Rules

Composites — turn several weak signals into one clear decision.

A composite rule combines several rspamd symbols with boolean logic into a new, standalone symbol with its own score — the most powerful tool for deliberately combining detection signals, without editing the rspamd configuration by hand.

Why combination rules

A single suspicious trait is often not enough for a clear decision — too many false positives. It's the combination that makes it unambiguous: "RBL hit and no valid DKIM signature" is a far stronger signal than either factor alone. Composites capture exactly these links — with their own name, their own score and full control over how they enter the scoring.

Expression syntax

Composites use the rspamd expression language:

  • & — AND (both symbols must fire), e.g. SPF_FAIL & DKIM_TRACE_FAIL
  • | — OR (at least one), e.g. RCVD_IN_ZEN | RCVD_IN_BARRACUDA
  • ! — NOT (symbol must not fire), e.g. RCVD_IN_ZEN & !DKIM_VALID
  • ( ) — grouping, e.g. (SPF_FAIL | DKIM_FAIL) & !WHITELIST

A concrete example — a known RBL hit without a valid DKIM signature becomes "hard spam":

NMG_RBL_NO_DKIM = RCVD_IN_ZEN & !DKIM_VALID

Policy — what happens to the input symbols

  • leave — input symbols stay in the score (default) — when the composite is an additional signal
  • remove_weight — the input symbols' weights are set to 0 — when the composite "replaces" them and double counting should be avoided
  • remove_symbol — input symbols are removed entirely — when they are irrelevant after evaluation
  • remove_existing — removes the symbols and prevents them firing again — for strict exclusion, typical for whitelist composites

Score direction

  • Positive (e.g. 5.0) — raises the spam score, towards quarantine/reject
  • Negative (e.g. -3.0) — a ham bonus, lowers the score and reduces false-positive risk
  • 0.0 — the composite fires as a visible symbol but does not change the score (useful for observation)

Preconfigured and extendable — without editing config

MailGuard ships builtin composites for typical scenarios (e.g. origin-tag combinations, outbound detection). These can be adjusted in score, policy and active state, but not deleted. You create your own composites through the interface — symbol names follow the pattern [A-Z][A-Z0-9_]{2,63}, and the available rspamd symbols are visible at any time. No access to config files, no restart, no risk of a broken rspamd config.

Detection on your own terms?

Composites combine signals precisely — for fewer false positives and sharper blocks, without touching the rspamd config.

See pricing