rspamd Whitelis/Blacklist per domain before filtering

since I'm sadly not getting any responses in rspamd's GitHub discussion board, maybe someone here has experience with rspamd prefilter mode.

I'm trying to get rspamd to accept any mail coming from a given list of domains, no matter how much it thinks it's spam. Sadly, this is necessary as too many people think it's a good idea to manipulate senders or do other shady things, usually used by people having something to hide. This should be easiest to accomplish with the prefilter mode, as those are supposed to run before even evaluating if the mail is spam or not. As an added bonus, this could also be used for a block list if some notorious spam mails simply don't get recognized. Of course, rspamd can be taught what should be spam and what not, but that doesn't seem to be effective enough. Also, in logs, I can't figure out why it refuses to apply the prefilters for most domains , so maybe one of you has a suggestion.

Right now I'm using the multimap configuration to set up the prefilters for the accept and block list. So in local.d/multimap.conf I have:

ACCEPTLIST_SENDER_DOMAIN {
      #type = "header";
      #header = "from";
      type = "from";
      prefilter = "true";
      filter = "email:domain";
      map = "file:///etc/rspamd/local.d/acceptlist.sender.domain.map";
      description = "Sender domain is on allowed";
      action = "accept"; # Prefilter mode
  }

BLOCKLIST_SENDER_DOMAIN {
      #type = "header";
      #header = "from";
      type = "from";
      prefilter = "true";
      filter = "email:domain";
      map = "file:///etc/rspamd/local.d/blocklist.sender.domain.map";
      symbol = "BLOCKLIST_SENDER_DOMAIN";
      description = "Sender domain is on blocked";
      score = 10.0;
      action = "add_header"; # Prefilter mode
  }

The two comments at the top of each block is from when I tried to filter for header and then the from header, but since you can directly filter for that I tried this one, it doesn't help though. Also, I tried adding the files in map with both just the path and file:///path/to/file, still no success either way. The rspamd.log also doesn't show anything helpful (only error constantly showing up is about not being able to load dkim key, as I'm not able to disable that module). Copying this config to overwrite.d also doesn't help. Any ideas?

I'm on Debian 11 running rspamd 3.4-1~bullseye straight from the rspamd repo.

My last answer does help quite a bit, but overall I have found some issues still unsolved:

for some reason it still adds ACCEPTLIST_SENDER_DOMAIN for a domain I deleted a while ago from the map file. I even restarted rspamd multiple times, but it refuses to forget about that domain. And I can't find any cache that I could delete that would help.

Adding to this, the multimap is supposed to accept mails coming from specified domains no matter what. But only when the domain is in the From: header, not in any other case. The domain I previously falsely added to the whitelist was the domain of our mailing list. So rspamd should never have accepted those mails in the first place based on the multimap, as no mailinglist of ours will replace the From: header with its own address. But still, many spam mails get still marked as spam, even if in theory they should be excluded by the false ACCEPTLIST_SENDER_DOMAIN. For now, I've re-added the prefilter=true; to the multimap config, maybe this will help. But all in all, rspamd still doesn't behave as expected.

EDIT: to solve the first problem I've switched back to explicitly check the From: header, as type:from will check the envelope from before checking this, so this should be much more reliable (of course it's quite simple to modify the From header but I can count the incidents this happened in the past years that haven't been caught by our main spam filter on one hand):

ACCEPTLIST_SENDER_DOMAIN {
      type = "header";
      header = "From:";
      prefilter = true;
      map = "/etc/rspamd/local.d/acceptlist.sender.domain.map";
      symbol ="ACCEPTLIST_SENDER_DOMAIN";
      description = "Sender domain is on allowed";
      action = "accept"; # Prefilter mode
  }

BLOCKLIST_SENDER_DOMAIN {
      type = "header";
      header = "From:";
      prefilter = true;
      map = "/etc/rspamd/local.d/blocklist.sender.domain.map";
      symbol = "BLOCKLIST_SENDER_DOMAIN";
      description = "Sender domain is on blocked";
      action = "add_header"; # Prefilter mode
  }

But for some reason mails have the following in their header once these symbols are triggered:

X-Rspamd-Pre-Result: action=no action;
    module=multimap;
    Matched map: ACCEPTLIST_SENDER_DOMAIN

Action in this case clearly should be "accept", as stated in the config. This is how it looks like in the config dump:

multimap {
    ACCEPTLIST_SENDER_DOMAIN {
        action = "accept";
        map = "/etc/rspamd/local.d/acceptlist.sender.domain.map";
        description = "Sender domain is on allowed";
        symbol = "ACCEPTLIST_SENDER_DOMAIN";
        prefilter = true;
        type = "header";
        header = "From";
}
    BLOCKLIST_SENDER_DOMAIN {
        action = "add_header";
        map = "/etc/rspamd/local.d/blocklist.sender.domain.map";
        description = "Sender domain is on blocked";
        symbol = "BLOCKLIST_SENDER_DOMAIN";
        prefilter = true;
        type = "header";
        header = "From";
}
    [...]
}

I don't think that there should be any quotes around the prefilter value :

prefilter = true;

Also, configuring a score in a prefilter map may be useless as the action is already enforced.

I hope it helps !

@cz.steve I've now built everything back to use rspamd as SpamAssassin wasn't warking the way I wan to either. Now the changes do enable the white- and blacklisting, although not exactly the way I inteded it to work. What I wanted was that it matches the given domains only to what's in the From: header, not in all other headers too. Is it possible to achieve that?

Right now my configuration is this:

ACCEPTLIST_SENDER_DOMAIN {
      type = "from";
      filter = "email:domain";
      map = "/etc/rspamd/local.d/acceptlist.sender.domain.map";
      symbol ="ACCEPTLIST_SENDER_DOMAIN";
      description = "Sender domain is on allowed";
      action = "accept"; # Prefilter mode
  }

BLOCKLIST_SENDER_DOMAIN {
      type = "from";
      filter = "email:domain";
      map = "/etc/rspamd/local.d/blocklist.sender.domain.map";
      symbol = "BLOCKLIST_SENDER_DOMAIN";
      description = "Sender domain is on blocked";
      action = "add_header"; # Prefilter mode
  }

This should work. I managed to implement exactly what you want. My local.d/multimap.conf contains:

For accepting mails from pecific domains

WHITELIST_SENDER_DOMAIN {
      type = "from";
      filter = "email:domain";
      map = "/${LOCAL_CONFDIR}/local.d/whitelist.sender.domain.map";
      symbol ="WHITELIST_SENDER_DOMAIN";
      description = "WHITELIST map for SENDERS Domain - Action accept";
      action = "accept";
  }
# For rejecting domains
BLACKLIST_SENDER_DOMAIN {
      type = "from";
      filter = "email:domain";
      map = "/${LOCAL_CONFDIR}/local.d/blacklist.sender.domain.map";
      symbol ="BLACKLISTED_DOMAIN";
      description = "Blacklist map for Senders Domain - Action reject";
      action = "reject";
  } 

You need to create the mentioned map files in local.d with the exact same name and populate them with the domain names what you want to filter. Only one domain name per line! The files should have read permission.

Also, note that if an action is set on a message most further checks should be skipped.