and an on-demand Check button in the WebUI.
Extracts SVG attachment content and smuggling indicators as new symbols: SVG_CONTENT, SVG_SCRIPT, SVG_FOREIGN_OBJECT, SVG_DATA_URI, SVG_FORM.
Extracts XLSX and PPTX relationship-level facts as new symbols: OOXML_MACROS, OOXML_OLE_OBJECT, OOXML_REMOTE_TEMPLATE, OOXML_EXTERNAL_DATA.

+6 more show less

Adds DKIM From-alignment reporting as a dedicated R_DKIM_ALIGNED symbol, decided in the DKIM module.
Adds redis_list pusher support to metadata_exporter.
Adds CSS compound selector and combinator evaluation, supporting div.mainbox, div p, div > p, h1 + p, and h1 ~ p patterns.
Adds lua_aliases mailbox identity and equivalent domain classes for comparing addresses.
Adds upstream pinning for lua_redis requests.
Enables HTML parts to be injected from Lua so decoded payloads pass through the regular HTML parser.

4 more in Everything

└──▷ BREAKING ON UPGRADE

!Maps used with the top filter in multimap must now list full suffixes (e.g. com.au instead of au) — the old TLD table is replaced by the public suffix lookup.
!The 10.5k-pattern TLD hyperscan database is removed from the scanner; free-text URL discovery now runs two passes (static matcher plus dot-anchored suffix labels) via the public suffix list.
!RBL URL composition maps and host TLD resolution now go through the public suffix lookup; ! exception rules are honoured and a host that is itself a public suffix resolves to the whole host.
!Fuzzy Redis hash counts are now derived from a periodic SCAN instead of the counter maintained by the update script; negative counters left by older versions are reported as 0.
!R_DKIM_ALLOW weight changes from -0.2 to -0.1; alignment credit moves to the new R_DKIM_ALIGNED symbol.

docs update Aug 16, 2026 · issue 047

Rspamd 4.1.5 adds fuzzy sender facts over encrypted connections, font-aware PDF text extraction, /ToUnicode CMap support, and structured fuzzy results in Elastic.

└──▷ USE IT

Enable structured nested fuzzy match objects in Elasticsearch to get per-match rule, probability, flag, and hash fields instead of a flat list.

/etc/rspamd/local.d/elastic.conf

fuzzy_nested = true;

Explicitly opt in to file and shared-memory message inputs on TCP before the default changes to false in the next major release.

/etc/rspamd/local.d/worker-normal.inc

allow_file_and_shm_inputs = true;

Adds fuzzy_nested option to the elastic plugin to toggle nested-type per-match fuzzy result objects (replacing the flat fuzzy_hashes list with per-match objects from task:get_fuzzy_results() containing rule, symbol, found and queried hashes, type, probability, flag, and exactness), and adds message size to the schema mapping.
Adds allow_file_and_shm_inputs = true explicitly to the normal, controller, and proxy worker configurations with documentation noting it applies to TCP listeners only and must not be exposed to untrusted networks; the default becomes false in the next major release.
Introduces fuzzy sender facts: rules sharing extensions with their storage now attach a sender-facts extension to check commands over encrypted connections, carrying SPF, DKIM, and DMARC results, PTR state (including generic/dynamic hostname verdict from hfilter), bucketed recipient count, and TLS usage; FUZZY_CALLBACK gains ordering dependencies so authentication results are available when commands are built.
Adds font-aware PDF simple font text decoding to libmime, supporting the three Annex D base encodings and per-font /Differences overrides, with a builder producing a single UTF-8 buffer per page.
Adds PDF /ToUnicode CMap parsing for composite (Type0) fonts, supporting codespace ranges, bfchar, bfrange, and UTF-16BE destinations including surrogate pairs; CMap takes precedence over /Encoding.

5 details in Everything

└──▷ BREAKING ON UPGRADE

!The condition callback for the GPT plugin now returns only a boolean (plus an optional reason) instead of both a decision and request content; deployments whose condition returned request content must update it to return the boolean decision alone.
!The allow_file_and_shm_inputs default will become false in the next major release; operators relying on file or shared-memory inputs over TCP should set allow_file_and_shm_inputs = true explicitly now.

docs update Aug 16, 2026 · issue 047

Rspamd 4.1.5 adds file/SHM input gating, controller auth rate-limiting, per-key fuzzy ACL fix, and Elastic nested fuzzy schema.

└──▷ USE IT

Opt in to the future-default now to silence TCP startup warnings on workers that have no clients using file or SHM inputs.

local.d/worker-normal.inc

# local.d/worker-normal.inc
allow_file_and_shm_inputs = false;

Tune controller auth rate-limiting to allow more attempts before throttling, or disable it entirely for a trusted internal deployment.

local.d/worker-controller.inc

# local.d/worker-controller.inc
max_auth_failures = 20;
auth_failure_window = 120s;

Temporarily disable sender-facts extension sharing on a fuzzy rule whose storage cannot yet be upgraded to 4.1.5.

local.d/fuzzy_check.conf

# local.d/fuzzy_check.conf, inside the affected rule
no_share = true;

Adds allow_file_and_shm_inputs boolean to normal, controller, and proxy workers in local.d/worker-normal.inc / local.d/worker-controller.inc / local.d/worker-proxy.inc to gate TCP access to File, Path, and Shm message inputs; unix-socket connections always retain the capability.
Adds max_auth_failures and auth_failure_window to local.d/worker-controller.inc to rate-limit failed controller password attempts per source (default: 10 failures in 60 s triggers HTTP 429; set max_auth_failures = 0 to disable).
Adds max_connections and max_connections_per_source limits to the controller and proxy workers.
Adds fuzzy_nested option to local.d/elastic.conf that switches the fuzzy results field to the Elasticsearch nested type, with per-match objects carrying symbol, found, queried, prob, flag, and exact; also adds an explicit mapping for message size.
Adds no_share = true per-rule flag in local.d/fuzzy_check.conf to disable sender-facts extension sharing on specific fuzzy rules; scanners now attach a new sender-facts extension to fuzzy commands on encrypted rules without no_share = true.

+3 more show less

Changes the gpt module's condition callback signature in local.d/gpt.conf to return only a boolean verdict plus an optional reason string, with request content now generated internally by the module.
The scanner's max_tasks counter now includes accepted TCP connections still transmitting their body, enabling earlier backpressure on saturated scanners.
url:get_urls_filtered() called without an include list (used by rspamadm mime urls and the URI_COUNT_ODD rule) no longer drops flag-less URLs such as those extracted from HTML parts, correcting the parity check for multipart/alternative messages.

8 details in Everything

└──▷ BREAKING ON UPGRADE

!Fuzzy storage nodes older than 4.1.5 cannot skip the new sender-facts extension type and will reject the entire fuzzy command, returning no reply to scanners — upgrade all fuzzy storage nodes to 4.1.5 before upgrading scanners, or set no_share = true on affected rules in local.d/fuzzy_check.conf.
!Per-key forbidden_ids ACLs in fuzzy storage no longer additively merge with the worker-level forbidden_ids option — keys that previously relied on the global list to suppress additional flags must have those flag IDs added explicitly to their own forbidden_ids list.
!encrypted_only = true in local.d/worker-fuzzy.inc no longer exempts peers with local or link-local source addresses — all clients, including those on localhost, must now use encryption (encryption_key in their fuzzy_check rule) or encrypted_only must be removed.
!The proxy now strips client-supplied Shm* headers and File, Path, Shm query arguments — scanning local files through the proxy no longer works; such clients must connect directly to a scanner listener.
!The allow_file_and_shm_inputs option defaults to true in 4.1.5 (with a startup warning on every TCP listener), but will default to false in the next major release — TCP clients supplying file paths or shared-memory inputs must migrate to a unix socket before that release.
!The gpt module's condition callback in local.d/gpt.conf must now return only a boolean and an optional reason string — callbacks that also return content will have that content silently ignored.
!The Elastic module's flat fuzzy field is replaced by structured per-match objects; saved searches, dashboards, and ingest pipelines referencing the old flat field must be updated, and indices created after the upgrade use the new mapping shape while pre-upgrade indices retain the old one.
!HFILTER_HELO_IP_A and URI_COUNT_ODD now fire in cases where they previously did not — local score overrides and composites involving these symbols may produce different scores after upgrade.

4.1.5 Aug 15, 2026 · issue 047

Rspamd 4.1.5 adds sender-fact sharing over fuzzy encrypted rules, font-aware PDF text extraction, and richer Elastic schema.

└──▷ GET THIS VERSION

$ git clone --branch 4.1.5 https://github.com/rspamd/rspamd.git
# already have the repo? check out this version:
$ git checkout 4.1.5

Adds sender facts (SPF, DKIM, DMARC, PTR state, recipient bucket, TLS) sharing with fuzzy storages over encrypted rules.
Adds font-aware PDF text extraction: decodes simple font text via the font's /Encoding (Annex D base encodings and /Differences overrides) and parses /ToUnicode CMaps to decode composite (Type0) fonts.
Extends the Elastic schema with structured fuzzy match results and message size.

3 details in Everything

└──▷ BREAKING ON UPGRADE

!GPT: The condition callback now returns only a boolean; request content generation has been moved into gpt_check.
!Workers: allow_file_and_shm_inputs now ships as an explicit true default for the normal, controller, and proxy workers — the default will become false in the next major release.

docs update Jul 29, 2026 · issue 029

Rspamd 4.1.4 tightens controller auth, extends regexp size limits to named scopes, and expands WebUI read-only access.

└──▷ TRY IT

Regenerate a controller password hash and update config before upgrading to avoid being locked out by the new strict hash validation.

$ rspamadm pw

Raise the regexp input size limit so multimap regexp_rules and Lua plugin scopes can match content larger than the new 1 MiB default.

yaml

regexp {
  max_size = 5242880; # 5 MiB; the default is 1 MiB
}

Controller worker now validates complete password hashes (salt and key lengths) at startup and rejects all auth attempts on malformed hashes, logging the issue explicitly.
The regexp.max_size limit (1 MiB default) now applies to named regexp scopes including multimap regexp_rules and Lua plugin scopes, not only the default scope; raising the limit now updates all registered scopes.
Introduces a message-wide word budget (100k words / 1 MiB of text) in the UTF tokenizer, with truncated parts flagged and logged, aligning UTF tokenizer behaviour with the raw tokenizer.
Read-only WebUI password now grants access to the Errors history tab (/errors) and the Selectors tab endpoints (list_extractors, list_transforms, check_selector); check_message remains privileged-only.

4 details in Everything

└──▷ BREAKING ON UPGRADE

!Malformed controller password hashes (e.g. truncated $1$ missing salt or key) that previously allowed all logins will now lock out all authentication after upgrade — regenerate hashes with rspamadm pw before upgrading.
!Named regexp scopes (multimap regexp_rules, Lua plugin scopes) now silently stop matching content beyond regexp.max_size (1 MiB by default); raise max_size in the regexp config section if larger inputs must be matched.
!Fuzzy hashes and Bayes token sets learned from very large UTF text parts before 4.1.4 may stop matching or change after upgrade due to the new word budget and dropped decayed words; re-learn affected patterns post-upgrade.
!The read-only WebUI password now exposes /errors, list_extractors, list_transforms, and check_selector endpoints with no option to restore previous gating — audit and rotate the read-only password if needed.
!Building from source with -DENABLE_JEMALLOC=ON now fails at CMake configure time when only a static libjemalloc_pic.a is available (without -DENABLE_STATIC=ON); install libjemalloc-dev / jemalloc-devel before building.

4.1.4 Jul 29, 2026 · issue 029

Rspamd 4.1.4 grants read-only WebUI users access to the Selectors tab and Errors history.

└──▷ GET THIS VERSION

$ git clone --branch 4.1.4 https://github.com/rspamd/rspamd.git
# already have the repo? check out this version:
$ git checkout 4.1.4

└──▷ BREAKING ON UPGRADE

!Rspamd now refuses to link against a static-only jemalloc; builds configured with a static-only jemalloc will fail to start.

docs update Jul 26, 2026 · issue 026

Rspamd 4.1.3 adds fuzzy hash diagnostics API, ClickHouse export, ARF enrichment, SSRF protection for lua_http, and a jQuery-free WebUI.

└──▷ TRY IT

Diagnose whether a specific fuzzy hash still has a live shingle anchor across all fuzzy workers — key for false-positive triage.

$ rspamadm control fuzzyhash <128-hex-digest>

Compute a message's fuzzy hashes per configured rule and verify them against storage, showing probability, flag, and confirmed digest.

$ rspamadm fuzzy_hash -C /path/to/message.eml

Block SSRF probes from attacker-controlled redirect targets in url_redirector while still allowing a trusted internal redirector host.

ini

url_redirector {
  # Allow a specific internal redirector; block all other RFC1918/loopback targets
  forbid_local = false;  # set per operator need; default is true
}

Adds structured fuzzy match results and a diagnostics API: every fuzzy match now produces a structured record (rule, symbol, upstream, digests, match type, probability, score, flag, timestamp) accessible via task:get_fuzzy_results() in Lua; a new fuzzy_check.check() Lua API queries a storage with task-generated or explicit hex digests.
Adds rspamadm fuzzy_hash command to compute a message's fuzzy hashes per configured rule, optionally check them against storage (-C), and query storages for explicit hex digests (-H).
Adds rspamadm control fuzzyhash <128-hex-digest> per-hash storage introspection across all fuzzy workers, reporting flag slots, values, creation time, TTL, and shingle slot ownership.
Adds configurable fuzzy probability weight curve via prob_bias and prob_power per-rule settings, replacing the fixed sqrt(prob) multiplier with a threshold-anchored curve.
Adds persistent shingle sets in the Redis fuzzy backend (S field on every ADD), enabling correct digest-only deletions and shingle-anchor refresh.

+7 more show less

Adds unkeyed client statistics: traffic from clients without a key is now tracked under a unkeyed pseudo-key with per-IP and aggregate counters.
Adds ClickHouse fuzzy match export: new Fuzzy.Hash, Fuzzy.Queried, Fuzzy.Rule, Fuzzy.Prob, and Fuzzy.Flag nested columns (schema version 11) populated from structured fuzzy results.
Adds annotated X-Rspamd-Fuzzy milter header built from structured fuzzy results, including rule, flag, probability, queried hash, and storage timestamp per match.
Adds forbid_local option to rspamd_http.request() to block SSRF via loopback, link-local, and RFC1918 destinations; enabled by default in url_redirector.
Adds ARF report enrichment in lua_feedback_parsers: recovers Source-IP, Arrival-Date, Original-Mail-From, and Original-Rcpt-To from the embedded original message headers for Microsoft JMRP feedback loops.
WebUI is rewritten to remove jQuery entirely, replacing it with native DOM and XMLHttpRequest.
Replaces Font Awesome SVG-with-JS (~900 KB) with a local 35-glyph SVG sprite.

12 details in Everything

└──▷ BREAKING ON UPGRADE

!The WebUI drops jQuery entirely and deletes the vendored jQuery build; any local customizations or extensions depending on jQuery or the $.fn API will break.
!The modalDialog backdrop attribute is renamed from its previous name to data-bs-backdrop (Bootstrap 5 native); custom WebUI code referencing the old attribute will lose the static-backdrop behaviour.
!Font Awesome SVG-with-JS is removed in favour of a local SVG sprite; any custom markup or extensions referencing Font Awesome JS APIs or its CSS classes outside the automated <i class="fas fa-name"> replacement sweep will stop rendering icons.
!The old zero-anchored fuzzy probability weight curve (sqrt(prob)) is not preserved; deployments relying on the previous scoring behaviour for non-exact fuzzy matches will see different scores after upgrade.
!HAVE_ED25519 no longer gates libsodium Ed25519 code in the DKIM path; builds that previously worked around missing OpenSSL Ed25519 support via compile-time flags may need configuration review.

docs update Jul 26, 2026 · docs issue 004

Rspamd 4.1.3 adds fuzzy hash diagnostics API, ClickHouse export, ARF enrichment, SSRF protection for lua_http, and a jQuery-free WebUI.

└──▷ TRY IT

Diagnose whether a specific fuzzy hash still has a live shingle anchor across all fuzzy workers — key for false-positive triage.

$ rspamadm control fuzzyhash <128-hex-digest>

Compute a message's fuzzy hashes per configured rule and verify them against storage, showing probability, flag, and confirmed digest.

$ rspamadm fuzzy_hash -C /path/to/message.eml

Block SSRF probes from attacker-controlled redirect targets in url_redirector while still allowing a trusted internal redirector host.

ini

url_redirector {
  # Allow a specific internal redirector; block all other RFC1918/loopback targets
  forbid_local = false;  # set per operator need; default is true
}

Adds structured fuzzy match results and a diagnostics API: every fuzzy match now produces a structured record (rule, symbol, upstream, digests, match type, probability, score, flag, timestamp) accessible via task:get_fuzzy_results() in Lua; a new fuzzy_check.check() Lua API queries a storage with task-generated or explicit hex digests.
Adds rspamadm fuzzy_hash command to compute a message's fuzzy hashes per configured rule, optionally check them against storage (-C), and query storages for explicit hex digests (-H).
Adds rspamadm control fuzzyhash <128-hex-digest> per-hash storage introspection across all fuzzy workers, reporting flag slots, values, creation time, TTL, and shingle slot ownership.
Adds configurable fuzzy probability weight curve via prob_bias and prob_power per-rule settings, replacing the fixed sqrt(prob) multiplier with a threshold-anchored curve.
Adds persistent shingle sets in the Redis fuzzy backend (S field on every ADD), enabling correct digest-only deletions and shingle-anchor refresh.

+7 more show less

Adds unkeyed client statistics: traffic from clients without a key is now tracked under a unkeyed pseudo-key with per-IP and aggregate counters.
Adds ClickHouse fuzzy match export: new Fuzzy.Hash, Fuzzy.Queried, Fuzzy.Rule, Fuzzy.Prob, and Fuzzy.Flag nested columns (schema version 11) populated from structured fuzzy results.
Adds annotated X-Rspamd-Fuzzy milter header built from structured fuzzy results, including rule, flag, probability, queried hash, and storage timestamp per match.
Adds forbid_local option to rspamd_http.request() to block SSRF via loopback, link-local, and RFC1918 destinations; enabled by default in url_redirector.
Adds ARF report enrichment in lua_feedback_parsers: recovers Source-IP, Arrival-Date, Original-Mail-From, and Original-Rcpt-To from the embedded original message headers for Microsoft JMRP feedback loops.
WebUI is rewritten to remove jQuery entirely, replacing it with native DOM and XMLHttpRequest.
Replaces Font Awesome SVG-with-JS (~900 KB) with a local 35-glyph SVG sprite.

12 details in Everything

└──▷ BREAKING ON UPGRADE

!The WebUI drops jQuery entirely and deletes the vendored jQuery build; any local customizations or extensions depending on jQuery or the $.fn API will break.
!The modalDialog backdrop attribute is renamed from its previous name to data-bs-backdrop (Bootstrap 5 native); custom WebUI code referencing the old attribute will lose the static-backdrop behaviour.
!Font Awesome SVG-with-JS is removed in favour of a local SVG sprite; any custom markup or extensions referencing Font Awesome JS APIs or its CSS classes outside the automated <i class="fas fa-name"> replacement sweep will stop rendering icons.
!The old zero-anchored fuzzy probability weight curve (sqrt(prob)) is not preserved; deployments relying on the previous scoring behaviour for non-exact fuzzy matches will see different scores after upgrade.
!HAVE_ED25519 no longer gates libsodium Ed25519 code in the DKIM path; builds that previously worked around missing OpenSSL Ed25519 support via compile-time flags may need configuration review.

4.1.3 Jul 25, 2026 · issue 026

Rspamd 4.1.3 adds fuzzy diagnostics API, ClickHouse fuzzy exports, per-hash introspection, and a local-network request block for lua_http.

└──▷ GET THIS VERSION

$ git clone --branch 4.1.3 https://github.com/rspamd/rspamd.git
# already have the repo? check out this version:
$ git checkout 4.1.3

└──▷ TRY IT

Inspect a specific fuzzy hash entry in storage to validate hits or debug false positives.

$ rspamadm control fuzzyhash <hash>

Retrieve structured fuzzy match results in a Lua rule to act on probability scores or matched rules.

lua

local results = task:get_fuzzy_results()
for _, r in ipairs(results) do
  rspamd_logger.infox(task, 'fuzzy match: rule=%s prob=%s', r.rule, r.probability)
end

Block lua_http from making outbound requests to internal/local network addresses in a custom redirector or plugin.

lua

# In rspamd lua_http call options:
local ret, code, body = rspamd_http.request({
  url = url,
  task = task,
  forbid_local = true,
})

Adds structured fuzzy match results via a diagnostics API and the new task:get_fuzzy_results() Lua method, with a configurable probability weight curve (prob_bias, prob_power) anchored at the match threshold.
Exports fuzzy match details to ClickHouse (schema version 11) and annotates the X-Rspamd-Fuzzy milter header with rule, flag, probability, and timestamp.
Adds forbid_local option to lua_http to block requests to local networks (enabled by default in url_redirector).
Enriches sparse ARF reports in lua_feedback_parsers with headers from the original message.

4 details in Everything

└──▷ BREAKING ON UPGRADE

!WebUI: jQuery has been removed entirely; all modules now use native DOM and XMLHttpRequest. Font Awesome is replaced by a local SVG sprite — any customizations or plugins depending on jQuery or Font Awesome in the WebUI will break.
!DKIM: HAVE_ED25519 is now scoped to OpenSSL key parsing only, changing ed25519 verification behavior on OpenSSL builds.

docs update Jul 22, 2026 · issue 022

Rspamd 4.1.2 adds composite Lua conditions, static_embed neural provider, neural training freeze, external rspamadm command discovery, and WebUI Tabulator migration.

└──▷ USE IT

Gate a composite atom on a Lua condition so it only fires when a postfilter symbol has a score above a threshold, without adding that symbol to the expression.

lua

rspamd_config:add_composite('MY_COMPOSITE', {
  expression = 'SYMBOL_A & SYMBOL_B',
  depends_on = {'POSTFILTER_SYMBOL'},
  conditions = {
    POSTFILTER_SYMBOL = function(task, symbol)
      local s = task:get_symbol('POSTFILTER_SYMBOL')
      return s and s[1].score > 5
    end
  }
})

Allow all symbols but selectively unlock an explicit_enable symbol without switching the task into whitelist mode.

ini

# local.d/settings.conf
MY_SETTING {
  apply {
    policy = "implicit_allow";
    symbols_enabled = ["MY_EXPLICIT_ENABLE_SYMBOL"];
  }
}

Check which symbols require explicit enabling after upgrading, to audit the new settings policy behaviour.

$ rspamadm configdump --symbol-details | jq '.[] | select(.flags | index("explicit_enable")) | .name'

Adds composite Lua conditions: rspamd_config:add_composite() now accepts a conditions map of synchronous Lua functions gating atom evaluation, with optional depends_on for cross-pass symbol access.
Introduces policy = "implicit_allow" in settings apply blocks, allowing symbols_enabled to unlock explicit_enable symbols without switching the task into whitelist mode.
Adds static_embed neural provider: a Model2Vec-style, mmap-shared float32 token-embedding backend requiring no neural forward pass, no FFI, and no new dependencies, with a get_token_vectors() method for external consumers.
Adds train.forced_learn_minimal_scan neural training option that installs a prefilter disabling all non-neural symbols during ANN-Train scans, skipping RBL/DNS/fuzzy/Bayes work.
Adds train.frozen neural training option that halts automatic training and vector storage while keeping inference active; explicit ANN-Train requests still retrain on demand.

+6 more show less

Adds task:disable_all_symbols([skip_mask]) Lua binding.
Enables external rspamadm sub-command discovery from a rspamadm.d drop-in directory and the RSPAMADM_COMMAND_PATH environment variable, allowing third-party packages to ship commands without touching rspamd's lualib tree.
Supports supplying the controller password via environment variable for non-interactive automation of password-protected rspamadm operations.
Adds --symbol-details flag to rspamadm configdump, reporting a flags array per symbol (fine, explicit_enable, composite, coro, etc.).
Migrates all WebUI tables from FooTable to Tabulator, adding per-column header filters, a global boolean search box (AND/OR/-/quoted phrases) for history and scan views, persisted column visibility, and automatic light/dark theming via Bootstrap CSS variables.
Exposes aliased and original email-address flags to Lua and adds the orig address flavour to selectors as from('mime', 'orig').

11 details in Everything

└──▷ BREAKING ON UPGRADE

!task:get_from({'mime', 'orig'}) now returns only the preserved original addresses when a rewrite exists, no longer appending rewritten addresses to the same list.
!Symbols carrying the explicit_enable flag now run only when listed in symbols_enabled or force-enabled via task:enable_symbol(); previously they ran whenever any settings were applied.
!The vendored FooTable library is removed from the WebUI; any customisation or external code depending on FooTable will break.

docs update Jul 22, 2026 · docs issue 004

Rspamd 4.1.2 adds composite Lua conditions, static_embed neural provider, neural training freeze, external rspamadm command discovery, and WebUI Tabulator migration.

└──▷ USE IT

Gate a composite atom on a Lua condition so it only fires when a postfilter symbol has a score above a threshold, without adding that symbol to the expression.

lua

rspamd_config:add_composite('MY_COMPOSITE', {
  expression = 'SYMBOL_A & SYMBOL_B',
  depends_on = {'POSTFILTER_SYMBOL'},
  conditions = {
    POSTFILTER_SYMBOL = function(task, symbol)
      local s = task:get_symbol('POSTFILTER_SYMBOL')
      return s and s[1].score > 5
    end
  }
})

Allow all symbols but selectively unlock an explicit_enable symbol without switching the task into whitelist mode.

ini

# local.d/settings.conf
MY_SETTING {
  apply {
    policy = "implicit_allow";
    symbols_enabled = ["MY_EXPLICIT_ENABLE_SYMBOL"];
  }
}

Check which symbols require explicit enabling after upgrading, to audit the new settings policy behaviour.

$ rspamadm configdump --symbol-details | jq '.[] | select(.flags | index("explicit_enable")) | .name'

Adds composite Lua conditions: rspamd_config:add_composite() now accepts a conditions map of synchronous Lua functions gating atom evaluation, with optional depends_on for cross-pass symbol access.
Introduces policy = "implicit_allow" in settings apply blocks, allowing symbols_enabled to unlock explicit_enable symbols without switching the task into whitelist mode.
Adds static_embed neural provider: a Model2Vec-style, mmap-shared float32 token-embedding backend requiring no neural forward pass, no FFI, and no new dependencies, with a get_token_vectors() method for external consumers.
Adds train.forced_learn_minimal_scan neural training option that installs a prefilter disabling all non-neural symbols during ANN-Train scans, skipping RBL/DNS/fuzzy/Bayes work.
Adds train.frozen neural training option that halts automatic training and vector storage while keeping inference active; explicit ANN-Train requests still retrain on demand.

+6 more show less

Adds task:disable_all_symbols([skip_mask]) Lua binding.
Enables external rspamadm sub-command discovery from a rspamadm.d drop-in directory and the RSPAMADM_COMMAND_PATH environment variable, allowing third-party packages to ship commands without touching rspamd's lualib tree.
Supports supplying the controller password via environment variable for non-interactive automation of password-protected rspamadm operations.
Adds --symbol-details flag to rspamadm configdump, reporting a flags array per symbol (fine, explicit_enable, composite, coro, etc.).
Migrates all WebUI tables from FooTable to Tabulator, adding per-column header filters, a global boolean search box (AND/OR/-/quoted phrases) for history and scan views, persisted column visibility, and automatic light/dark theming via Bootstrap CSS variables.
Exposes aliased and original email-address flags to Lua and adds the orig address flavour to selectors as from('mime', 'orig').

11 details in Everything

└──▷ BREAKING ON UPGRADE

!task:get_from({'mime', 'orig'}) now returns only the preserved original addresses when a rewrite exists, no longer appending rewritten addresses to the same list.
!Symbols carrying the explicit_enable flag now run only when listed in symbols_enabled or force-enabled via task:enable_symbol(); previously they ran whenever any settings were applied.
!The vendored FooTable library is removed from the WebUI; any customisation or external code depending on FooTable will break.

docs update Jul 22, 2026 · issue 022

Rspamd 4.1.2 adds sender-identity preservation for DMARC/SPF, composite Lua conditions, and WebUI Tabulator migration.

Preserves sender identity through DMARC/SPF processing pipelines.
Supports composite Lua conditions for more expressive rule authoring.
Migrates the WebUI to the Tabulator library for improved table rendering.

3 details in Everything

docs update Jul 22, 2026 · docs issue 004

Rspamd 4.1.2 adds sender-identity preservation for DMARC/SPF, composite Lua conditions, and WebUI Tabulator migration.

Preserves sender identity through DMARC/SPF processing pipelines.
Supports composite Lua conditions for more expressive rule authoring.
Migrates the WebUI to the Tabulator library for improved table rendering.

3 details in Everything

docs update Jul 22, 2026 · issue 022

Rspamd 4.1.2 tightens selector parsing, glob map anchoring, explicit_enable gating, alias rewriting, and secretbox nonce handling.

└──▷ TRY IT

Find all symbols carrying the explicit_enable flag so you know which ones to add to symbols_enabled in your settings.

$ rspamadm configdump --symbol-details | grep -B 4 explicit_enable

Unlock an explicit_enable symbol additively (without whitelisting all others) using the new policy option in settings.

hcl

# local.d/settings.conf
my_entry {
  # ... match conditions ...
  apply {
    policy = "implicit_allow";
    symbols_enabled = ["MY_EXPLICIT_SYM"];
    symbols_disabled = ["UNWANTED_SYM"];
  }
}

Invalid selectors now fail configuration load with an error pointing at the offending token, preventing silently truncated selector chains in multimap, rbl, ratelimit, settings, reputation, and the WebUI.
Glob map patterns are now compiled anchored (^(?:...)$) at load time, closing a subdomain evasion vector where bare entries like *.bit.ly previously matched foo.bit.ly.evil.com.
Symbols carrying the explicit_enable flag are now strictly gated: they run only when listed in symbols_enabled of applied settings, with a new policy = "implicit_allow" option to unlock symbols additively without whitelisting.
lua_cryptobox secretbox now correctly zero-pads short nonces to 24 bytes, producing stable, reproducible ciphertexts instead of memory-dependent output.

4 details in Everything

└──▷ BREAKING ON UPGRADE

!Selectors with a syntax error after a valid prefix (e.g. from("smtp"):domain:lower) now cause configuration load to fail instead of silently evaluating the truncated prefix — affects multimap, rbl, ratelimit, settings, reputation, and WebUI selectors.
!Glob map entries now match the whole subject: bare entries like t.co no longer match walmart.com, and *.bit.ly no longer matches foo.bit.ly.evil.com — affects multimap glob/glob_multi types, url_redirector redirector_hosts_map, dkim_signing and arc signing_table/key_table, mx_check exclusions, and rbl glob returncodes matchers.
!Symbols with the explicit_enable flag no longer run when *any* settings are applied; they must be listed in symbols_enabled of the relevant settings entry or enabled via task:enable_symbol().
!task:get_from({'mime', 'orig'}) now returns only the wire addresses when an alias rewrite preserved originals, instead of the combined originals-plus-rewritten list — code relying on the combined list must query both flavours separately.
!From-domain maps or statistics keyed on gmail.com will now see googlemail.com for those senders, since cross-domain alias rewrites on the From address are silently discarded.
!Ciphertexts produced by rspamd_cryptobox secretbox with nonces shorter than 24 bytes under earlier versions were never reliable and will most likely fail to decrypt after upgrading; persisted secretbox data must be re-encrypted.

docs update Jul 22, 2026 · docs issue 004

Rspamd 4.1.2 tightens selector parsing, glob map anchoring, explicit_enable gating, alias rewriting, and secretbox nonce handling.

└──▷ TRY IT

Find all symbols carrying the explicit_enable flag so you know which ones to add to symbols_enabled in your settings.

$ rspamadm configdump --symbol-details | grep -B 4 explicit_enable

Unlock an explicit_enable symbol additively (without whitelisting all others) using the new policy option in settings.

hcl

# local.d/settings.conf
my_entry {
  # ... match conditions ...
  apply {
    policy = "implicit_allow";
    symbols_enabled = ["MY_EXPLICIT_SYM"];
    symbols_disabled = ["UNWANTED_SYM"];
  }
}

Invalid selectors now fail configuration load with an error pointing at the offending token, preventing silently truncated selector chains in multimap, rbl, ratelimit, settings, reputation, and the WebUI.
Glob map patterns are now compiled anchored (^(?:...)$) at load time, closing a subdomain evasion vector where bare entries like *.bit.ly previously matched foo.bit.ly.evil.com.
Symbols carrying the explicit_enable flag are now strictly gated: they run only when listed in symbols_enabled of applied settings, with a new policy = "implicit_allow" option to unlock symbols additively without whitelisting.
lua_cryptobox secretbox now correctly zero-pads short nonces to 24 bytes, producing stable, reproducible ciphertexts instead of memory-dependent output.

4 details in Everything

└──▷ BREAKING ON UPGRADE

!Selectors with a syntax error after a valid prefix (e.g. from("smtp"):domain:lower) now cause configuration load to fail instead of silently evaluating the truncated prefix — affects multimap, rbl, ratelimit, settings, reputation, and WebUI selectors.
!Glob map entries now match the whole subject: bare entries like t.co no longer match walmart.com, and *.bit.ly no longer matches foo.bit.ly.evil.com — affects multimap glob/glob_multi types, url_redirector redirector_hosts_map, dkim_signing and arc signing_table/key_table, mx_check exclusions, and rbl glob returncodes matchers.
!Symbols with the explicit_enable flag no longer run when *any* settings are applied; they must be listed in symbols_enabled of the relevant settings entry or enabled via task:enable_symbol().
!task:get_from({'mime', 'orig'}) now returns only the wire addresses when an alias rewrite preserved originals, instead of the combined originals-plus-rewritten list — code relying on the combined list must query both flavours separately.
!From-domain maps or statistics keyed on gmail.com will now see googlemail.com for those senders, since cross-domain alias rewrites on the From address are silently discarded.
!Ciphertexts produced by rspamd_cryptobox secretbox with nonces shorter than 24 bytes under earlier versions were never reliable and will most likely fail to decrypt after upgrading; persisted secretbox data must be re-encrypted.

4.1.2 Jul 21, 2026 · issue 022

Rspamd 4.1.2 adds per-symbol Lua composites, a static embedding Neural provider, new Settings policies, and external Rspamadm command discovery.

└──▷ GET THIS VERSION

$ git clone --branch 4.1.2 https://github.com/rspamd/rspamd.git
# already have the repo? check out this version:
$ git checkout 4.1.2

└──▷ USE IT

Prevent automatic Neural network updates while still allowing manual forced-learn during a model evaluation period.

ini

neural {
  train {
    frozen = true;
  }
}

Load Rspamadm command modules from a custom directory to deploy organisation-specific admin tooling without modifying core config.

$ RSPAMADM_COMMAND_PATH=/opt/rspamd/custom-commands rspamadm <command>

Adds per-symbol Lua conditions and explicit dependencies in Composites rules.
Adds static_embed Neural provider with a WordPiece subword tokenizer over a static embedding matrix and per-token vector access.
Adds Neural train.frozen control to halt automatic training and a forced-learn minimal-scan fast path.
Adds implicit_allow policy option in Settings apply with additive symbols_enabled, plus strict explicit_enable gating.
Enables discovery of Rspamadm command modules from external directories via rspamadm.d or RSPAMADM_COMMAND_PATH.

+3 more show less

Allows the Rspamd controller password to be read from the environment for automation use cases.
Adds symcache flag display to configdump --symbol-details.
Migrates all WebUI tables from FooTable to Tabulator, enabling per-column filters and global history/scan search.

8 details in Everything

└──▷ BREAKING ON UPGRADE

!In lua_task, the orig address flavour now returns only the wire (transmitted) addresses when a rewrite preserved the originals — code expecting rewritten addresses under orig will receive different values.
!WebUI: FooTable has been removed and all tables are now Tabulator-based; any customizations or integrations targeting FooTable will break.
!Maps: glob map patterns are now anchored to match the whole subject; entries relying on substring matching must be updated to use explicit wildcards or they will stop matching.

4.1.1 Jun 19, 2026 · release notes

Rspamd 4.1.1 adds pluggable Neural registries, richer CSS text-hiding detection, zip-bomb limits, and byte-distribution stats.

└──▷ GET THIS VERSION

$ git clone --branch 4.1.1 https://github.com/rspamd/rspamd.git
# already have the repo? check out this version:
$ git checkout 4.1.1

Adds pluggable feature-provider and ANN-architecture registries to the Neural module, plus a sequence output mode with SIF word selection for fasttext_embed, multi-head attention pooling in kann, and slice/concat graph transforms in lua_kann.
Enables content-negotiation (representation and compression) in checkv3 via Accept/Accept-Encoding headers.
Expands CSS text-hiding detection to cover off-screen positioning, clip, negative text-indent, and tiny fonts.
Adds opt-in zip-bomb extraction limits (size, count, ratio) to lua_archive and byte-distribution statistics (entropy, byte mean/deviation, serial correlation, Monte-Carlo Pi) to lua_text.
Exposes a zlib/YARA-compatible crc32 on rspamd_text, rspamd_util, and cryptobox hash objects.

+1 more show less

Adds an explicit SOM (start-of-match) flag to the Multipattern engine.

6 details in Everything

4.1.1 Jun 19, 2026 · issue 007

Rspamd 4.1.1 adds pluggable Neural registries, richer CSS text-hiding detection, zip-bomb limits, and new byte-analysis APIs.

└──▷ GET THIS VERSION

$ git clone --branch 4.1.1 https://github.com/rspamd/rspamd.git
# already have the repo? check out this version:
$ git checkout 4.1.1

Adds pluggable feature-provider and ANN-architecture registries to the Neural module, plus a sequence output mode with SIF word selection for fasttext_embed, multi-head attention pooling in kann, and slice/concat graph transforms in lua_kann.
Enables content-negotiation in checkv3 — representation and compression now negotiated via Accept/Accept-Encoding headers.
Expands CSS text-hiding detection to cover off-screen positioning, clip, negative text-indent, and tiny fonts.
Adds opt-in zip-bomb extraction limits (size, count, ratio) to lua_archive to bound archive expansion.
New byte-distribution statistics methods in lua_text: entropy, byte mean/deviation, serial correlation, and Monte-Carlo Pi.

+2 more show less

Exposes a zlib/YARA-compatible CRC32 on rspamd_text, rspamd_util, and cryptobox hash objects.
Adds an explicit SOM (start-of-match) flag to the Multipattern engine.

7 details in Everything

4.1.0 Jun 5, 2026 · release notes

Rspamd 4.1.0 adds load-aware upstream selection, chain-aware URL redirect caching, /checkv3 metadata headers, hot-reloadable composites, and new Lua/selector APIs.

└──▷ GET THIS VERSION

$ git clone --branch 4.1.0 https://github.com/rspamd/rspamd.git
# already have the repo? check out this version:
$ git checkout 4.1.0

└──▷ TRY IT

Inspect per-worker memory usage — RSS, Lua heap, mempool callsites, and jemalloc stats — to identify a leaking worker process.

$ rspamadm control memstat

Hold dmarc_report dispatch until a full batch is ready, reducing partial-report noise in high-volume environments.

$ rspamadm dmarc_report --batch-wait

Review autolearn statistics grouped by a chosen field and sorted by a metric to tune Bayes classifier performance.

$ rspamadm autolearnstats --sort-by ham --group domain

Adds Power of Two Choices load-aware upstream selection with per-upstream latency EWMA, slow-start on revive, per-target SRV weight/error-budget expansion, and deferred DNS to survive transient startup failures.
Upgrades url_redirector with chain-aware intermediate-hop caching, coherent browser fingerprint profiles for stealth resolution, glob-based redirector_hosts_map, and a per-URL GET allowlist.
Adds IP-class classification, bad_mxs/bad_ips trust maps, and per-source checks to mx_check.
Exposes custom metadata via metadata headers and task:get_metadata() on the /checkv3 protocol endpoint.
Adds hot-reloadable dynamic composites map so composite rules update without a full restart.

+9 more show less

Extends Lua API with bulk and regexp symbol lookups on task; phase-specific (connect/read/write) timeouts and an on_error callback for lua_tcp; lua_extras structured loader for custom selectors, maps, and regexps with cross-kind dependency ordering; and lua_feedback_parsers for DSN and ARF reports.
Reports pending async events and stalled symbols when a scan times out, aiding diagnosis of slow scans.
Adds fuzzy_digest, fuzzy_shingles, authenticated, and received_count selectors.
Adds ClickHouse named extra_columns presets (including an outbound preset) and richer Elastic logs covering Reply-To, received IPs, URL metadata, and forcing module.
Adds per-service <RULE>_CHECK anchor symbol for dependency ordering and eXpurgate engine support in lua_scanners.
Adds HTML5 tag definitions (video/audio/picture/svg/…) and optional insertion-ordered HTTP header emission.
Adds rspamadm control memstat for per-worker memory dumps covering RSS, mempool callsites, Lua heap, and jemalloc stats; also adds dmarc_report --batch-wait and autolearnstats --sort-by/--group options.
Supports env-overridable baseline pidfile and logging, auto-load of the shipped fasttext model when present, and fixed-point (%.Nf) formatting with correct rounding in fpconv.
Discovers rspamd.com fuzzy servers via SRV by default in fuzzy_check.

14 details in Everything

└──▷ BREAKING ON UPGRADE

!mx_check: MX_NONE replaces the former MX_NXDOMAIN and MX_MISSING symbols; any rules, composites, or actions referencing those old symbol names will stop matching.
!fuzzy_check: rspamd.com server discovery now uses SRV records by default; setups that rely on hard-coded addresses or override DNS resolution may behave differently.

4.0.1 Apr 5, 2026 · release notes

Rspamd 4.0.1 adds layered settings merge and a dynamic block API for fuzzy storage with custom response codes.

└──▷ GET THIS VERSION

$ git clone --branch 4.0.1 https://github.com/rspamd/rspamd.git
# already have the repo? check out this version:
$ git checkout 4.0.1

Adds layered collect-then-merge flow for settings, with weak dependencies, disabled status in symcache, and force-enable override for settings conflicts.
Introduces a dynamic block API for the fuzzy storage worker, supporting custom response codes (403 for ratelimits, 503 for bans) and exposing ratelimit_whitelist checks to Lua.

2 details in Everything

4.0.0 Mar 30, 2026 · release notes

Rspamd 4.0 adds /checkv3 multipart API, HTTPS-native workers, multi-class Bayes, HTML phishing fuzzy hashes, and LLM embeddings.

└──▷ GET THIS VERSION

$ git clone --branch 4.0.0 https://github.com/rspamd/rspamd.git
# already have the repo? check out this version:
$ git checkout 4.0.0

└──▷ TRY IT

Submit a message to the new v3 API endpoint using msgpack encoding for lower overhead in high-throughput pipelines.

$ rspamc --protocol-v3 --msgpack symbols <message.eml>

After upgrading a Redis-sharded Bayes setup, migrate shard assignments from Jump Hash to Ring Hash to preserve classifier accuracy.

$ rspamadm statistics_dump migrate

Opt out of the new default that includes content URLs (e.g. from PDFs) in task:get_urls() results.

ini

# local.d/options.inc
include_content_urls = false;

New /checkv3 HTTP endpoint uses multipart/form-data requests and multipart/mixed responses with structured JSON/msgpack metadata, per-part zstd compression, zero-copy writev responses, and proxy support.
Hyperscan compilation and caching moved to a pluggable async Lua backend with Redis storage, enabling shared databases across workers and hosts with self-healing stale-blob detection.
Single fuzzy hash can now carry up to 8 flags simultaneously (epoch 12), with multiple rules matching the same digest independently.
New FUZZY_HTML_PHISHING symbol detects reused phishing templates where an HTML template matches but link domains differ.
Workers now serve HTTPS natively (auto-detected from bind socket flags), enabling secure WebUI and API without a reverse proxy.

+15 more show less

Built-in mmap-based fasttext shim shares model memory across workers via MAP_SHARED, saving ~500 MB–7 GB per host and supporting hot-reload via maps infrastructure.
Native UUID v7 generation per task with ClickHouse UUID v7 column support for cross-system correlation.
Neural module supports external pretrained models with multi-layer funnel architecture, multi-model fasttext embedding with SIF word weighting, and expression-based autolearn for LLM providers.
Bayes classifiers now support arbitrary classes beyond binary spam/ham, with updated WebUI learning UI and new /bayes/classifiers endpoint.
Milter add/remove headers and extended symbol info exposed in RSPAMC/SPAMC text protocol for Exim and other legacy clients.
Token bucket load balancing for proxy upstreams with configurable burst parameters.
Ring Hash (Ketama) consistent hashing replaces Jump Hash for Redis sharding with minimal disruption and a rspamadm statistics_dump migrate shard migration tool.
ARC trusted_authserv_id support for reusing upstream Authentication-Results headers.
Reply-To validity checks added to headers_checks.
Fuzzy hashes stored in Redis history for matched hash tracking.
HTTP content negotiation framework with zstd compression for the /stat endpoint.
Attachment filename sub-tokens improve Bayes classifier accuracy.
GPT module adds configurable consensus thresholds and a context_augment hook.
New rspamadm subcommands: autolearnstats, logstats, and mapstats.
ASCII85 decode support added for PDF extraction.

20 details in Everything

└──▷ BREAKING ON UPGRADE

!Jump Hash replaced with Ring Hash (Ketama) for Redis sharding: run rspamadm statistics_dump migrate after upgrading or accept temporary Bayes accuracy loss while data is re-learned (single Redis server setups unaffected).
!URLs from PDF and other computed parts are now included by default in task:get_urls(); set include_content_urls = false in local.d/options.inc to restore old behavior.
!The ssl = true worker option is removed; SSL is now auto-detected from bind socket flags.
!ENABLE_FASTTEXT cmake option no longer exists as libfasttext has been replaced with a built-in shim.
!SenderScore RBLs are disabled by default (require MyValidity account registration).
!Suspicious TLDs are now map-based via conf/maps.d/suspicious_tlds.inc instead of a hardcoded list.
!Neural autolearn options have been renamed to match RBL module naming conventions.
!Token bucket load balancing is now enabled by default for proxy upstreams, replacing simple round-robin.

3.14.3 Jan 8, 2026 · release notes

Rspamd 3.14.3 adds Lua task registry for validation, PDF text extraction for garbage filtering, and extra tables API for the ClickHouse plugin.

└──▷ GET THIS VERSION

$ git clone --branch 3.14.3 https://github.com/rspamd/rspamd.git
# already have the repo? check out this version:
$ git checkout 3.14.3

Adds a task registry for safe Lua task reference validation.
Adds text quality analysis for PDF garbage filtering with basic PDF text extraction including UTF-16 detection.

2 details in Everything

3.14.2 Dec 11, 2025 · release notes

Rspamd 3.14.2 adds new metadata export formatters, DMARC RUA re-validation, and selective Authentication-Results header removal.

└──▷ GET THIS VERSION

$ git clone --branch 3.14.2 https://github.com/rspamd/rspamd.git
# already have the repo? check out this version:
$ git checkout 3.14.2

└──▷ TRY IT

Re-validate all cached DMARC RUA addresses against your exclusion maps or RBLs before dispatching reports.

$ rspamadm dmarc_report --recheck-rua

Adds multipart, msgpack, and json_with_message formatters to the Metadata Exporter for flexible binary and multipart upload support.
New rspamadm dmarc_report --recheck-rua flag re-validates cached DMARC report addresses against exclusion maps and RBLs before sending.
New remove_ar_from option in Milter Headers enables selective removal of Authentication-Results headers targeting specific domains.

3 details in Everything

└──▷ BREAKING ON UPGRADE

!The meta_headers option in Metadata Exporter is deprecated in favor of the new formatters (multipart, msgpack, json_with_message).

3.14.1 Dec 1, 2025 · release notes

Rspamd 3.14.1 adds inverted indexes for Composites, rspamadm spf_flatten tool, deep URL processing, and lua_shape validation.

└──▷ GET THIS VERSION

$ git clone --branch 3.14.1 https://github.com/rspamd/rspamd.git
# already have the repo? check out this version:
$ git checkout 3.14.1

Adds a bloom filter for fast negative symbol lookups in Composites
Adds statistics tracking and control protocol command to Composites
Adds combinator option for selector rules in Multimap
Adds rspamadm spf_flatten tool with macro preservation
Adds deep processing architecture for URLs with C-to-Lua filter consultation

+5 more show less

Adds obfuscated URL detection to url_suspect plugin
Adds rspamd_util.decode_html_entities for HTML entity decoding
Adds lua_shape validation library as a replacement for tableshape
Adds T.callable() type in lua_shape for function validation
Adds callable defaults support in lua_shape

10 details in Everything

3.14.0 Nov 11, 2025 · release notes

Rspamd 3.14.0 adds HTML fuzzy hashing, TCP fuzzy protocol, CTA URL detection API, dark mode WebUI, and a Postfix wizard.

└──▷ GET THIS VERSION

$ git clone --branch 3.14.0 https://github.com/rspamd/rspamd.git
# already have the repo? check out this version:
$ git checkout 3.14.0

└──▷ USE IT

Detect call-to-action URLs in a message from a custom Lua rule — useful for catching phishing lures that bury a single redirect link in HTML.

lua

local cta_urls = task:get_cta_urls()
for _, url in ipairs(cta_urls) do
  rspamd_logger.infox(task, 'CTA URL found: %s', tostring(url))
end

Enable dark mode in the Rspamd WebUI — useful for SOC analysts working in low-light environments; auto-detection follows the OS preference.

📍In the WebUI, open Settings and enable Dark Mode (auto-detection follows the OS theme preference).

Adds structural similarity detection for HTML content via HTML fuzzy hashing, with per-rule text_hashes toggle for HTML-only matching.
Adds full TCP support for the fuzzy protocol with auto-switch from UDP and production-ready connection management.
New task:get_cta_urls() Lua API for call-to-action URL detection, plus hash-based URL deduplication with a 50k URL limit for DoS protection.
Adds HTML URL rewriting infrastructure.
Adds web search context for the LLM plugin with Redis caching.

+5 more show less

Adds dark mode to the WebUI with auto-detection.
Adds advanced alias support with loop detection.
Adds Milter ESMTP argument parsing with a new Lua API.
Adds a Postfix wizard for automated Rspamd integration.
Adds configurable Bayes guards for tunable spam-learning behavior.

10 details in Everything

3.13.2 Oct 14, 2025 · release notes

Rspamd 3.13.2 adds Metadefender hash lookups, LLM user/domain context, Vault KV v2, fuzzy split keys, and DMARC RUA exclusions.

└──▷ GET THIS VERSION

$ git clone --branch 3.13.2 https://github.com/rspamd/rspamd.git
# already have the repo? check out this version:
$ git checkout 3.13.2

New Metadefender hash lookup module enables file-hash reputation checks against the Metadefender cloud.
Adds user/domain context support for LLM-based email classification, allowing per-user or per-domain tuning of AI-driven decisions.
Supports HashiCorp Vault KV version 2 for secret storage, enabling use of versioned KV secrets in Rspamd configuration.
Adds separate encryption keys for read and write operations in the fuzzy_check module, enabling split-key access control on fuzzy hash storage.
Adds RUA address exclusion support in dmarc.lua, allowing specific reporting addresses to be suppressed from DMARC aggregate reports.

5 details in Everything

3.13.1 Sep 30, 2025 · release notes

Rspamd 3.13.1 adds encrypted ZIP archive scanning, encrypted maps, and Redis TLS support.

└──▷ GET THIS VERSION

$ git clone --branch 3.13.1 https://github.com/rspamd/rspamd.git
# already have the repo? check out this version:
$ git checkout 3.13.1

Supports scanning encrypted ZIP archives (both ZipCrypto and AES encryption) via updated Lua bindings using libarchive.
Adds encrypted maps to enable new secure map distribution scenarios.
Enables configurable TLS connections to Redis backends for secure environments.

3 details in Everything

3.13.0 Sep 17, 2025 · release notes

Rspamd 3.13.0 adds multiclass Bayes, a provider-based neural/LLM fusion engine, and SA-style multimap selector rules.

└──▷ GET THIS VERSION

$ git clone --branch 3.13.0 https://github.com/rspamd/rspamd.git
# already have the repo? check out this version:
$ git checkout 3.13.0

└──▷ TRY IT

Train a message into a named Bayes class (e.g., transactional) instead of the binary spam/ham model.

$ rspamc learn_class:transactional receipt.eml

Filter messages using an SA-style selector rule in multimap to match sender domain with a regex.

yaml

selector FROM_CORP from:domain =~ /corp\.example$/i

Adds multiclass Bayesian classification supporting 2–20 named labels (spam, ham, transactional, newsletters, phishing, etc.) with single-Redis-call efficiency, autolearn, and Lua API support via task:get_multiclass_result().
Overhauls the neural module into a pluggable provider-based architecture combining symbol features, LLM embeddings (OpenAI, etc.), trained normalization (unit/zscore/none), and Redis-backed embedding caching.
Adds SA-style selector rules in the multimap module for regex filtering on message fields, integrated with Hyperscan and the regex cache.
Adds automatic MIME part-type detection and expanded HTML feature extraction for downstream classification modules.
Adds flexible HTTP timeout configuration and upstream probe mode to reduce forced revive operations.

+2 more show less

Adds Bayes class management to the WebUI alongside end-to-end scan test flows.
Adds initial support for OpenAI GPT-5 and improved handling of GPT model parameters and prompts in the GPT/LLM integration.

7 details in Everything

3.12.1 Jun 17, 2025 · release notes

Rspamd 3.12.1 adds a new /bayes/classifiers HTTP endpoint for querying Bayesian classifier state.

└──▷ GET THIS VERSION

$ git clone --branch 3.12.1 https://github.com/rspamd/rspamd.git
# already have the repo? check out this version:
$ git checkout 3.12.1

└──▷ TRY IT

Query the Bayesian classifiers configured in Rspamd to inspect their current state — useful for monitoring or automation.

$ curl -s http://localhost:11334/bayes/classifiers

3.12.0 Jun 11, 2025 · release notes

Rspamd 3.12.0 adds Contextal platform integration, HEIC file detection, new email rules, fuzzy server routing, and WebUI enhancements.

└──▷ GET THIS VERSION

$ git clone --branch 3.12.0 https://github.com/rspamd/rspamd.git
# already have the repo? check out this version:
$ git checkout 3.12.0

└──▷ TRY IT

Show only non-default (locally overridden) configuration values to audit your local changes against shipped defaults.

$ rspamadm configdump --non-default

Upload an .eml file directly in the WebUI to test selectors against a real message without copy-pasting.

📍In the Rspamd WebUI, go to Test selectors, then click the file upload control to select a local .eml file and evaluate selectors against it.

New plugin to integrate with the Contextal platform for advanced content analysis.
Adds detection support for HEIC image files via the magic module.
New R_HTTP_URL_IN_FROM rule to detect HTTP URLs in the From header.
New FREEMAIL_REPLYTO_NEQ_FROM rule to flag mismatched freemail Reply-To and From addresses.
Adds Sieve and cPanel forwarding symbols for improved forwarding detection.

+9 more show less

Supports CDB format for external maps.
Allows specifying the Redis protocol version in configuration.
Allows routing fuzzy operations to different servers per operation type.
Adds exclusion list support for the reputation plugin.
New --non-default option for rspamadm configdump to show only locally overridden configuration.
Replies module now considers all recipients and uses SMTP-level ones for improved tracking.
WebUI gains a Delete hash button and dedicated UI for deleting specific fuzzy hashes.
WebUI Test selectors panel now supports file upload for selector testing.
Improved maps status visibility in the WebUI Maps table.

14 details in Everything

3.11.1 Mar 8, 2025 · release notes

Rspamd 3.11.1 adds Ollama/LLM consensus, Redis caching framework, RBL disable-via-map, and expanded fake-reply detection.

└──▷ GET THIS VERSION

$ git clone --branch 3.11.1 https://github.com/rspamd/rspamd.git
# already have the repo? check out this version:
$ git checkout 3.11.1

Adds Ollama support to the GPT plugin, enabling local LLM-based spam analysis without external APIs.
Supports LLM model consensus, allowing multiple LLM models to vote on a message classification.
Enables LLM usage for anonymization of message content before external analysis.
Adds optional suppression of response_format in the GPT plugin to support gpt4all and compatible local models.
Adds GPT plugin support for attaching model reasoning to scan results.

+10 more show less

Introduces a Redis caching framework for use across modules, with the GPT module as the first consumer.
Adds a noop Redis backend for running scripts without actual Redis I/O.
Allows RBL (real-time blocklist) rules to be disabled dynamically via a map.
Allows multiple Lua scripts to be loaded for fuzzy storage processing.
Expands detection of fake reply subjects to multiple languages.
Adds the ability to create timers from Lua scripts.
Allows shingles to be stored as opaque Lua data for custom processing.
Adds early map refresh logic when a map's expiry is unexpectedly long.
Adds images as a supported check type in RBL check_types configuration.
Respects per-map ipv4 and ipv6 configuration options for RBL resolve_ip.

15 details in Everything

3.11.0 Dec 16, 2024 · release notes

Rspamd 3.11 adds ES8/OpenSearch2 support, ratelimit management utilities, MIME strip command, and message anonymization.

└──▷ GET THIS VERSION

$ git clone --branch 3.11.0 https://github.com/rspamd/rspamd.git
# already have the repo? check out this version:
$ git checkout 3.11.0

└──▷ TRY IT

Strip attachments from a message in a pipeline — useful for sanitizing inbound mail before archiving or forwarding.

$ rspamadm mime strip <path/to/message.eml>

Adds support for Elasticsearch 8 and OpenSearch 2 in the Elasticsearch/OpenSearch plugin.
Adds index policy with log retention support to the Elasticsearch/OpenSearch plugin.
Adds LRU cache for last-filled ratelimit buckets, improving ratelimit performance at scale.
Adds utilities to manage ratelimit buckets directly.
Adds rspamadm mime strip command for removing attachments from messages.

+6 more show less

Adds new message anonymization capabilities.
Adds include/exclude logic for headers processing.
Adds lua.local.d folder and other new ways to extend Rspamd configuration.
Replaces fastutf with simdutf for broader architecture support and improved Unicode performance.
Skips extra RBL checks when the Received IP matches the From IP, reducing redundant lookups.
Multimap now uses only distinct text parts for content matching.

11 details in Everything

└──▷ BREAKING ON UPGRADE

!The Elasticsearch/OpenSearch plugin has a reworked configuration format — existing plugin configuration will break on upgrade.

3.10.0 Sep 30, 2024 · release notes

Rspamd 3.10.0 adds MIME UTF-8 support, fuzzy per-key rate limits, DMARC domain filtering, and OpenSSL 3.0 compatibility.

└──▷ GET THIS VERSION

$ git clone --branch 3.10.0 https://github.com/rspamd/rspamd.git
# already have the repo? check out this version:
$ git checkout 3.10.0

Adds MIME UTF-8 support for improved handling of international email content.
Adds SenderScore Reputationlist RBL and RPBL return codes to the default RBL configuration.
Supports setting a negative group score limit via min_score on score groups.
Adds DMARC reporting.only_domains setting to restrict DMARC aggregate reports to specific domains.
Implements individual rate limits per fuzzy key in fuzzy storage.

+7 more show less

Supports different operating modes for fuzzy rules.
Adds OpenSSL 3.0 support across cryptographic subsystems including lua_rsa.
Allows changing the log tag dynamically from an HTTP request.
Sets a default 5-day expiration for Redis-backed history entries.
Allows manipulations with opaque UCL objects for more flexible configuration handling.
URL-encodes constructed ICAP paths to ensure URL safety.
Supports more flexible keypair encoding formats.

12 details in Everything

└──▷ BREAKING ON UPGRADE

!NIST mode has been removed from the cryptobox; configurations relying on NIST curve support in cryptobox will break.
!Control block support has been removed; setups using control blocks will no longer function.

3.9.1 Jul 31, 2024 · release notes

Rspamd 3.9.1 adds special handling of SPF +all (pass-all) records to improve spam detection.

└──▷ GET THIS VERSION

$ git clone --branch 3.9.1 https://github.com/rspamd/rspamd.git
# already have the repo? check out this version:
$ git checkout 3.9.1

Detects and scores SPF +all (pass-all) records specially, flagging domains that publish permissive SPF policies that allow any sender.

1 detail in Everything

3.9.0 Jul 12, 2024 · release notes

Rspamd 3.9 adds JSON syslog logging, file scanning in WebUI, milter header preservation, and customizable bayes expiry

└──▷ GET THIS VERSION

$ git clone --branch 3.9.0 https://github.com/rspamd/rspamd.git
# already have the repo? check out this version:
$ git checkout 3.9.0

└──▷ USE IT

Enable structured logging in syslog so logs can be parsed by JSON-centric log aggregators.

config

# Add to local.d/options.inc:
log_syslog_format = "json";

Configure custom expiry times for bayes filter entries using the new dedicated configuration file.

config

# Create or edit /etc/rspamd/local.d/bayes_expiry.conf
# Example: set a 30-day expiry
expiry = 2592000;

Use the new WebUI feature to upload an email file for manual analysis directly from the interface.

📍1. Open the Rspamd WebUI. 2. Navigate to the Scan tab. 3. Drag and drop an EML/MIME file into the drop area or click to select a file.

Support JSON logging when in syslog mode
Add bayes_expiry.conf to provide ability to set custom settings for bayes filter expiry
Allow to add templates to redis history prefix
[WebUI] Add file input and drop area to scan tab
[Feature] milter_headers: support not removing headers

+1 more show less

Upstreams: make min_resolve_interval configurable

6 details in Everything

└──▷ BREAKING ON UPGRADE

!Do not report module as action

3.8.2 Feb 20, 2024 · release notes

Rspamd 3.8.2 adds JSON syslog logging, redis history prefix templates, fuzzy storage dynamic keypairs, and from map extraction.

└──▷ GET THIS VERSION

$ git clone --branch 3.8.2 https://github.com/rspamd/rspamd.git
# already have the repo? check out this version:
$ git checkout 3.8.2

Adds JSON logging support when Rspamd runs in syslog mode
Allows adding templates to the Redis history prefix via configuration
Enables dynamic keypair loading for fuzzy storage modules
Adds extraction type support for from maps

4 details in Everything

└──▷ BREAKING ON UPGRADE

!Modules are no longer reported as actions in the history/UI (previously displayed as action)

3.8.0 Jan 20, 2024 · release notes

Rspamd 3.8.0 adds JSON logging, per-RBL url_whitelist control, and DMARC suppression for specific recipients

└──▷ GET THIS VERSION

$ git clone --branch 3.8.0 https://github.com/rspamd/rspamd.git
# already have the repo? check out this version:
$ git checkout 3.8.0

Support JSON logging via json module
Support the ping command in fuzzy storage protocol
Support suppressing DMARC reporting for particular recipients
Add per-RBL configuration to disable or replace url_whitelist

4 details in Everything

3.7.5 Dec 15, 2023 · release notes

Rspamd 3.7.5 adds loongarch platform support.

└──▷ GET THIS VERSION

$ git clone --branch 3.7.5 https://github.com/rspamd/rspamd.git
# already have the repo? check out this version:
$ git checkout 3.7.5

3.7.4 Nov 14, 2023 · release notes

Adds composite URL detection rule and new ZPAQ attachment handling for Rspamd 3.7.4

└──▷ GET THIS VERSION

$ git clone --branch 3.7.4 https://github.com/rspamd/rspamd.git
# already have the repo? check out this version:
$ git checkout 3.7.4

suspicious_url composite rule detects suspicious URLs in messages flagged with SUSPICIOUS_HEADERS
New rule detects messages missing both X-Mailer and User-Agent headers
Rspamd now treats *.zpaq attachments as archives and harmful

3 details in Everything

3.7.2 Oct 26, 2023 · release notes

Rspamd 3.7.2 adds blank spam detection, controls for inverted action filtering in the WebUI, and configurable RBL matchers.

└──▷ GET THIS VERSION

$ git clone --branch 3.7.2 https://github.com/rspamd/rspamd.git
# already have the repo? check out this version:
$ git checkout 3.7.2

Adds blank_spam rule to detect emails with only whitespace or images, no text content
Adds a WebUI control to invert the action filter for rules results
Introduces a new configuration option for RBL modules to use different matchers for DNS return codes

3 details in Everything

3.7.1 Oct 7, 2023 · release notes

Rspamd 3.7.1 adds TCP JSON exporter, Redis 6 ACL support, known senders plugin, and numeric RBL checks

└──▷ GET THIS VERSION

$ git clone --branch 3.7.1 https://github.com/rspamd/rspamd.git
# already have the repo? check out this version:
$ git checkout 3.7.1

Adds username and password configuration options in the Redis module for ACL-based authentication
Introduces the known_senders plugin for tracking and scoring messages from established senders
Enables RBL checks on numeric URLs by adding support for numeric_urls inspection in the RBL subsystem

3 details in Everything

3.6 Aug 3, 2023 · release notes

Rspamd 3.6 adds fasttext language detection, fuzzy hash computation in WebUI, and ip_map strategy for external relay

└──▷ GET THIS VERSION

$ git clone --branch 3.6 https://github.com/rspamd/rspamd.git
# already have the repo? check out this version:
$ git checkout 3.6

Adds fasttext language detector module to Rspamd for improved language identification
Adds ability to compute fuzzy hashes in the WebUI via the Scan tab
Adds ip_map strategy to external_relay configuration for controlling relay IP selection

3 details in Everything

3.5 Mar 17, 2023 · release notes

Rspamd 3.5 adds MIME part filtering for antivirus checks and an external maps feature.

└──▷ GET THIS VERSION

$ git clone --branch 3.5 https://github.com/rspamd/rspamd.git
# already have the repo? check out this version:
$ git checkout 3.5

└──▷ TRY IT

Generate a human-readable scan report using rspamc.

$ rspamc -R < email.eml

Enables Mime part filters on the antivirus module
Supports external maps in Rspamd configuration
Adds -R option to rspamc for human-readable reports

3 details in Everything

3.4 Nov 1, 2022 · release notes

Rspamd 3.4 adds basic auth to metadata_exporter http pusher and new detection rules for bounce spam and freemmailers.

└──▷ GET THIS VERSION

$ git clone --branch 3.4 https://github.com/rspamd/rspamd.git
# already have the repo? check out this version:
$ git checkout 3.4

metadata_exporter HTTP pusher now supports basic authentication for remote metric pushing
New detection: bounce spam rule added to penalize bounce-based spam patterns
New composite rule against AFF involving freemailers

3 details in Everything

3.3 Oct 2, 2022 · release notes

Rspamd 3.3 adds HTTP timeout and map editor settings to WebUI, plus scan_time/hostname in metadata_exporter

└──▷ GET THIS VERSION

$ git clone --branch 3.3 https://github.com/rspamd/rspamd.git
# already have the repo? check out this version:
$ git checkout 3.3

Adds http_async_timeout setting to control the Ajax request timeout for the WebUI.
Adds editor option in the WebUI map configuration to allow choosing a specific map editor.
Adds scan_time and hostname fields to the metadata_exporter output.

3 details in Everything

3.2 Apr 8, 2022 · release notes

Rspamd 3.2 adds Hyperscan support for ppc64, a JSON API for maps, ROC-based neural threshold estimation, Cloudmark integration, configurable S3 URLs, WebUI scan options, and enables PCRE2 by default.

└──▷ GET THIS VERSION

$ git clone --branch 3.2 https://github.com/rspamd/rspamd.git
# already have the repo? check out this version:
$ git checkout 3.2

└──▷ TRY IT

Inspect the new enhanced structure in configdump output to verify your custom settings.

$ rspamadm configdump

Hyperscan for ppc64 (also vectorscan)
JSON endpoint for querying maps
ROC based threshold estimation for neural network plugin
Allow configurable s3 urls
Set one_shot for URIBL rules by default

+1 more show less

Enable PCRE2 by default

6 details in Everything

3.1 Nov 3, 2021 · release notes

Rspamd 3.1 adds autolearn junk_threshold, neural test command, per-bucket ratelimit config, and CDB bayes backend.

└──▷ GET THIS VERSION

$ git clone --branch 3.1 https://github.com/rspamd/rspamd.git
# already have the repo? check out this version:
$ git checkout 3.1

└──▷ TRY IT

Run a quick validation of the neural network model without full classification.

$ rspamc neural test <model_path>

Add junk_threshold to control autolearn acceptance
Add neural test subcommand for model validation
Allow setting fake EICAR patterns in antivirus module configuration
Add Lua API interface for CDB building (lua_cdb)
Support per-bucket configurations in ratelimit module

+1 more show less

Store structured data in messagepack format when using S3 backend

6 details in Everything

3.0 Oct 5, 2021 · release notes

Rspamd 3.0 adds DOM HTML parser, S3 plugin, DMARC munging, and several new commands and endpoints.

└──▷ GET THIS VERSION

$ git clone --branch 3.0 https://github.com/rspamd/rspamd.git
# already have the repo? check out this version:
$ git checkout 3.0

rspamadm bayes_dump subcommand for saving and restoring Bayes tokens
rspamadm dmarc_report subcommand for sending DMARC reports
external_services plugin support for Pyzor
s3 module and s3.lua plugin to store messages directly in Amazon S3
external_relay plugin to treat sender's IP as reported by a trusted relay

+2 more show less

OpenMetrics-compatible metrics endpoint at /openmetrics in the controller
Kubernetes health and readiness endpoints (/healthz, /readyz) in the controller

7 details in Everything

└──▷ BREAKING ON UPGRADE

!DMARC reporting logic moved from Rspamd core to rspamadm dmarc_report subcommand; direct integration via Lua config for report sending is no longer available.

2.7 Jan 8, 2021 · release notes

Rspamd 2.7 adds rspamadm clickhouse CLI, ==/!= expressions, RBL content/image URL matching, and SMIME container support.

└──▷ GET THIS VERSION

$ git clone --branch 2.7 https://github.com/rspamd/rspamd.git
# already have the repo? check out this version:
$ git checkout 2.7

Adds the rspamadm clickhouse subcommand for managing ClickHouse interactions directly from the command line
Enables use of '==' and '!=' operators in Rspamd expression language for more precise rule logic
Adds support for matching only content or image URLs in RBL checks.
Adds support for processing SMIME signed messages containers in addition to standard email bodies

4 details in Everything

2.6 Sep 30, 2020 · release notes

Rspamd 2.6 adds selectors plugin, Fuzzy_check gen_hashes and Lua cryptobox secretbox API.

└──▷ GET THIS VERSION

$ git clone --branch 2.6 https://github.com/rspamd/rspamd.git
# already have the repo? check out this version:
$ git checkout 2.6

Adds selectors plugin to enable rule-based actions via controller
Adds weight_threshold option for fine-tuning Fuzzy_check rules
Adds query_specific endpoint to the Rspamd controller API
Adds support for multiple base32 alphabets in maps and decoding

4 details in Everything

2.5 Apr 1, 2020 · release notes

Rspamd 2.5 adds fuzzy storage scripts, ARC whitelisted_signers_map, Neural class bias, and hosts file processing.

└──▷ GET THIS VERSION

$ git clone --branch 2.5 https://github.com/rspamd/rspamd.git
# already have the repo? check out this version:
$ git checkout 2.5

└──▷ USE IT

Configure a map of whitelisted ARC signers.

config

arc {
  whitelisted_signers_map = "${DBDIR}/map/arc_whitelist";
}

Adds script support for fuzzy storage backends via the new feature path
Adds whitelisted_signers_map option to ARC configuration modules

2 details in Everything

2.4 Feb 26, 2020 · release notes

Rspamd 2.4 adds ClickHouse extra columns, RBL url_compose_map, systemd socket names, and Lua logging APIs

└──▷ GET THIS VERSION

$ git clone --branch 2.4 https://github.com/rspamd/rspamd.git
# already have the repo? check out this version:
$ git checkout 2.4

Adds support for extra columns in ClickHouse.
New url_compose_map option available in RBL configuration blocks to control URL composition behavior
Adds support for listening on systemd sockets by name.
New Lua library lua_urls_compose exposed for script-based URL manipulation
Allows setting a custom log function for the logger.

5 details in Everything

2.3 Feb 4, 2020 · release notes

Rspamd 2.3 adds Avast antivirus support, external SPF relays, and Lua text hashing functions

└──▷ GET THIS VERSION

$ git clone --branch 2.3 https://github.com/rspamd/rspamd.git
# already have the repo? check out this version:
$ git checkout 2.3

antivirus.conf now supports the avast module for antivirus scanning
Adds an external_relay option to SPF.

2 details in Everything

2.1 Oct 28, 2019 · release notes

Rspamd 2.1 adds explicit events-backend selection and configurable SPF lookup limits.

└──▷ GET THIS VERSION

$ git clone --branch 2.1 https://github.com/rspamd/rspamd.git
# already have the repo? check out this version:
$ git checkout 2.1

Allows explicitly selecting the events backend.
Adds configurable limits for SPF lookups.
Allow disabling AAAA checks in SPF configuration via a dedicated setting.

3 details in Everything

└──▷ BREAKING ON UPGRADE

!Building Rspamd now requires CMake 3.9.

2.0 Oct 11, 2019 · release notes

Rspamd 2.0 adds p0f fingerprinting, lua_maps support, and new Lua selectors

└──▷ GET THIS VERSION

$ git clone --branch 2.0 https://github.com/rspamd/rspamd.git
# already have the repo? check out this version:
$ git checkout 2.0

Adds lua_smtp library for custom SMTP protocol handling in Lua scripts
Adds p0f scanner module for OS detection via passive TCP fingerprinting
Adds lua_maps with static maps and key-value pair support for configuration-driven lookups
Adds Clickhouse: Store groups data to store composite rule group outcomes in ClickHouse metrics backend
Adds Lua_selectors features including words selector, sort/uniq transforms, and table arguments for dynamic rule evaluation

+1 more show less

Adds Rbl: Support process script to allow executing external scripts during RBL checks for custom enrichment or filtering

6 details in Everything

1.9.3 May 13, 2019 · release notes

Adds IP_SCORE_FREEMAIL rule, vault-based DKIM/ARC keys, and least_passthrough action.

└──▷ GET THIS VERSION

$ git clone --branch 1.9.3 https://github.com/rspamd/rspamd.git
# already have the repo? check out this version:
$ git checkout 1.9.3

Add IP_SCORE_FREEMAIL composite rule for scoring
Adds DKIM keypair generation and fast hashes to the Lua cryptobox API.
Add vault subcommand to rspamadm for DKIM/ARC key management, including rotation and improved generation
Adds least-passthrough results.
Allow oversigning headers when the exists mode is used

5 details in Everything

└──▷ BREAKING ON UPGRADE

!The default oversigning headers list has been changed to a more sane list

1.9.2 Apr 16, 2019 · release notes

Rspamd 1.9.2 adds DNS utility, SPF caching verbosity, encrypted file handling, DKIM signing maps, and Lua map enhancements.

└──▷ GET THIS VERSION

$ git clone --branch 1.9.2 https://github.com/rspamd/rspamd.git
# already have the repo? check out this version:
$ git checkout 1.9.2

Adds dns_tool subcommand to rspamadm for DNS diagnostics
Oversigns OpenPGP and Autocrypt headers.
Adds support for loading user plugins directly from the plugins.d directory
Adds more verbosity for SPF caching.
Enhances antivirus module to specially handle encrypted files within archives

+5 more show less

Adds OpenDKIM-like signing_table and key_table options to dkim_signing module, usable as maps
Allows static regexp and glob patterns in Lua maps
Enables parsing of .ical (iCalendar) files within the tool
Stores SPF record digests for performance optimization
Adds new fields to ClickHouse output.

10 details in Everything

1.9.1 Apr 5, 2019 · release notes

Rspamd 1.9.1 adds rspamadm template CLI command, Jinja preprocessing for configs, and HTTP proxy support.

└──▷ GET THIS VERSION

$ git clone --branch 1.9.1 https://github.com/rspamd/rspamd.git
# already have the repo? check out this version:
$ git checkout 1.9.1

Adds rspamadm template subcommand to render configuration files using Jinja2 templates
Enables preprocessing of Rspamd config files with Jinja syntax before parsing
Greylisting module now supports disabling greylist actions based on specific symbol matches
Adds user-configurable extension filters to the Mime_types plugin.

4 details in Everything

1.9.0 Mar 12, 2019 · release notes

Rspamd 1.9.0 adds rspamadm signing, external service plugin, Lua API extensions, and settings flexibility

└──▷ GET THIS VERSION

$ git clone --branch 1.9.0 https://github.com/rspamd/rspamd.git
# already have the repo? check out this version:
$ git checkout 1.9.0

Adds rspamadm mime sign command for signing MIME messages
Adds configgraph utility to visualize configuration dependencies
Adds external_services plugin with oletools (olefy) support for malicious document detection
Adds lua_scanners ICAP protocol support and SpamAssassin scanner integration
Adds rspamadm modify tool for rewriting headers and appending footers to plain messages

+7 more show less

Adds ipmask processor in Selectors for matching IP ranges
Adds task:lookup_words Lua method and flexible URL extraction methods
Adds ability to set rewrite subject pattern from settings
Adds hostname match support in Settings selectors
Adds support for ed25519 DKIM key generation
Adds preliminary rate-limit support to Fuzzy_storage.
Adds upstream watcher event listeners via Lua API

12 details in Everything

1.8.3 Dec 3, 2018 · release notes

Rspamd 1.8.3 adds Kaspersky AV support, ClickHouse DB, encryption-only connections and rspamadm mime word format control.

└──▷ GET THIS VERSION

$ git clone --branch 1.8.3 https://github.com/rspamd/rspamd.git
# already have the repo? check out this version:
$ git checkout 1.8.3

Add Kaspersky antivirus support as a new integration for malware detection
Add method to get DKIM results via Lua API
Allow to require encryption when accepting connections to enforce TLS-only access
Allow to choose words format in rspamadm mime subcommand

4 details in Everything

1.8.2 Nov 19, 2018 · release notes

Rspamd 1.8.2 adds rspamadm cookie utility, cookies in replies module, and Lua regexps from glob

└──▷ GET THIS VERSION

$ git clone --branch 1.8.2 https://github.com/rspamd/rspamd.git
# already have the repo? check out this version:
$ git checkout 1.8.2

Adds the rspamadm cookie utility and functions for generating encrypted cookies.
Adds cookie support in the replies module.
Enable creation of Lua regexps directly from glob patterns or plain strings using specialized functions

3 details in Everything

└──▷ BREAKING ON UPGRADE

!rspamd_update is disabled by default, requiring explicit configuration to re-enable if previously used.

1.8.1 Oct 16, 2018 · release notes

Rspamd 1.8.1 adds DKIM/ARC check_violation, HTTP auth for maps, user disable actions, and WebUI symbol colorization

└──▷ GET THIS VERSION

$ git clone --branch 1.8.1 https://github.com/rspamd/rspamd.git
# already have the repo? check out this version:
$ git checkout 1.8.1

└──▷ USE IT

Configure DKIM/ARC signing to check for violation results

config

dkim_signing {
  check_violation = true;
}

Adds check_violation feature to DKIM/ARC signing configuration
Allow maps with HTTP authentication
Add support for g+: and g-: composite atoms in rules
Enable disabling actions via user settings
Colorize symbols in the WebUI

+1 more show less

Adds sorting by symbol score value in WebUI history

6 details in Everything

1.8.0 Sep 24, 2018 · release notes

Rspamd 1.8.0 adds selectors framework for flexible configuration, enhanced Lua API, and improved ratelimiting

└──▷ GET THIS VERSION

$ git clone --branch 1.8.0 https://github.com/rspamd/rspamd.git
# already have the repo? check out this version:
$ git checkout 1.8.0

Adds functional selectors library for creating complex configuration conditions in settings, maps, and modules
Supports new ratelimiting scopes: by digest, by attachments data, and by filenames via the selectors framework
Adds selectors support in the ratelimit module to apply limits based on dynamic criteria like message metadata
Allows retrieving DKIM signing data directly from HTTP headers instead of requiring local file access
Enables caching of selector results at runtime for improved performance on repeated lookups

+2 more show less

Integrates the selectors framework into the multimap module for more flexible map key matching
Adds support for (almost) all html entities in text processing to improve content analysis accuracy

7 details in Everything

1.7.9 Aug 1, 2018 · release notes

Rspamd 1.7.9 adds HTTP basic auth for elastic/clickhouse plugins, SPF selectors, IPv6 scoped parsing, and ssl_no_verify flag.

└──▷ GET THIS VERSION

$ git clone --branch 1.7.9 https://github.com/rspamd/rspamd.git
# already have the repo? check out this version:
$ git checkout 1.7.9

Add ssl_no_verify flag to disable all SSL checks
Implement parsing of scoped IPv6 addresses
Allow to print full mime structure when extracting mime data
Improve rspamc counters output

4 details in Everything

1.7.8 Jul 12, 2018 · release notes

Rspamd 1.7.8 adds Lua fuzzy hash extraction, AV module config, and HTTP map caching

└──▷ GET THIS VERSION

$ git clone --branch 1.7.8 https://github.com/rspamd/rspamd.git
# already have the repo? check out this version:
$ git checkout 1.7.8

Adds HTTP map caching.
Allow configuring the rejection message for the AV module via new config options
Adds a preliminary Lua function for obtaining fuzzy hashes from text.
Adds fuzzy-hash extraction in the MIME tool.

4 details in Everything

1.7.7 Jul 2, 2018 · release notes

New rspamadm mime tool with Lua API hooks for statistical tokens and HTML extraction enhancements.

└──▷ GET THIS VERSION

$ git clone --branch 1.7.7 https://github.com/rspamd/rspamd.git
# already have the repo? check out this version:
$ git checkout 1.7.7

Adds rspamadm mime command-line utility for extracting MIME data, words, HTML structure, URLs, and Bayes tokens from email files
Adds a Lua API method for retrieving statistical tokens.
Introduces ignored symbols concept to prevent race conditions in symbol processing
Enables chunked reading of ordinary file maps to improve stability during rewrites
Adds HTML parser support for the <base> tag, opacity CSS styles, and multiple size suffixes in style parsing

5 details in Everything

1.7.6 Jun 15, 2018 · release notes

Rspamd 1.7.6 adds ED25519 DKIM signatures, keypair operations, fake DNS records, and encrypted UCL configuration.

└──▷ GET THIS VERSION

$ git clone --branch 1.7.6 https://github.com/rspamd/rspamd.git
# already have the repo? check out this version:
$ git checkout 1.7.6

Adds decryption, signing, and signature verification to rspamadm keypair.
Add dkim_signing pubkey checks to match private and public keys for DKIM signatures.
Add support for fake DNS records, allowing specification of the fake DNS address from the config.
Allow adding symbols and setting task flags directly via settings in configuration.
Provide $HOSTNAME variable in UCL and support encrypted configs in UCL.

+2 more show less

Add gzip compression for HTTP requests in the elastic module and add gzip methods to lua util.
WebUI displays smtp sender/recipient in history.

7 details in Everything

1.7.5 May 18, 2018 · release notes

Adds fuzzy hash headers, EMA averaging, multiple groups/symbols, and CommuniGate Pro support in Rspamd 1.7.5

└──▷ GET THIS VERSION

$ git clone --branch 1.7.5 https://github.com/rspamd/rspamd.git
# already have the repo? check out this version:
$ git checkout 1.7.5

Adds the ability to insert fuzzy hashes into headers.
Uses EMA for calculating averages.
Allows assigning multiple groups to symbols, enabling complex policy actions in configuration
Adds support for receiving and processing emails from CommuniGate Pro self-generated messages
Enables retrieving multipart children nodes directly in Lua scripts via the improved Lua API

5 details in Everything

1.7.4 May 1, 2018 · release notes

Rspamd 1.7.4 adds glob maps, ClickHouse stop-symbol support, and network-based fuzzy request blocking.

└──▷ GET THIS VERSION

$ git clone --branch 1.7.4 https://github.com/rspamd/rspamd.git
# already have the repo? check out this version:
$ git checkout 1.7.4

Adds glob map support as an alternative to regexp maps for pattern matching
Adds stop-symbol support for ClickHouse collection.
Allows blocking fuzzy requests from specific networks via new config directives
Introduces use_domain_sign_inbound feature to control inbound domain signing behavior
Allows changing the expire time of live statistics.

+1 more show less

Adds a failure symbol for the AV module and distinguishes AV failure from clean results

6 details in Everything

└──▷ BREAKING ON UPGRADE

!The configuration format for workers has changed to the new structure: worker type { ... }
!All workers now bind to localhost by default, requiring manual configuration to expose ports externally

1.7.3 Apr 10, 2018 · release notes

Rspamd 1.7.3 adds AVX2 base64 codec, oversigning for headers, and silent logging level.

└──▷ GET THIS VERSION

$ git clone --branch 1.7.3 https://github.com/rspamd/rspamd.git
# already have the repo? check out this version:
$ git checkout 1.7.3

Adds AVX2 codec for base64 encoding operations
Adds Lua API method to retrieve all URL flags
Adds support for folding headers on specific stop characters
Adds lua_cpath option in configuration to set the Lua library path
Adds ability to specify a custom rejection message in milter mode

+8 more show less

Adds handling for unnormalised Unicode obfuscation in URLs
Avoids detecting language twice for relative parts.
Adds oversigning feature implementation
Adds silent logging level to minimize log noise
Improves the URL_IN_SUBJECT rule.
Adds hashing mechanism to reduce Redis attack surface
Adds messages total count to WebUI throughput summary
Adds symbols order selector in WebUI history view

13 details in Everything

1.7.2 Mar 23, 2018 · release notes

Rspamd 1.7.2 adds ClickHouse email storage and single-quote support in configs

└──▷ GET THIS VERSION

$ git clone --branch 1.7.2 https://github.com/rspamd/rspamd.git
# already have the repo? check out this version:
$ git checkout 1.7.2

Adds support for storing emails in ClickHouse.
Adds support for single quotes in configuration.

2 details in Everything

1.7.1 Mar 20, 2018 · release notes

Rspamd 1.7.1 adds lua rules squeezing, X-Spam: Yes header removal, filename logging, and whitelist to emails module.

└──▷ GET THIS VERSION

$ git clone --branch 1.7.1 https://github.com/rspamd/rspamd.git
# already have the repo? check out this version:
$ git checkout 1.7.1

rspamd_stats can now output progress info on STDERR

1 detail in Everything

1.7.0 Mar 12, 2018 · release notes

Rspamd 1.7.0 adds Lua API for DKIM key gen and CPU flags, rspamadm stats JSON, gzip compression support, and new bayes expiry config

└──▷ GET THIS VERSION

$ git clone --branch 1.7.0 https://github.com/rspamd/rspamd.git
# already have the repo? check out this version:
$ git checkout 1.7.0

Add bayes_expiry module as a standalone config component for automatic expiry of bayesian learner data

1 detail in Everything

└──▷ BREAKING ON UPGRADE

!The fann_redis module is renamed to neural; configurations must update module names from fann_redis to neural

1.6.6 Feb 16, 2018 · release notes

Rspamd 1.6.6 adds header insertion at specific positions and hiding usernames in Authentication-Results.

└──▷ GET THIS VERSION

$ git clone --branch 1.6.6 https://github.com/rspamd/rspamd.git
# already have the repo? check out this version:
$ git checkout 1.6.6

Supports inserting headers at a specified position in a message.
Authentication-Results module gains support for hiding usernames

2 details in Everything

1.6.5 Oct 22, 2017 · release notes

Rspamd 1.6.5 adds HTTP map Expires support, mime parser headers flags, and score filtering.

└──▷ GET THIS VERSION

$ git clone --branch 1.6.5 https://github.com/rspamd/rspamd.git
# already have the repo? check out this version:
$ git checkout 1.6.5

Adds Expires header support when using HTTP maps for dynamic configuration updates
Implements headers flags in the mime parser to control which headers are parsed and exposed

2 details in Everything

1.6.4 Sep 10, 2017 · release notes

Rspamd 1.6.4 adds Lua API for content-type attributes, arbitrary Milter header manipulation, and random User-Agent selection.

└──▷ GET THIS VERSION

$ git clone --branch 1.6.4 https://github.com/rspamd/rspamd.git
# already have the repo? check out this version:
$ git checkout 1.6.4

Adds a Lua method for retrieving all Content-Type attributes.
Adds support for adding and removing arbitrary headers in Milter mode via configuration keys
Allows selecting a User-Agent randomly from a list.

3 details in Everything

1.6.3 Jul 26, 2017 · release notes

Rspamd 1.6.3 adds EBL support, monitored host config, fuzzy hash skipping, multimap symbol checks, and multi-key Redis support.

└──▷ GET THIS VERSION

$ git clone --branch 1.6.3 https://github.com/rspamd/rspamd.git
# already have the repo? check out this version:
$ git checkout 1.6.3

Adds EBL to the default configuration.
Allows configuring monitored.
Allows skipping specific hashes in fuzzy storage.
Adds symbol option checking capability in Multimap, allowing validation of associated symbols during mapping.
Adds support for checking multiple keys in Redis settings.

5 details in Everything

1.6.2 Jul 8, 2017 · release notes

Rspamd 1.6.2 adds Lua REPL -e, ClickHouse symbol storage, per-domain email normalization, and Lua APIs.

└──▷ GET THIS VERSION

$ git clone --branch 1.6.2 https://github.com/rspamd/rspamd.git
# already have the repo? check out this version:
$ git checkout 1.6.2

Adds -e option for lua_repl to support one-liner execution mode
Adds storage of symbol data in ClickHouse.
Supports HTTPS connections when connecting to Clickhouse
Adds per-domain email normalisation rules to the emails module
Adds extended_headers_rcpt option to milter_headers configuration

+11 more show less

Allows checking reply-to email addresses in addition to standard headers
Adds short_text_direct_hash capability for fuzzy check module
Adds text_part:get_stats Lua function for script access to text part statistics
Allows adding custom processing scripts for surbl lookups
Allows discarding messages instead of rejecting them via new action type
Allows specifying custom User-Agent string for rspamc requests
Adds TLD extraction filters in Multimap plugin for received headers
Supports SPF macros transformations during evaluation
Enables suppression of DMARC reports for specific domains
Implements rdns-curve plugin using rspamd cryptobox library
Normalizes email aliases within the emails module

16 details in Everything

1.6.0 Jun 12, 2017 · release notes

Rspamd 1.6.0 adds ARC support, milter protocol scanning, DKIM verification API, Redis Bayes storage, and static maps

└──▷ GET THIS VERSION

$ git clone --branch 1.6.0 https://github.com/rspamd/rspamd.git
# already have the repo? check out this version:
$ git checkout 1.6.0

Adds preliminary ARC signing support and sample ARC module configuration.
Adds monitored_address setting in RBL modules to specify which addresses are monitored
Adds an API for verifying DKIM and ARC signatures.

3 details in Everything

└──▷ BREAKING ON UPGRADE

!ratelimits module has been removed from the default configuration set

Rspamd

Summary

How Rspamd helps

Languages

Features

What Rspamd offers you

release 9 total

docs

example

release 8 total

example

release 7 total

docs

release

release

release 24 total

docs

example

release 10 total

docs

example

release 7 total

docs

release

release 8 total

docs

release

example

release

release

release 32 total

docs

example

release 13 total

example

release 9 total

docs

example

release

example

release

docs

command line

release 7 total

release 25 total

docs

example

release 22 total

docs

release

docs

example

release 9 total

release 8 total

release

example

release

release

release

release

release

docs

release

release

docs

release

docs

example

release

example

release

example

release

release

release

release

example

release

release

release

`sentence-transformers` 2.7.0 in its `neural-embedding-service` image (contrib/neural-embedding-service/Dockerfile.gpu)

`transformers` 5.5.0 in its `neural-embedding-service` image (contrib/neural-embedding-service/Dockerfile.gpu)