Rule Authoring & Tuning

Edit Rspamd maps directly in the dashboard with syntax highlighting for regex, SA-style lists, composites, and blocklists. Save changes and Rspamd picks them up on the next poll — no Rspamd reload required.

The Symbols in this file panel shows which symbols reference the map, so you can see the impact of your changes before you save.

Which symbols use this map? What does the composites file look like? Can I edit this blocklist without SSH?

The Maps editor answers these questions with an in-browser editor. No file access, no Rspamd reload — edit, save, and the change propagates via HTTP.

Manual map editing requires SSH, file access, and Rspamd reload. The Maps editor runs in your browser with syntax highlighting and validation.

HTTP-served maps mean hot-reload. Rspamd polls the endpoint on its existing schedule — no restart, no reload, no service interruption.

Regex maps, multimap files, composites expressions, IP blocklists, domain blocklists, mail-from blocklists — all supported with syntax highlighting and validation.

Simulate weight and threshold changes against historical traffic before you commit. The What-If simulator replays your scan data with proposed scores and shows the predicted impact on verdicts.

Test a symbol weight change, threshold adjustment, or composite expression modification. See how many messages would flip from reject to allow — or vice versa.

If I lower this threshold, how many FPs will I introduce? What happens if I disable this RBL? Will my new composite cause collateral damage?

What-If answers these questions with data from your actual traffic. No guesswork, no production testing.

The simulator shows predicted verdict changes before you touch your production config. Validate a tuning decision against replayed traffic, then commit with confidence.

Build a selector from the node's live registry, test it against a real message, and add it to the Selector Grid with a weight — without memorising selector syntax.

The extractor and transform lists are fetched from the running node, so custom extractors you have deployed appear automatically, each with its own inline documentation. A raw-edit toggle drops you into the expression as text whenever the builder gets in your way.

Paste a raw message, or pick one straight out of a capture stream, and evaluate: the constructor shows you what the selector actually extracts from it. One click then deploys the finished selector as a scoring rule.

The loop from 'I noticed a pattern' to 'the rule is live' never leaves the browser.

When the built-in extractors don't reach far enough, author a selector in Lua. The console signs it with Ed25519 and stores it; the scanner verifies that signature before it will load the code.

Once loaded, a custom selector behaves like any other — use it in the Constructor, in the Selector Grid, or as a clustering key.

Custom selectors are executable code running inside your scanner. The private signing key lives only in the console's environment, so gaining write access to the shared state store is not enough to inject code the scanner will run.

Extensibility without turning your data store into a remote-code-execution surface.

Selector Grid is a rules engine that builds scoring rules from lua_selectors value sets. One click turns a cluster or stream observation into a deployed scoring rule — no syntax, no config files.

Define selectors (from-domain, ASN, header fingerprint, URL pattern), set match conditions and scores, and ship the rule. Rspamd picks it up via HTTP poll.

How do I turn this cluster into a rule? Can I score based on ASN? What's the fastest way to ship a header-fingerprint rule?

Selector Grid answers these questions by turning observations into rules without touching Rspamd config files.

The Clusters panel shows a pattern. Click 'Create Selector Grid rule', define the selector and score, save. The rule is live. No rspamd.conf, no reload — the rule propagates via HTTP.