Mail Server Integration

We recommend three configuration profiles depending on your risk tolerance:

Policy	Description	Rejects on	Tags/Scores on
🟢 Conservative (Default)	Minimal false positives. Only reject on strong evidence.	127.0.0.3 (spam high), .4 (malware), .5 (phishing), .6 (botnet), .9 (manual)	127.0.0.2 (spam low), .7, .8
🟡 Balanced	Good trade-off between security and deliverability.	127.0.0.3–.9 (all listed)	127.0.0.2 (spam low)
🔴 Aggressive	Maximum protection. May cause false positives.	127.0.0.2–.9 (all codes)	—

Our recommendation: Use Conservative. The 127.0.0.2 (spam low confidence) code should be used for scoring, not rejecting. This minimizes false positives while still protecting against confirmed threats.

Conservative (Recommended)

# /etc/postfix/main.cf
smtpd_recipient_restrictions =
    permit_mynetworks,
    permit_sasl_authenticated,
    reject_unauth_destination,
    # Reject only high-confidence spam, malware, phishing, botnet, manual block
    reject_rbl_client dnsbl.provider.tools=127.0.0.3,
    reject_rbl_client dnsbl.provider.tools=127.0.0.4,
    reject_rbl_client dnsbl.provider.tools=127.0.0.5,
    reject_rbl_client dnsbl.provider.tools=127.0.0.6,
    reject_rbl_client dnsbl.provider.tools=127.0.0.9,
    # Low-confidence spam: warn only (adds header)
    warn_if_reject reject_rbl_client dnsbl.provider.tools=127.0.0.2

Aggressive

# Reject ALL listed IPs (including low-confidence)
smtpd_recipient_restrictions =
    permit_mynetworks,
    permit_sasl_authenticated,
    reject_unauth_destination,
    reject_rbl_client dnsbl.provider.tools

Configuration

# /etc/rspamd/local.d/rbl.conf
rbls {
  providertools {
    symbol = "RBL_PROVIDERTOOLS";
    rbl = "dnsbl.provider.tools";
    ipv6 = true;
    returncodes {
      RBL_PROVIDERTOOLS_SPAM_LOW = "127.0.0.2";
      RBL_PROVIDERTOOLS_SPAM_HIGH = "127.0.0.3";
      RBL_PROVIDERTOOLS_MALWARE = "127.0.0.4";
      RBL_PROVIDERTOOLS_PHISH = "127.0.0.5";
      RBL_PROVIDERTOOLS_BOTNET = "127.0.0.6";
      RBL_PROVIDERTOOLS_EXPLOIT = "127.0.0.7";
      RBL_PROVIDERTOOLS_ABUSE = "127.0.0.8";
      RBL_PROVIDERTOOLS_MANUAL = "127.0.0.9";
    }
  }
}

# /etc/rspamd/local.d/rbl_group.conf - Conservative scoring
symbols {
  "RBL_PROVIDERTOOLS_SPAM_LOW"  { weight = 3.0; description = "Spam (low confidence) on provider.tools"; }
  "RBL_PROVIDERTOOLS_SPAM_HIGH" { weight = 7.0; description = "Spam (high confidence) on provider.tools"; }
  "RBL_PROVIDERTOOLS_MALWARE"   { weight = 10.0; description = "Malware on provider.tools"; }
  "RBL_PROVIDERTOOLS_PHISH"     { weight = 10.0; description = "Phishing on provider.tools"; }
  "RBL_PROVIDERTOOLS_BOTNET"    { weight = 10.0; description = "Botnet on provider.tools"; }
  "RBL_PROVIDERTOOLS_EXPLOIT"   { weight = 5.0; description = "Exploit/Scanner"; }
  "RBL_PROVIDERTOOLS_ABUSE"     { weight = 4.0; description = "Abuse/Policy"; }
  "RBL_PROVIDERTOOLS_MANUAL"    { weight = 10.0; description = "Manually blocked"; }
}

Note: With Rspamd, keep the weight for SPAM_LOW at 3.0 (below reject threshold). This means low-confidence spam adds to the score but won't cause rejection on its own.

# /etc/spamassassin/local.cf

# Base rule
header   RCVD_IN_PROVIDERTOOLS eval:check_rbl('providertools', 'dnsbl.provider.tools.')
describe RCVD_IN_PROVIDERTOOLS Listed on provider.tools DNSBL

# Category-specific sub-rules
header   RCVD_IN_PROVIDERTOOLS_SPAM_LOW eval:check_rbl_sub('providertools', '127.0.0.2')
describe RCVD_IN_PROVIDERTOOLS_SPAM_LOW Spam (low confidence) on provider.tools
score    RCVD_IN_PROVIDERTOOLS_SPAM_LOW 2.5

header   RCVD_IN_PROVIDERTOOLS_SPAM_HIGH eval:check_rbl_sub('providertools', '127.0.0.3')
describe RCVD_IN_PROVIDERTOOLS_SPAM_HIGH Spam (high confidence) on provider.tools
score    RCVD_IN_PROVIDERTOOLS_SPAM_HIGH 6.0

header   RCVD_IN_PROVIDERTOOLS_MALWARE eval:check_rbl_sub('providertools', '127.0.0.4')
describe RCVD_IN_PROVIDERTOOLS_MALWARE Malware on provider.tools
score    RCVD_IN_PROVIDERTOOLS_MALWARE 10.0

header   RCVD_IN_PROVIDERTOOLS_PHISH eval:check_rbl_sub('providertools', '127.0.0.5')
describe RCVD_IN_PROVIDERTOOLS_PHISH Phishing on provider.tools
score    RCVD_IN_PROVIDERTOOLS_PHISH 10.0

header   RCVD_IN_PROVIDERTOOLS_BOTNET eval:check_rbl_sub('providertools', '127.0.0.6')
describe RCVD_IN_PROVIDERTOOLS_BOTNET Botnet on provider.tools
score    RCVD_IN_PROVIDERTOOLS_BOTNET 10.0