About Rmilter
Introduction
Rmilter is used to integrate rspamd and milter
compatible MTA, for example Postfix or Sendmail. It also performs other useful functions for email filtering including:
- Virus scanning using Clamav
- Spam scanning using Rspamd
- Greylisting using redis storage
- Ratelimit using redis storage
- Replies check (whitelisting replies to sent messages)
- Passing certain messages to redis pub/sub channels
- DKIM signing
Rmilter project page can be found on GitHub: http://github.com/vstakhov/rmilter.
Rmilter configuration
Rmilter configuration format is described in the following page.
Postfix settings
Here is a scheme that demonstrates Rspamd and Rmilter integration using Postfix MTA:
There are several useful settings for postfix to work with this milter:
smtpd_milters = unix:/var/run/rmilter/rmilter.sock
milter_mail_macros = i {mail_addr} {client_addr} {client_name} {auth_authen}
milter_protocol = 6
Useful rmilter recipies
This section contains a number of useful configuration recipes and best practices for Rmilter.
Setup DKIM signing of outcoming email for authenticated users
With this setup you should generate keys and store them in /etc/dkim/<domain>.<selector>.key
This could be done, for example by using opendkim-genkey
:
opendkim-genkey --domain=example.com --selector=dkim
That will generate dkim.private
file with private key and dkim.txt
with the suggested TXT
record for your domain.
dkim {
domain {
key = /etc/dkim;
domain = "*";
selector = "dkim";
};
header_canon = relaxed;
body_canon = relaxed;
sign_alg = sha256;
};
Please note, that Rmilter will sign merely mail for the authenticated users, hence you should also ensure that {auth_authen}
macro
is passed to milter on MAIL FROM
stage:
milter_mail_macros = i {mail_addr} {client_addr} {client_name} {auth_authen}
Setup whitelisting of reply messages
It is possible to store Message-ID
headers for authenticated users and whitelist replies to that messages by using of Rmilter. To enable this
feature, please ensure that you have redis
server running and add the following lines to Redis section:
redis {
...
# servers_id - redis servers used for message id storing, can not be mirrored
servers_id = localhost;
# id_prefix - prefix for extracting message ids from redis
# Default: empty (no prefix is prepended to key)
id_prefix = "message_id.";
}