NethServer Version: NethServer 7.9.2009
Module: rspamd 2.5
Good Afternoon Nethserverianer, i have a question about the general possibilità per reject Emails by subject. i got a lot emails with the same subject like your plan for investizione is ready but the mail adresses are all completely different and from different servers. it would be easy to stop it by subject, but didn’t find a possibility.
Let’s ask @stephdl the master-in-knowledge of nethserver-mail-filter. 
multimap is the key
/etc/rspamd/local.d/multimap.conf, you need a custom fragment
https://rspamd.com/doc/modules/multimap.html#map-filters
the idea could be to create a map (file), then you add one topic per line to reject when found inside.
thank you Stephen, i will give it a try
i would like to understand this. i got spam messages and the bayes recognized it as spam. but there is no reaction from the spam filter. it says 97,46% Spam but no reaction.
when i then try to learn/scan the message from the rpamd it says it should be rejected, but it did not do it.
maybe there are some wrong options at my side?
Could you post the code you added to the multimap.conf please, we need to start the debug
Good Morning Stephen,
i did not change the multimap.conf because i thought the baysan filter would act as filter. cause when one of this emails arrive, they are not recognized as spam, if i do the manual learn as spam, the filter directly says spam and would reject it, but the rspamd does not do it automaticly, and this is the point where i thought to ask. for my understanding the system shoud be rejecting the mails, or not?
The message above should not be in your email box, the score of 52 should have triggered the action reject. If the email is dropped to your inbox then maillog is the way to see what happened, search the rspamd ID of the full transaction and show it to us
At the end you need to show us what rspamd settings you use, sometimes a misconfiguration can explain it
this is what i thought also, but it act exactly that way. this is an email from an hour ago
this should now the complete mail with, at least, the entry of the maillog. the mails going into the normal email box.
Read carefully what I wrote please hucky, we need the full maillog transaction of rspamd for this email, you have an ID that you can grep
I tend to never trust human, only logs
this is a full log transaction
sorry if i dont was able to understand completely what you want. i thought the log above is the log with everything from this one email, i generate it from the mail.log of rspamd by the emailadress. i will try to figure out to make it that way you want.
check my example, we need to state what it happened, you have not only rspamd but dovecot and postfix and probably other services.
No problem, just help us to help you 
