Analytics & Impact

The Overview dashboard is your at-a-glance home for traffic health: volume by time range, action distribution (reject/add-header/greylist/no-action), and top-firing symbols across your deployment.

One screen shows you whether traffic is within expected bounds, which actions are dominating, and what's driving your scan decisions.

SPF, DKIM and DMARC pass-rate cards with per-protocol donuts show the authentication hygiene of your inbound mail — which senders fail, and how those failures track with spam verdicts.

Volume-by-hour and volume-by-weekday bars, split spam versus ham, reveal the rhythm of your mail stream: the off-hours bursts that abuse operations favour, and the traffic shape that tells you when a spike is real.

Is traffic volume normal? What's my reject rate? Which symbols are firing most today? What's our DMARC pass rate, and when does spam hit hardest?

Overview surfaces the immediate signals operators need: traffic spikes, action drift, authentication posture, and the symbols that are shaping your verdicts.

The Detection Impact module analyses your scan history to answer a simple question: did this detection layer change the outcome?

For each layer, the dashboard separates how often it fires from how often it actually decides the verdict. A feed that fires on most of your traffic but rarely changes an outcome scores low; a niche rule that fires seldom but consistently tips messages over the line scores high where it counts.

Is this feed pulling its weight? Are my RBLs redundant? Would dropping this composite rule affect my false negative rate?

Raw hit counts can't answer these questions. A high-volume feed might be redundant if another layer already catches those messages. A low-volume feed might be decisive if it targets edge cases nothing else touches.

Identify zero-impact feeds and disable them to reduce latency. Find redundant RBLs and consolidate. Tune scores based on actual contribution, not hit rate.

The What-If simulator lets you propose score changes and see the replayed impact before you change anything in production.

Pick any symbol from 300+ in your Rspamd configuration and see its complete operational profile: hits per day, hit rate, reject percentage, score distribution, and which other symbols fire alongside it.

The co-firing list shows which symbols commonly appear together — use this to understand rule interaction and find redundant composites.

Why is the Bayes classifier scoring so low on this domain? Which symbols co-fire with my new custom rule? Is this FP caused by symbol interaction?

Symbol Introspect links these questions to data. You can see the time series for a symbol, inspect the distribution of its scores, and understand its behaviour in context.

The 'Capture mail with this symbol' button creates a stream filter that catches messages where this symbol fires. Use this to build targeted investigation streams without manual rule authoring.

The Score Evaluation panel shows the distribution of message scores and how they cluster around action thresholds. Spot threshold pressure, score inflation, and verdict shifts before they affect users.

See histograms of scores by action, track score drift over time, and understand how your tuning decisions reshape the score landscape.

Are scores clustering too close to the reject threshold? Has score inflation shifted our effective threshold? What's the score distribution for greylisted messages?

Score Evaluation visualises the shape of your verdicts — essential for understanding how tuning changes affect real traffic.

When scores cluster near the threshold, small changes in symbol weights can cause large verdict swings. The panel shows you this clustering so you can tune proactively.

Compares live verdicts against confirmed ground-truth labels from a feedback table: false positive, false negative, true positive, and true negative. Measures real accuracy, not just symbol hit rates.

The panel shows accuracy metrics over time, error breakdowns by symbol, and confusion matrices. See which detection layers contribute most to FP/FN.

Replay re-runs every labelled message through your live configuration, so you can see what a tuning change actually fixed: now-correct versus still-wrong, split by FP and FN, with the still-wrong samples sorted closest-to-threshold.

What's our real accuracy? Which symbols cause the most FPs? Are we improving or regressing?

Ground-truth comparison answers these questions with data, not assumptions. Symbol-level error attribution shows you exactly what's driving mistakes.