Rspamd and Chinese symbol emails

Support
1

We have been getting about 10 a day in emails to a few different users of email with all Chinese symbols in subject line, majority have nothing in body, but not all. We are an english native language company, who does not deal with any Chinese customers, so we know these are spam. Problem is they are never marked as spam, Rspamd marks as clean, and if we move to spam the system never ‘learns’.
Is there a way to force it to mark all non-english emails as spam? Or even just emails with all Chinese in subject?
It wasn’t a huge issue, but one user has now received over 200 of these today.
I noticed in the logs that they all game from qq.com, so I blocked that address in NS system, just not sure if that is best way, especially if some are not qq.com.

2

Put the messages into “spam” folder of every user.
It will help learn the bayesian filter that you are considering that kind of message spam.

3

I have, no difference.
None of these get marked as spam, ever.

4

We need the symbol set by rspamd inside the headers, for example you could increase the weight of a symbol (you can use the rspamd ui) and make this email set as spam or rejected

By the way what are your settings in rspamd (no actions, add headers, reject…)

5

I’ll admit that I know very little about rspamd. I am using it with the default install settings.
It has been working well for us, but do get a few pretty obvious spam get through so I need to learn to use it.

6

open the source of one email or check the history tab insde the UI of rspamd, then check all symbole and score added inside, then paste them here

7

80 pages of rspamd history doesn’t go back far enough unfortunately.
Here is the source of one of emails that did not get marked as spam, not sure if this is what you needed.
https://pastebin.com/a18WW7DU

8

this is what thunderbird output in the source of message, try to find it

X-Mailer: Open-Xchange Mailer v7.6.3-Rev45
X-Originating-IP: 82.127.234.145
X-Originating-Client: open-xchange-appsuite
X-Rspamd-Queue-Id: 36A3118CD64A4
X-Spamd-Result: default: False [-0.47 / 19.90];
	 RCVD_TLS_LAST(0.00)[];
	 HAS_REPLYTO(0.00)[vigand.pierre@orange.fr];
	 HAS_X_PRIO_THREE(0.00)[3];
	 HAS_XOIP(0.00)[];
	 FROM_HAS_DN(0.00)[];
	 FREEMAIL_FROM(0.00)[orange.fr];
	 HAS_ATTACHMENT(0.00)[];
	 FREEMAIL_REPLYTO(0.00)[orange.fr];
	 DMARC_NA(0.00)[orange.fr];
	 MIME_GOOD(-0.10)[multipart/mixed];
	 REPLYTO_EQ_FROM(0.00)[];
	 IP_SCORE(-1.66)[ip: (-3.51), ipnet: 80.12.240.0/20(-3.16), asn: 3215(-1.39), country: FR(-0.22)];
	 MX_GOOD(-0.01)[smtp-in.orange.fr,smtp-in.orange.fr];
	 RCVD_IN_DNSWL_NONE(0.00)[128.242.12.80.list.dnswl.org : 127.0.5.0];
	 MISSING_TO(2.00)[];
	 MIME_HTML_ONLY(0.20)[];
	 R_SPF_NA(1.00)[];
	 FROM_EQ_ENVFROM(0.00)[];
	 R_DKIM_NA(1.00)[];
	 FREEMAIL_ENVFROM(0.00)[orange.fr];
	 ASN(0.00)[asn:3215, ipnet:80.12.240.0/20, country:FR];
	 MIME_TRACE(0.00)[0:+,1:~,2:~,3:~,4:~];
	 BAYES_HAM(-2.91)[99.61%];
	 RCVD_COUNT_TWO(0.00)[2]
9

What I linked above is exactly what is shown in Thurnderbird source as well.

10

fun you have no score :slight_smile: