Set up Rspamd spam filtering and DKIM signing with Postfix

Rspamd is a fast, modern spam filter that scores every message using many checks – SPF, DKIM, DMARC, blocklists, Bayesian learning, fuzzy hashes – and can also DKIM-sign outgoing mail. This guide connects Rspamd to a Postfix mail server.

Before you start

• A working Postfix (and ideally Dovecot) mail server with root access.
• At least 1–2 GB of free RAM for Rspamd and Redis.
• A local DNS resolver such as Unbound is recommended, because public resolvers are often blocked by DNS blocklists.

Install Rspamd and Redis

1. Add the official Rspamd repository for your distribution (instructions on the Rspamd website), then install:
   Copy

   sudo apt install -y rspamd redis-server

   On AlmaLinux/Rocky use sudo dnf install -y rspamd redis after adding the repo.

2. Start both: sudo systemctl enable --now redis rspamd (Redis service may be redis-server on Debian/Ubuntu).

Basic configuration

Put local settings in /etc/rspamd/local.d/ – never edit the main files.

1. redis.conf:
   Copy

   servers = "127.0.0.1";

2. actions.conf (scores are examples – start conservative):
   Copy

   reject = 15;
   add_header = 6;
   greylist = 4;

3. milter_headers.conf:
   Copy

   use = ["x-spamd-bar", "x-spam-level", "authentication-results"];

4. classifier-bayes.conf:
   Copy

   autolearn = true;

Connect Postfix

Add to /etc/postfix/main.cf:

smtpd_milters = inet:127.0.0.1:11332
non_smtpd_milters = inet:127.0.0.1:11332
milter_default_action = accept
milter_protocol = 6

Reload with sudo systemctl reload postfix. milter_default_action = accept keeps mail flowing if Rspamd is down.

Enable DKIM signing

1. Generate a key:
   Copy

   sudo mkdir -p /var/lib/rspamd/dkim
   sudo rspamadm dkim_keygen -s mail -d example.com -k /var/lib/rspamd/dkim/example.com.mail.key | sudo tee /var/lib/rspamd/dkim/example.com.mail.txt
   sudo chown -R _rspamd:_rspamd /var/lib/rspamd/dkim

   The user is rspamd on some systems.

2. In local.d/dkim_signing.conf:
   Copy

   path = "/var/lib/rspamd/dkim/$domain.$selector.key";
   selector = "mail";
   allow_username_mismatch = true;

3. Publish the TXT record from the .txt file at mail._domainkey.example.com.
4. Restart Rspamd and send a test to a mailbox that shows headers; look for dkim=pass.

Web interface

1. Set a password: rspamadm pw, and put the hash in local.d/worker-controller.inc as password = "HASH";.
2. The UI listens on 127.0.0.1:11334. Reach it through an SSH tunnel or a password-protected reverse proxy – don't expose it publicly.

Move spam to Junk and train the filter

• Use Dovecot's Sieve plugin to file messages with an X-Spam: Yes header into Junk.
• Use Dovecot's imapsieve to call rspamc learn_spam/learn_ham when users move mail into or out of Junk.

Troubleshooting

• No Rspamd headers on mail: check the milter line in Postfix and journalctl -u rspamd.
• Too much legitimate mail rejected: raise reject, and check the symbol breakdown in the web UI history.
• DNSBL checks always fail: use a local resolver instead of public DNS.
• Test the config: rspamadm configtest.

FAQ: Rspamd

Rspamd or SpamAssassin?

Rspamd is faster and includes DKIM/ARC signing and a web UI; SpamAssassin is older and well integrated into panels like cPanel and Plesk.

Does Rspamd need Redis?

It works without it, but Bayes learning, greylisting and rate limits depend on Redis.

Can Rspamd scan for viruses?

Yes, by connecting to ClamAV through its antivirus module.

Next steps

• Set up Dovecot with Postfix
• Unbound local DNS resolver
• SPF, DKIM and DMARC explained