Frequently Asked Questions
Every operational question we're asked about Rspamd Console. Something missing? Ask us directly.
Does my mail content leave my network?
That depends on your LLM setup. The dashboard itself runs within your infrastructure — scan data writes to your ClickHouse; streams and cached LLM responses store in your Redis. Mail content is sent to an LLM provider only by the features you explicitly enable, and with a self-hosted model everything stays in-house.
Which Rspamd versions are supported?
Rspamd 4.1 and later, with ClickHouse logging enabled and the controller worker reachable from the dashboard.
Does it require ClickHouse?
Yes. ClickHouse stores the scan data that powers the detection impact, symbol introspect, and overview panels. This is the same ClickHouse you may already use for Rspamd analytics.
Do I need to migrate my existing Rspamd cluster?
No. Rspamd Console drops into your existing Rspamd cluster — single-node or HA — and uses the Redis and ClickHouse you already run. No data leaves your network.
Can I run it air-gapped?
Yes. The dashboard containers run entirely within your infrastructure. Only LLM features require external API calls, and you choose when and what to send.
Does it work with my Redis Sentinel setup?
Yes. The dashboard shares the same Redis as your Rspamd instances, and Redis Sentinel is supported for high-availability configurations.
Will it work with my ClickHouse setup?
Yes. The dashboard works with your existing ClickHouse. Contact us for guidance on large or sharded deployments.
What's the Rspamd-side install — a plugin? a sidecar?
No patches, no custom builds — Rspamd Console works with your existing Rspamd instances. A small drop-in plugin package adds the capture-stream and learn-queue endpoints; everything else is read from your existing ClickHouse and Redis through the controller API.
Does it write to Rspamd at all, or read-only?
Scan data is read-only. Learn operations (Bayes, Neural, Fuzzy) go through Rspamd's controller HTTP API, and the Maps editor writes to HTTP-served map files that Rspamd polls — no configuration files are touched.
How does it handle multi-tenant deployments?
Multi-tenancy is built in. Organizations in your identity provider map onto tenants: their users sign into the same console and see only their own traffic — statistics, captured streams, message lifecycle — while you keep the global view and administer tenants centrally. Isolation is derived from how each message is attributed at scan time, not from interface-level filtering, and every tenant can tune its own policy within limits you define. All of it runs on the shared infrastructure you already operate — no per-tenant stacks.
Authentication — built-in, or behind my SSO?
Authentication and role-based access control are built in. You can also place the dashboard behind your own reverse proxy with SSO integration if required.
Backup / DR?
Your ClickHouse and Redis backups cover dashboard state. If you use the Maps editor, include the maps directory in your file backups. No other backup requirements beyond your existing infrastructure.
Upgrade path?
Container image updates via your deployment system. Major version upgrades may require a brief config review.
Can my own automation or AI agents operate it?
Yes. The console exposes a Model Context Protocol (MCP) endpoint — disabled by default — that gives an agent exactly what the UI can do: inspect traffic, evaluate rules, preview a policy change, file a block for approval. There is no privileged side door: agent calls pass through the same roles, the same verify-by-rescan semantics and the same audit trail as an operator's clicks.
Can I extend the dashboards / write my own panels?
Panel extension is on the roadmap. Contact us if you have specific requirements.
What's the support model?
Rspamd Console includes email support with defined SLAs and a dedicated support channel.
Which LLM models are supported?
The dashboard is model-agnostic and works with the major LLM providers — Anthropic, OpenAI, Google and others. Your administrator chooses which providers are available and can restrict the list to the ones you approve. Each of the console's LLM tasks — interactive prompts, auto-triage verdicts, one-time-code confirmation, campaign analysis, and the adversarial action judge — can be pointed at its own model and its own API key; leave either blank to inherit the deployment default. Changes take effect within a worker cycle, without a restart.
Does my captured mail content go to the LLM provider?
Only through LLM features you enable, and never raw payloads. Interactive Ask LLM sends the decoded message text and scan results when you click it on a specific message; optional automated analyses — such as image analysis of borderline mail — run only if you turn them on, under a spend budget you set. The provider choice is yours, and responses are cached in your own infrastructure so repeat lookups don't re-send anything.
Can I write my own LLM prompts?
Yes. Alongside the curated presets, the Ask LLM panel has a "Custom prompt" mode. Your custom prompts are saved in your browser, and results are cached so identical requests aren't sent twice.