Rspamd — The Cyber Toolchain

Rspamd 4.2.3

Wed, 21 Oct 2026 10:54:14 GMT

Rspamd 4.2.3 adds priority-ranked force_actions postfilters, unix_time metadata export, and a richer Lua task API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `priority` setting to `force_actions` rules that depend on composites, promoting them to postfilters and exposing the rank as a `priority:N` symbol option.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `merge_checks = false` config key to `RBL` to retain one symbol insertion per check instead of merging duplicate DNS queries into a single result. • Adds `unix_time` field to general metadata in `metadata_exporter`. • task:has_pre_result() in the Lua API now returns the action name (instead of its type) plus its flags. Breaking changes: • `phishtank.rspamd.com` is now disabled by default; setups relying on Phishtank lookups will silently lose that check unless re-enabled. • RBL duplicate DNS queries are now merged into a single symbol insertion, so a rule scores only once per matched value instead of once per check. Set `merge_checks = false` to restore the previous per-check scoring behaviour. • RBL: the `dkim_domainonly` flag under `dkim_match_from` was inverted; eSLDs were compared when `dkim_domainonly` was off. The logic is now corrected, which may change which DKIM-domain RBL matches fire. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/rspamd

Rspamd 4.2.2

Sat, 10 Oct 2026 21:43:43 GMT

Rspamd 4.2.2 adds multi-currency crypto wallet detection, richer metadata_exporter templating, and new Lua API helpers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds crypto_addresses() selector extractor to expose detected wallet addresses from the new `lua_crypto_addresses` scanner, which replaces `bitcoin.lua`.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `add_from_string` to `lua_crypto_addresses` to feed text recovered from attachments into the bounded wallet-address scanner. • Adds `mail_from`, `mail_to`, `helo`, `channel`, and `stream_key` fields plus selector expansion and custom variables to `metadata_exporter` rules. • Adds `email_parts` to `metadata_exporter` to compose multipart email alerts with plain and HTML parts grouped into `multipart/alternative`, with automatic RFC 2047 encoding for non-ASCII headers. • Validates `metadata_exporter` rules against a schema so that `configtest` fails on an invalid rule. • Adds `util.fold_header_unstructured` to the Lua API for folding unstructured headers per RFC 5322. • Adds an `smtp` newline normalization mode to `rspamd_text` in the Lua API. • Adds EHLO and 8BITMIME negotiation with HELO fallback to `lua_smtp`, downgrading 8-bit messages to 7-bit when the server does not advertise 8BITMIME. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/rspamd

Rspamd 4.2.0

Fri, 18 Sep 2026 11:50:38 GMT

Rspamd 4.2.0 adds SVG/OOXML content extraction, public suffix Lua API, fuzzy storage health UI, and untrusted UCL parsing limits.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Exposes public suffix list semantics to Lua as rspamd_tld_lookup(), url:get_public_suffix() with match flags, and the `get_public_suffix` selector transform, supporting wildcards, exceptions, and ICANN/private splits.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds ucl.untrusted_parser(), parser:set_limits(), and parser:get_limits() Lua API calls for bounded parsing of untrusted UCL/JSON/msgpack network input (controller and proxy bodies, checkv3 metadata). • Adds fuzzy storage health monitoring via `fuzzy_check.ping_storage_all` and the `/plugins/fuzzy/status` API endpoint, with per-server liveness marks, down badges, and an on-demand Check button in the WebUI. • Reports sampled fuzzy storage statistics from count scans (`count_scan.stats_sample`) in `/fuzzystat` and via `rspamadm fuzzystat`, with configurable per-source IP caps (`max_ips_per_key`, per-key `max_ips`). • Extracts SVG attachment content and smuggling indicators as new symbols: `SVG_CONTENT`, `SVG_SCRIPT`, `SVG_FOREIGN_OBJECT`, `SVG_DATA_URI`, `SVG_FORM`. • Extracts XLSX and PPTX relationship-level facts as new symbols: `OOXML_MACROS`, `OOXML_OLE_OBJECT`, `OOXML_REMOTE_TEMPLATE`, `OOXML_EXTERNAL_DATA`. • Adds DKIM From-alignment reporting as a dedicated `R_DKIM_ALIGNED` symbol, decided in the DKIM module. • Adds `redis_list` pusher support to `metadata_exporter`. • Adds CSS compound selector and combinator evaluation, supporting `div.mainbox`, `div p`, `div > p`, `h1 + p`, and `h1 ~ p` patterns. • Adds `lua_aliases` mailbox identity and equivalent domain classes for comparing addresses. • Adds ClickHouse data-skipping indexes for point lookups at schema version 12. • Adds upstream pinning for `lua_redis` requests. • Enables HTML parts to be injected from Lua so decoded payloads pass through the regular HTML parser. • WebUI Status servers table gains three-state health, per-server details rows, load and latency columns, version and config drift indicators, a Writable badge, and an 'All SERVERS' cluster row. • WebUI Bayes panel gains a learns balance bar and a `min_learns` status badge. Breaking changes: • Maps used with the `top` filter in multimap must now list full suffixes (e.g. `com.au` instead of `au`) — the old TLD table is replaced by the public suffix lookup. • The 10.5k-pattern TLD hyperscan database is removed from the scanner; free-text URL discovery now runs two passes (static matcher plus dot-anchored suffix labels) via the public suffix list. • RBL URL composition maps and host TLD resolution now go through the public suffix lookup; `!` exception rules are honoured and a host that is itself a public suffix resolves to the whole host. • Fuzzy Redis hash counts are now derived from a periodic SCAN instead of the counter maintained by the update script; negative counters left by older versions are reported as 0. • `R_DKIM_ALLOW` weight changes from -0.2 to -0.1; alignment credit moves to the new `R_DKIM_ALIGNED` symbol. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/rspamd

Rspamd 4.1.5

Sat, 15 Aug 2026 10:52:27 GMT

Rspamd 4.1.5 adds sender-fact sharing over fuzzy encrypted rules, font-aware PDF text extraction, and richer Elastic schema. • Adds sender facts (SPF, DKIM, DMARC, PTR state, recipient bucket, TLS) sharing with fuzzy storages over encrypted rules. • Adds font-aware PDF text extraction: decodes simple font text via the font's `/Encoding` (Annex D base encodings and `/Differences` overrides) and parses `/ToUnicode` CMaps to decode composite (Type0) fonts. • Extends the Elastic schema with structured fuzzy match results and message size. Breaking changes: • GPT: The condition callback now returns only a boolean; request content generation has been moved into `gpt_check`. • Workers: `allow_file_and_shm_inputs` now ships as an explicit `true` default for the normal, controller, and proxy workers — the default will become `false` in the next major release. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/rspamd

Rspamd 4.1.4

Wed, 29 Jul 2026 09:38:18 GMT

Rspamd 4.1.4 grants read-only WebUI users access to the Selectors tab and Errors history. • Read-only WebUI users can now access the Selectors tab and the Errors history. Breaking changes: • Rspamd now refuses to link against a static-only jemalloc; builds configured with a static-only jemalloc will fail to start. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/rspamd

Rspamd 4.1.3

Sat, 25 Jul 2026 19:27:22 GMT

Rspamd 4.1.3 adds fuzzy diagnostics API, ClickHouse fuzzy exports, per-hash introspection, and a local-network request block for lua_http. • Adds structured fuzzy match results via a diagnostics API and the new task:get_fuzzy_results() Lua method, with a configurable probability weight curve (`prob_bias`, `prob_power`) anchored at the match threshold. • Exports fuzzy match details to ClickHouse (schema version 11) and annotates the `X-Rspamd-Fuzzy` milter header with rule, flag, probability, and timestamp. • Adds `forbid_local` option to `lua_http` to block requests to local networks (enabled by default in `url_redirector`). • Enriches sparse ARF reports in `lua_feedback_parsers` with headers from the original message. Breaking changes: • WebUI: jQuery has been removed entirely; all modules now use native DOM and XMLHttpRequest. Font Awesome is replaced by a local SVG sprite — any customizations or plugins depending on jQuery or Font Awesome in the WebUI will break. • DKIM: `HAVE_ED25519` is now scoped to OpenSSL key parsing only, changing ed25519 verification behavior on OpenSSL builds. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/rspamd

Rspamd 4.1.2

Tue, 21 Jul 2026 17:54:39 GMT

Rspamd 4.1.2 adds per-symbol Lua composites, a static embedding Neural provider, new Settings policies, and external Rspamadm command discovery. • Adds per-symbol Lua conditions and explicit dependencies in Composites rules. • Adds `static_embed` Neural provider with a WordPiece subword tokenizer over a static embedding matrix and per-token vector access. • Adds Neural `train.frozen` control to halt automatic training and a forced-learn minimal-scan fast path. • Adds `implicit_allow` policy option in Settings `apply` with additive `symbols_enabled`, plus strict `explicit_enable` gating. • Enables discovery of Rspamadm command modules from external directories via `rspamadm.d` or `RSPAMADM_COMMAND_PATH`. • Allows the Rspamd controller password to be read from the environment for automation use cases. • Adds symcache flag display to `configdump --symbol-details`. • Migrates all WebUI tables from FooTable to Tabulator, enabling per-column filters and global history/scan search. Breaking changes: • In `lua_task`, the `orig` address flavour now returns only the wire (transmitted) addresses when a rewrite preserved the originals — code expecting rewritten addresses under `orig` will receive different values. • WebUI: FooTable has been removed and all tables are now Tabulator-based; any customizations or integrations targeting FooTable will break. • Maps: glob map patterns are now anchored to match the whole subject; entries relying on substring matching must be updated to use explicit wildcards or they will stop matching. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/rspamd

Rspamd 4.1.1

Fri, 19 Jun 2026 14:58:37 GMT

Rspamd 4.1.1 adds pluggable Neural registries, richer CSS text-hiding detection, zip-bomb limits, and byte-distribution stats. • Adds pluggable feature-provider and ANN-architecture registries to the Neural module, plus a sequence output mode with SIF word selection for `fasttext_embed`, multi-head attention pooling in kann, and `slice`/`concat` graph transforms in lua_kann. • Enables content-negotiation (representation and compression) in checkv3 via `Accept`/`Accept-Encoding` headers. • Expands CSS text-hiding detection to cover off-screen positioning, clip, negative text-indent, and tiny fonts. • Adds opt-in zip-bomb extraction limits (size, count, ratio) to `lua_archive` and byte-distribution statistics (entropy, byte mean/deviation, serial correlation, Monte-Carlo Pi) to `lua_text`. • Exposes a zlib/YARA-compatible crc32 on `rspamd_text`, `rspamd_util`, and cryptobox hash objects. • Adds an explicit SOM (start-of-match) flag to the Multipattern engine. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/rspamd

Rspamd 4.1.1

Fri, 19 Jun 2026 14:58:37 GMT

Rspamd 4.1.1 adds pluggable Neural registries, richer CSS text-hiding detection, zip-bomb limits, and new byte-analysis APIs. • Adds pluggable feature-provider and ANN-architecture registries to the Neural module, plus a sequence output mode with SIF word selection for `fasttext_embed`, multi-head attention pooling in kann, and `slice`/`concat` graph transforms in lua_kann. • Enables content-negotiation in checkv3 — representation and compression now negotiated via `Accept`/`Accept-Encoding` headers. • Expands CSS text-hiding detection to cover off-screen positioning, clip, negative text-indent, and tiny fonts. • Adds opt-in zip-bomb extraction limits (size, count, ratio) to `lua_archive` to bound archive expansion. • New byte-distribution statistics methods in `lua_text`: entropy, byte mean/deviation, serial correlation, and Monte-Carlo Pi. • Exposes a zlib/YARA-compatible CRC32 on `rspamd_text`, `rspamd_util`, and cryptobox hash objects. • Adds an explicit SOM (start-of-match) flag to the Multipattern engine. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/rspamd

Rspamd 4.1.0

Fri, 05 Jun 2026 11:45:19 GMT

Rspamd 4.1.0 adds load-aware upstream selection, chain-aware URL redirect caching, /checkv3 metadata headers, hot-reloadable composites, and new Lua/selector APIs. • Adds Power of Two Choices load-aware upstream selection with per-upstream latency EWMA, slow-start on revive, per-target SRV weight/error-budget expansion, and deferred DNS to survive transient startup failures. • Upgrades `url_redirector` with chain-aware intermediate-hop caching, coherent browser fingerprint profiles for stealth resolution, glob-based `redirector_hosts_map`, and a per-URL GET allowlist. • Adds IP-class classification, `bad_mxs`/`bad_ips` trust maps, and per-source checks to `mx_check`. • Exposes custom metadata via metadata headers and task:get_metadata() on the `/checkv3` protocol endpoint. • Adds hot-reloadable dynamic composites map so composite rules update without a full restart. • Extends Lua API with bulk and regexp symbol lookups on `task`; phase-specific (connect/read/write) timeouts and an `on_error` callback for `lua_tcp`; `lua_extras` structured loader for custom selectors, maps, and regexps with cross-kind dependency ordering; and `lua_feedback_parsers` for DSN and ARF reports. • Reports pending async events and stalled symbols when a scan times out, aiding diagnosis of slow scans. • Adds `fuzzy_digest`, `fuzzy_shingles`, `authenticated`, and `received_count` selectors. • Adds ClickHouse named `extra_columns` presets (including an outbound preset) and richer Elastic logs covering Reply-To, received IPs, URL metadata, and forcing module. • Adds per-service `_CHECK` anchor symbol for dependency ordering and eXpurgate engine support in `lua_scanners`. • Adds HTML5 tag definitions (video/audio/picture/svg/…) and optional insertion-ordered HTTP header emission. • Adds `rspamadm control memstat` for per-worker memory dumps covering RSS, mempool callsites, Lua heap, and jemalloc stats; also adds `dmarc_report --batch-wait` and `autolearnstats --sort-by`/`--group` options. • Supports env-overridable baseline pidfile and logging, auto-load of the shipped fasttext model when present, and fixed-point (`%.Nf`) formatting with correct rounding in fpconv. • Discovers rspamd.com fuzzy servers via SRV by default in `fuzzy_check`. Breaking changes: • `mx_check`: `MX_NONE` replaces the former `MX_NXDOMAIN` and `MX_MISSING` symbols; any rules, composites, or actions referencing those old symbol names will stop matching. • `fuzzy_check`: rspamd.com server discovery now uses SRV records by default; setups that rely on hard-coded addresses or override DNS resolution may behave differently. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/rspamd

Rspamd 4.0.1

Sun, 05 Apr 2026 19:31:36 GMT

Rspamd 4.0.1 adds layered settings merge and a dynamic block API for fuzzy storage with custom response codes. • Adds layered collect-then-merge flow for settings, with weak dependencies, disabled status in symcache, and force-enable override for settings conflicts. • Introduces a dynamic block API for the fuzzy storage worker, supporting custom response codes (403 for ratelimits, 503 for bans) and exposing ratelimit_whitelist checks to Lua. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/rspamd

Rspamd 4.0.0

Mon, 30 Mar 2026 12:59:16 GMT

Rspamd 4.0 adds /checkv3 multipart API, HTTPS-native workers, multi-class Bayes, HTML phishing fuzzy hashes, and LLM embeddings. • New `/checkv3` HTTP endpoint uses multipart/form-data requests and multipart/mixed responses with structured JSON/msgpack metadata, per-part zstd compression, zero-copy writev responses, and proxy support. • Hyperscan compilation and caching moved to a pluggable async Lua backend with Redis storage, enabling shared databases across workers and hosts with self-healing stale-blob detection. • Single fuzzy hash can now carry up to 8 flags simultaneously (epoch 12), with multiple rules matching the same digest independently. • New `FUZZY_HTML_PHISHING` symbol detects reused phishing templates where an HTML template matches but link domains differ. • Workers now serve HTTPS natively (auto-detected from bind socket flags), enabling secure WebUI and API without a reverse proxy. • Built-in mmap-based fasttext shim shares model memory across workers via MAP_SHARED, saving ~500 MB–7 GB per host and supporting hot-reload via maps infrastructure. • Native UUID v7 generation per task with ClickHouse UUID v7 column support for cross-system correlation. • Neural module supports external pretrained models with multi-layer funnel architecture, multi-model fasttext embedding with SIF word weighting, and expression-based autolearn for LLM providers. • Bayes classifiers now support arbitrary classes beyond binary spam/ham, with updated WebUI learning UI and new `/bayes/classifiers` endpoint. • Milter add/remove headers and extended symbol info exposed in RSPAMC/SPAMC text protocol for Exim and other legacy clients. • Token bucket load balancing for proxy upstreams with configurable burst parameters. • Ring Hash (Ketama) consistent hashing replaces Jump Hash for Redis sharding with minimal disruption and a `rspamadm statistics_dump migrate` shard migration tool. • ARC `trusted_authserv_id` support for reusing upstream Authentication-Results headers. • Reply-To validity checks added to headers_checks. • Fuzzy hashes stored in Redis history for matched hash tracking. • HTTP content negotiation framework with zstd compression for the `/stat` endpoint. • Attachment filename sub-tokens improve Bayes classifier accuracy. • GPT module adds configurable consensus thresholds and a `context_augment` hook. • New `rspamadm` subcommands: `autolearnstats`, `logstats`, and `mapstats`. • ASCII85 decode support added for PDF extraction. Breaking changes: • Jump Hash replaced with Ring Hash (Ketama) for Redis sharding: run `rspamadm statistics_dump migrate` after upgrading or accept temporary Bayes accuracy loss while data is re-learned (single Redis server setups unaffected). • URLs from PDF and other computed parts are now included by default in task:get_urls(); set `include_content_urls = false` in `local.d/options.inc` to restore old behavior. • The `ssl = true` worker option is removed; SSL is now auto-detected from bind socket flags. • `ENABLE_FASTTEXT` cmake option no longer exists as libfasttext has been replaced with a built-in shim. • SenderScore RBLs are disabled by default (require MyValidity account registration). • Suspicious TLDs are now map-based via `conf/maps.d/suspicious_tlds.inc` instead of a hardcoded list. • Neural autolearn options have been renamed to match RBL module naming conventions. • Token bucket load balancing is now enabled by default for proxy upstreams, replacing simple round-robin. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/rspamd

Rspamd 3.14.3

Thu, 08 Jan 2026 00:00:00 GMT

Rspamd 3.14.3 adds Lua task registry for validation, PDF text extraction for garbage filtering, and extra tables API for the ClickHouse plugin. • Adds a task registry for safe Lua task reference validation. • Adds text quality analysis for PDF garbage filtering with basic PDF text extraction including UTF-16 detection. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/rspamd

Rspamd 3.14.2

Thu, 11 Dec 2025 11:50:23 GMT

Rspamd 3.14.2 adds new metadata export formatters, DMARC RUA re-validation, and selective Authentication-Results header removal. • Adds `multipart`, `msgpack`, and `json_with_message` formatters to the Metadata Exporter for flexible binary and multipart upload support. • New `rspamadm dmarc_report --recheck-rua` flag re-validates cached DMARC report addresses against exclusion maps and RBLs before sending. • New `remove_ar_from` option in Milter Headers enables selective removal of `Authentication-Results` headers targeting specific domains. Breaking changes: • The `meta_headers` option in Metadata Exporter is deprecated in favor of the new formatters (`multipart`, `msgpack`, `json_with_message`). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/rspamd

Rspamd 3.14.1

Mon, 01 Dec 2025 00:00:00 GMT

Rspamd 3.14.1 adds inverted indexes for Composites, rspamadm spf_flatten tool, deep URL processing, and lua_shape validation. • Adds a bloom filter for fast negative symbol lookups in Composites • Adds statistics tracking and control protocol command to Composites • Adds combinator option for selector rules in Multimap • Adds `rspamadm spf_flatten` tool with macro preservation • Adds deep processing architecture for URLs with C-to-Lua filter consultation • Adds obfuscated URL detection to `url_suspect` plugin • Adds `rspamd_util.decode_html_entities` for HTML entity decoding • Adds `lua_shape` validation library as a replacement for tableshape • Adds T.callable() type in lua_shape for function validation • Adds callable defaults support in lua_shape Full history on Cyber Toolchain: https://cybertoolchain.io/tools/rspamd

Rspamd 3.14.0

Tue, 11 Nov 2025 14:08:54 GMT

Rspamd 3.14.0 adds HTML fuzzy hashing, TCP fuzzy protocol, CTA URL detection API, dark mode WebUI, and a Postfix wizard. • Adds structural similarity detection for HTML content via HTML fuzzy hashing, with per-rule text_hashes toggle for HTML-only matching. • Adds full TCP support for the fuzzy protocol with auto-switch from UDP and production-ready connection management. • New task:get_cta_urls() Lua API for call-to-action URL detection, plus hash-based URL deduplication with a 50k URL limit for DoS protection. • Adds HTML URL rewriting infrastructure. • Adds web search context for the LLM plugin with Redis caching. • Adds dark mode to the WebUI with auto-detection. • Adds advanced alias support with loop detection. • Adds Milter ESMTP argument parsing with a new Lua API. • Adds a Postfix wizard for automated Rspamd integration. • Adds configurable Bayes guards for tunable spam-learning behavior. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/rspamd

Rspamd 3.13.2

Tue, 14 Oct 2025 14:11:38 GMT

Rspamd 3.13.2 adds Metadefender hash lookups, LLM user/domain context, Vault KV v2, fuzzy split keys, and DMARC RUA exclusions. • New Metadefender hash lookup module enables file-hash reputation checks against the Metadefender cloud. • Adds user/domain context support for LLM-based email classification, allowing per-user or per-domain tuning of AI-driven decisions. • Supports HashiCorp Vault KV version 2 for secret storage, enabling use of versioned KV secrets in Rspamd configuration. • Adds separate encryption keys for read and write operations in the fuzzy_check module, enabling split-key access control on fuzzy hash storage. • Adds RUA address exclusion support in dmarc.lua, allowing specific reporting addresses to be suppressed from DMARC aggregate reports. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/rspamd

Rspamd 3.13.1

Tue, 30 Sep 2025 10:28:04 GMT

Rspamd 3.13.1 adds encrypted ZIP archive scanning, encrypted maps, and Redis TLS support. • Supports scanning encrypted ZIP archives (both ZipCrypto and AES encryption) via updated Lua bindings using libarchive. • Adds encrypted maps to enable new secure map distribution scenarios. • Enables configurable TLS connections to Redis backends for secure environments. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/rspamd

Rspamd 3.13.0

Wed, 17 Sep 2025 08:01:12 GMT

Rspamd 3.13.0 adds multiclass Bayes, a provider-based neural/LLM fusion engine, and SA-style multimap selector rules. • Adds multiclass Bayesian classification supporting 2–20 named labels (spam, ham, transactional, newsletters, phishing, etc.) with single-Redis-call efficiency, autolearn, and Lua API support via task:get_multiclass_result(). • Overhauls the neural module into a pluggable provider-based architecture combining symbol features, LLM embeddings (OpenAI, etc.), trained normalization (unit/zscore/none), and Redis-backed embedding caching. • Adds SA-style selector rules in the multimap module for regex filtering on message fields, integrated with Hyperscan and the regex cache. • Adds automatic MIME part-type detection and expanded HTML feature extraction for downstream classification modules. • Adds flexible HTTP timeout configuration and upstream probe mode to reduce forced revive operations. • Adds Bayes class management to the WebUI alongside end-to-end scan test flows. • Adds initial support for OpenAI GPT-5 and improved handling of GPT model parameters and prompts in the GPT/LLM integration. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/rspamd

Rspamd 3.12.1

Tue, 17 Jun 2025 09:34:17 GMT

Rspamd 3.12.1 adds a new /bayes/classifiers HTTP endpoint for querying Bayesian classifier state. • Adds `/bayes/classifiers` HTTP endpoint to retrieve Bayesian classifier information via the Rspamd HTTP API. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/rspamd

Rspamd 3.12.0

Wed, 11 Jun 2025 18:28:36 GMT

Rspamd 3.12.0 adds Contextal platform integration, HEIC file detection, new email rules, fuzzy server routing, and WebUI enhancements. • New plugin to integrate with the Contextal platform for advanced content analysis. • Adds detection support for HEIC image files via the magic module. • New `R_HTTP_URL_IN_FROM` rule to detect HTTP URLs in the From header. • New `FREEMAIL_REPLYTO_NEQ_FROM` rule to flag mismatched freemail Reply-To and From addresses. • Adds Sieve and cPanel forwarding symbols for improved forwarding detection. • Supports CDB format for external maps. • Allows specifying the Redis protocol version in configuration. • Allows routing fuzzy operations to different servers per operation type. • Adds exclusion list support for the reputation plugin. • New `--non-default` option for `rspamadm configdump` to show only locally overridden configuration. • Replies module now considers all recipients and uses SMTP-level ones for improved tracking. • WebUI gains a 'Delete hash' button and dedicated UI for deleting specific fuzzy hashes. • WebUI 'Test selectors' panel now supports file upload for selector testing. • Improved maps status visibility in the WebUI Maps table. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/rspamd

Rspamd 3.11.1

Sat, 08 Mar 2025 14:14:53 GMT

Rspamd 3.11.1 adds Ollama/LLM consensus, Redis caching framework, RBL disable-via-map, and expanded fake-reply detection. • Adds Ollama support to the GPT plugin, enabling local LLM-based spam analysis without external APIs. • Supports LLM model consensus, allowing multiple LLM models to vote on a message classification. • Enables LLM usage for anonymization of message content before external analysis. • Adds optional suppression of `response_format` in the GPT plugin to support gpt4all and compatible local models. • Adds GPT plugin support for attaching model reasoning to scan results. • Introduces a Redis caching framework for use across modules, with the GPT module as the first consumer. • Adds a 'noop' Redis backend for running scripts without actual Redis I/O. • Allows RBL (real-time blocklist) rules to be disabled dynamically via a map. • Allows multiple Lua scripts to be loaded for fuzzy storage processing. • Expands detection of fake reply subjects to multiple languages. • Adds the ability to create timers from Lua scripts. • Allows shingles to be stored as opaque Lua data for custom processing. • Adds early map refresh logic when a map's expiry is unexpectedly long. • Adds `images` as a supported check type in RBL `check_types` configuration. • Respects per-map `ipv4` and `ipv6` configuration options for RBL `resolve_ip`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/rspamd

Rspamd 3.11.0

Mon, 16 Dec 2024 14:14:15 GMT

Rspamd 3.11 adds ES8/OpenSearch2 support, ratelimit management utilities, MIME strip command, and message anonymization. • Adds support for Elasticsearch 8 and OpenSearch 2 in the Elasticsearch/OpenSearch plugin. • Adds index policy with log retention support to the Elasticsearch/OpenSearch plugin. • Adds LRU cache for last-filled ratelimit buckets, improving ratelimit performance at scale. • Adds utilities to manage ratelimit buckets directly. • Adds `rspamadm mime strip` command for removing attachments from messages. • Adds new message anonymization capabilities. • Adds include/exclude logic for headers processing. • Adds `lua.local.d` folder and other new ways to extend Rspamd configuration. • Replaces fastutf with simdutf for broader architecture support and improved Unicode performance. • Skips extra RBL checks when the Received IP matches the From IP, reducing redundant lookups. • Multimap now uses only distinct text parts for content matching. Breaking changes: • The Elasticsearch/OpenSearch plugin has a reworked configuration format — existing plugin configuration will break on upgrade. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/rspamd

Rspamd 3.10.0

Mon, 30 Sep 2024 17:51:03 GMT

Rspamd 3.10.0 adds MIME UTF-8 support, fuzzy per-key rate limits, DMARC domain filtering, and OpenSSL 3.0 compatibility. • Adds MIME UTF-8 support for improved handling of international email content. • Adds SenderScore Reputationlist RBL and RPBL return codes to the default RBL configuration. • Supports setting a negative group score limit via `min_score` on score groups. • Adds DMARC `reporting.only_domains` setting to restrict DMARC aggregate reports to specific domains. • Implements individual rate limits per fuzzy key in fuzzy storage. • Supports different operating modes for fuzzy rules. • Adds OpenSSL 3.0 support across cryptographic subsystems including `lua_rsa`. • Allows changing the log tag dynamically from an HTTP request. • Sets a default 5-day expiration for Redis-backed history entries. • Allows manipulations with opaque UCL objects for more flexible configuration handling. • URL-encodes constructed ICAP paths to ensure URL safety. • Supports more flexible keypair encoding formats. Breaking changes: • NIST mode has been removed from the cryptobox; configurations relying on NIST curve support in cryptobox will break. • Control block support has been removed; setups using control blocks will no longer function. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/rspamd

Rspamd 3.9.1

Wed, 31 Jul 2024 09:14:30 GMT

Rspamd 3.9.1 adds special handling of SPF +all (pass-all) records to improve spam detection. • Detects and scores SPF '+all' (pass-all) records specially, flagging domains that publish permissive SPF policies that allow any sender. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/rspamd

Rspamd 3.9.0

Fri, 12 Jul 2024 11:19:12 GMT

Rspamd 3.9 adds JSON syslog logging, file scanning in WebUI, milter header preservation, and customizable bayes expiry • Support JSON logging when in syslog mode • Add `bayes_expiry.conf` to provide ability to set custom settings for bayes filter expiry • Allow to add templates to redis history prefix • [WebUI] Add file input and drop area to scan tab • [Feature] milter_headers: support not removing headers • Upstreams: make `min_resolve_interval` configurable Breaking changes: • Do not report module as action Full history on Cyber Toolchain: https://cybertoolchain.io/tools/rspamd

Rspamd 3.8.2

Tue, 20 Feb 2024 17:23:34 GMT

Rspamd 3.8.2 adds JSON syslog logging, redis history prefix templates, fuzzy storage dynamic keypairs, and `from` map extraction. • Adds JSON logging support when Rspamd runs in syslog mode • Allows adding templates to the Redis history prefix via configuration • Enables dynamic keypair loading for fuzzy storage modules • Adds extraction type support for `from` maps Breaking changes: • Modules are no longer reported as actions in the history/UI (previously displayed as action) Full history on Cyber Toolchain: https://cybertoolchain.io/tools/rspamd

Rspamd 3.8.0

Sat, 20 Jan 2024 12:54:16 GMT

Rspamd 3.8.0 adds JSON logging, per-RBL url_whitelist control, and DMARC suppression for specific recipients • Support JSON logging via `json` module • Support the `ping` command in fuzzy storage protocol • Support suppressing DMARC reporting for particular recipients • Add per-RBL configuration to disable or replace `url_whitelist` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/rspamd

Rspamd 3.7.5

Fri, 15 Dec 2023 00:00:00 GMT

Rspamd 3.7.5 adds `loongarch` platform support. • Adds `loongarch` architecture support for Rspamd deployment Full history on Cyber Toolchain: https://cybertoolchain.io/tools/rspamd

Rspamd 3.7.4

Tue, 14 Nov 2023 15:13:44 GMT

Adds composite URL detection rule and new ZPAQ attachment handling for Rspamd 3.7.4 • `suspicious_url` composite rule detects suspicious URLs in messages flagged with `SUSPICIOUS_HEADERS` • New rule detects messages missing both `X-Mailer` and `User-Agent` headers • Rspamd now treats `*.zpaq` attachments as archives and harmful Full history on Cyber Toolchain: https://cybertoolchain.io/tools/rspamd

Rspamd 3.7.2

Thu, 26 Oct 2023 13:33:55 GMT

Rspamd 3.7.2 adds blank spam detection, controls for inverted action filtering in the WebUI, and configurable RBL matchers. • Adds `blank_spam` rule to detect emails with only whitespace or images, no text content • Adds a WebUI control to invert the action filter for rules results • Introduces a new configuration option for RBL modules to use different matchers for DNS return codes Full history on Cyber Toolchain: https://cybertoolchain.io/tools/rspamd

Rspamd 3.7.1

Sat, 07 Oct 2023 13:55:57 GMT

Rspamd 3.7.1 adds TCP JSON exporter, Redis 6 ACL support, known senders plugin, and numeric RBL checks • Adds `username` and `password` configuration options in the Redis module for ACL-based authentication • Introduces the `known_senders` plugin for tracking and scoring messages from established senders • Enables RBL checks on numeric URLs by adding support for `numeric_urls` inspection in the RBL subsystem Full history on Cyber Toolchain: https://cybertoolchain.io/tools/rspamd

Rspamd 3.6

Thu, 03 Aug 2023 13:59:10 GMT

Rspamd 3.6 adds fasttext language detection, fuzzy hash computation in WebUI, and ip_map strategy for external relay • Adds `fasttext` language detector module to Rspamd for improved language identification • Adds ability to compute fuzzy hashes in the WebUI via the Scan tab • Adds `ip_map` strategy to `external_relay` configuration for controlling relay IP selection Full history on Cyber Toolchain: https://cybertoolchain.io/tools/rspamd

Rspamd 3.4

Tue, 01 Nov 2022 20:28:54 GMT

Rspamd 3.4 adds basic auth to metadata_exporter http pusher and new detection rules for bounce spam and freemmailers. • `metadata_exporter` HTTP pusher now supports basic authentication for remote metric pushing • New detection: 'bounce spam' rule added to penalize bounce-based spam patterns • New composite rule against AFF involving freemailers Full history on Cyber Toolchain: https://cybertoolchain.io/tools/rspamd

Rspamd 3.3

Sun, 02 Oct 2022 22:09:37 GMT

Rspamd 3.3 adds HTTP timeout and map editor settings to WebUI, plus scan_time/hostname in metadata_exporter • Adds `http_async_timeout` setting to control the Ajax request timeout for the WebUI. • Adds `editor` option in the WebUI map configuration to allow choosing a specific map editor. • Adds `scan_time` and `hostname` fields to the metadata_exporter output. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/rspamd

Rspamd 3.2

Fri, 08 Apr 2022 20:47:41 GMT

Rspamd 3.2 adds Hyperscan support for ppc64, a JSON API for maps, ROC-based neural threshold estimation, Cloudmark integration, configurable S3 URLs, WebUI scan options, and enables PCRE2 by default. • Hyperscan for ppc64 (also vectorscan) • JSON endpoint for querying maps • ROC based threshold estimation for neural network plugin • Allow configurable s3 urls • Set one_shot for URIBL rules by default • Enable PCRE2 by default Full history on Cyber Toolchain: https://cybertoolchain.io/tools/rspamd

Rspamd 3.1

Wed, 03 Nov 2021 09:09:34 GMT

Rspamd 3.1 adds autolearn junk_threshold, neural test command, per-bucket ratelimit config, and CDB bayes backend. • Add `junk_threshold` to control autolearn acceptance • Add `neural test` subcommand for model validation • Allow setting fake EICAR patterns in antivirus module configuration • Add Lua API interface for CDB building (`lua_cdb`) • Support per-bucket configurations in ratelimit module • Store structured data in messagepack format when using S3 backend Full history on Cyber Toolchain: https://cybertoolchain.io/tools/rspamd