Allow e-mails from MailChimp user account

jader · October 15, 2025, 10:16am

NethServer Version: 7.9
Module: RSPAMD

Hi

I’m aware NS7 is old/obsolete, but I have one client usiing it.

Now I have a small problem: a BIG supplier of them is sending e-mail using MailChimp and those e-mail are going to SPAM.

I found out some instructions about how to deal with this but not sure if I’ll not break ALL e-mail functions!

The instructions from IA at Google Search

are:

In /etc/rspamd/local.d/multimap.conf or a similar location

custom_header_check {
type = “header”;
header = “X-My-Custom-Header”;
map = “/etc/rspamd/local.d/custom_header_map.map”;
symbol = “CUSTOM_HEADER_SYMBOL”;
}

Then, create /etc/rspamd/local.d/custom_header_map.map with entries like:
Código

^Value-To-Match$    10.0 # Assign a score of 10.0 if header matches

So I think I should create something like that in /etc/e-smith/templates**-custom**/etc/rspamd/local.d/multimap.conf/15MailChimp (not sure if in -custom or not, neither if I create a new 15MailChimp file or just copy the 10base file

/etc/rspamd/local.d/multimap.conf

custom_header_check {
    type = "header";
    header = "X-MC-User";
    map = "/etc/rspamd/local.d/MailChimp.map";
    symbol = "MailChimp";
}

Then, create /etc/rspamd/local.d/MailChimp.map with entries like:
Código

^c24c5deb2f7d246c4e30f8403$    20.0 # Syngenta MailChimp user is NEVER SPAM

I’d like an expert tell me how implement this new MailChimp User filter.

I don’t know if this is fine and do not know how to add another user in filter (just add one extra line with X-MC-User info?

I think this would be GREAT to allow MailChimp trusted users to send e-mail to our clients.

Thanks

Jáder

mrmarkuz · October 15, 2025, 7:33pm

What about allowing the mail domain of the supplier, you could setup a rule to allow all mails from “maildomain.tld”:

jader · October 15, 2025, 8:49pm

Hi Mark

Thanks by your quick answer!

I’ve tried that already ! That’s what I do for all domains who do not use MailChimp, but it do not work in this case!

Of course the message has a “From” header with a syngenta e-mail, but that’s is not usefull, because it could be written there “From: Barak Obama president@usa.com” or anything else. hehehe

A message sent by MailChimp do have a "Received from “ from their own domains, and not from their clients servers @syngenta.com) as you can see at this 3 pieces of message headers, from 3 different date, and those came from different hosts/domains:

Received: from localhost (localhost [127.0.0.1])by mail181.sea101.rsgsv.net (Mailchimp) with ESMTP id 4clsC24GXSzM0frfor carolina@aaaaaaaa.com.br; Mon, 13 Oct 2025 22:16:46 +0000 (GMT)

Received: from localhost (localhost [127.0.0.1])by mail187.wdc02.mcdlv.net (Mailchimp) with ESMTP id 4cL7Pp0LV0zbww7for tecnico4@aaaaaaaa.com.br; Mon,  8 Sep 2025 13:40:46 +0000 (GMT)

Received: from localhost (localhost [127.0.0.1])by mail144.suw14.mcdlv.net (Mailchimp) with ESMTP id 4c2mtz05bLz6ClgZ8for tecnico4@aaaaaaaa.com.br; Thu, 14 Aug 2025 13:54:19 +0000 (GMT)

but all headers have similar content as below:

X-Mailer: Mailchimp Mailer - CID03613cfecc19a87ed186X-Campaign: mailchimpc24c5deb2f7d246c4e30f8403.03613cfeccX-campaignid: mailchimpc24c5deb2f7d246c4e30f8403.03613cfeccX-Report-Abuse: Please report abuse for this campaign here: https://mailchimp.com/contact/abuse/?u=c24c5deb2f7d246c4e30f8403&id=03613cfecc&e=19a87ed186

X-MC-User: c24c5deb2f7d246c4e30f8403

So I need to create a “MailChimp rule” and allow I use last parameter (User ID = X-MC-User) to allow them and reject all MailChimp Users (except SYNGENTA).

Thanks

Jáder

mrmarkuz · October 15, 2025, 9:18pm

Found an old post that shows how to create the custom templates if you want to try it meanwhile, see Blocking email at the tld - #20 by mrmarkuz

I’m going to try it tomorrow…

jader · October 15, 2025, 9:52pm

Hi Mark

Thanks by your tip.

I’ve trying to get this work, but I do not know what to put. See this file:

#
# configure MailChimp 
#

{
if ($rspamd{SpamCheckStatus} eq 'enabled') {

$OUT .= << 'EOF'
MAILCHIMP {
    type = "header";
    map = [
    "${CONFDIR}/mailchimp.map",
    ];
    header = "X-MC-User";
    action = "accept";
    filter = "top";
    symbol = "MAILCHIMP";
    regexp = true;
    description = "Accept Email from Trusted MailChimp Users ID";
}
EOF
}
}

I just do not if this is correct, see ACTION, FILTER and REGEX parameters.

I created a new map file:

[root@agulhao ~]# cat /etc/rspamd/mailchimp.map
^c24c5deb2f7d246c4e30f8403$    20.0 # Syngenta MailChimp user is NEVER SPAM

So I just need to know if FILTER option is correct… and I could try it.

Regards,

Jáder

jader · October 16, 2025, 6:21am

Hi Mark

I’m yet working on this

#
# configure MailChimp 
#

{
if ($rspamd{SpamCheckStatus} eq 'enabled') {

$OUT .= << 'EOF'
MAILCHIMP {
    type = "header";
    map = [
    "${CONFDIR}/mailchimp.map",
    ];
    header = "X-MC-User";
    action = "accept";
    filter = "headers";
    symbol = "MAILCHIMP";
    regexp = true;
    description = "Accept Email from Trusted MailChimp Users ID";
}
EOF
}
}

Note I change the filter option to use HEADERS by reading this Multimap module | Rspamd Documentation

I do not know if this is not CPU intensive because I’ll search for a regex in all headers of all e-mails.

What do you think? It’s ready for a production test ? (sorry no lab to test this right now!)

Regards

Jáder

jader · October 16, 2025, 7:09am

Hi

I think I got it working now!

But because it 4am I’ll let to enable it tomorrow morning…kkkk

edit this file

#
# accept e-mail from trusted MailChimp User ID accounts 
#

{
if ($rspamd{SpamCheckStatus} eq 'enabled') {

$OUT .= << 'EOF'
MAILCHIMP {
    type = "header";
    map = [
    "${CONFDIR}/mailchimp.map",
    ];
    header = "X-MC-User";
    action = "accept";
    filter = "headers";
    symbol = "MAILCHIMP";
    regexp = true;
    score  = -20.0;
    description = "Accept Email from Trusted MailChimp Users ID";
}
EOF
}
}

and add trusted IDs at this file /etc/rspamd/mailchimp.map

[root@agulhao ~]# cat /etc/rspamd/mailchimp.map
^c24c5deb2f7d246c4e30f8403$  # Syngenta MailChimp user is NEVER SPAM

So I went to RSPAMd web interface = http://IP:980/rspamd choose SCAN/LEARN tab, pasted the whole message and try it (scan).

It returned JUST one symbol (MAILCHIMP) with a -20 score…

Please let me know if you’re happy with this solution.

Regards,

Jáder

LayLow · October 16, 2025, 7:23am

Don’t want to muddy the waters, but ever looked at ListMonk ?

mrmarkuz · October 16, 2025, 7:26am

Thanks for sharing the solution, the configuration looks good.

Did you use custom templates to add the files?

jader · October 16, 2025, 12:22pm

Hi LayLow,

Thanks by your response. I’m dealing with a client (a BIG company named SYNGENTA) sending e-mails using MailChimp.

AFAIK your suggestion is a Mailing service. I’m not interested to send them by myself.

Regards,

Jáder

jader · October 16, 2025, 12:32pm

Yes, I’m using a custom-template fragment 15MailChimp.

But the /etc/rspamd/mailchimp.map file is just edited to add new lines…not a template-custom file

BTW: I’m not sure why the rspamd web UI when analizing the original message (w/o new plugin) show a lot of SYMBOLS each one with his weight and when I activate new plugin (mailchimp) it just show ONE symbol (mailchimp) ?

It’s because it has -20 weight (so much weight nothing more matters) or I did something wrong and stopped flow of analisis ?

I’ll try to create an HowTo about filter ANY message header using the Mailchimp as sample and put it available somewhere. I think this could help a lot of people.

mrmarkuz · October 16, 2025, 12:50pm

I think when the first filter action matches and is set to accept, no other filters are applied so there are no other symbols.

I found that for performance it’s better to also set the prefilter=yes, see Multimap module | Rspamd Documentation but I didn’t test…

jader · October 16, 2025, 2:21pm

Hum… lot of things to think about:

should I use “prefilter=yes; “
I thnk so… this way I follow best practices and do the test before
should I leave the “action=accept;”
I think so… this way I get less load (I really wanna to accept that e-mail)
should I use regex or just the ID from MailChimp? How could I do it without using regex (quicker, less CPU intensive)

I’ll try it later (non commercial time) to give less impact on production environment!

Regards,

Jáder

jader · October 16, 2025, 2:48pm

I just created a simple entry on ns7:email [NethServer & NethSecurity] about RSPAMd .

I’ll try it later, but no reason to do not work as expected.

jader · October 16, 2025, 9:59pm

Hi

I just enabled my MAILCHIMP filter and still receiving e-mails… Success.

I’d like to resend same message to verify is working.

This message is received only once a month…I have no patience to wait that long.

How could I resend a received message (I just copied it from user mailbox) to myself or even to original To user?

Regards,

Jáder

mrmarkuz · October 17, 2025, 7:07am

You could use the rspamd web UI to check the symbols or most mail client have an option like “Edit mail as new” which you could try.

For example Roundcube:

jader · October 17, 2025, 11:56am

I’ve used RSPAMD to test message again . It was this way I found about it just quitting after identify it was from a reliable MailChimp account.

I was trying to be sure (today) all MailChimp messages from Syngenta will be accept as non-SPAM.

I think I’ll create a fake message using original headers and sending it thru SMTP using telnet.

Thank you Markus by your support.

Case closed! Bye!