LoginSign Up
← Back to all sparks
R

Rspamd

COMMS
Velocity5.0

Fast spam filtering system for mail servers

rspamd.com ↗

Rspamd 4.3 fixes SPF evaluation order and rejects weak DKIM keys, with results that change.

spam filteringemail authenticationinput hardeningattachment extractionmemory safety
◆Current state
Rspamd 4.3.0 on November 13 is a correctness release with a long incompatible-changes list. SPF records are now evaluated in term order, closing a case where an explicit -ip4 deny could be overridden by a broader allow. DKIM rejects RSA keys under 1024 bits and signatures with duplicate tags, DMARC no longer drops a policy over an unknown tag, URL mismatches are scored apart from phishing, and PDF text extraction and archive unpacking change their output. Critical fixes cover a header line that could abort a worker from one unauthenticated HTTP request.
◆Where it's heading
Since 4.1, every release has hardened parsers and closed memory-safety and trust gaps; 4.3 applies the same pass to the authentication standards themselves (SPF, DKIM, DMARC, ARC) and to content extraction. Operators should expect scores and fuzzy hashes to shift after upgrading, because the project now favours spec-correct results over backward-compatible ones.
◆Prediction
A 4.3.x point release fixing regressions from these behaviour changes is the likely next step, as 4.2.1 followed 4.2.0 within two weeks.

◆Recent moves

  1. 21h ago

    4.3.0: SPF order fix, stricter DKIM, new truncation symbols

    4.3.0 brings the hardening of the 4.2 line to email authentication: SPF evaluated in term order, weak DKIM keys rejected, DMARC parsing fixed, plus symbols that flag truncated or unreadable attachments. Its many incompatible changes mean scores move after upgrade.

    View source ↗
  2. 24d ago

    4.2.3: ARC trust fix, merged RBL queries, browser-style HTML parsing

    Fixes a real trust gap, where a whitelisted forwarder with a broken ARC seal could still lower DMARC, and brings HTML parsing closer to browsers. RBL scoring also changes, so a rule now counts once per matched value.

    View source ↗
  3. 1mo ago

    4.2.2: crypto wallet detection and changed MIME digests

    Wallet-address detection replaces bitcoin.lua and extends to twelve named currencies with one symbol each. The MIME digest change is the upgrade risk, since anything keyed on old digests stops matching.

    View source ↗
  4. 1mo ago

    4.2.1: critical HTTP and memory-safety fixes

    A security release flagged as strongly recommended: an HTTP heap overflow, a use-after-free and a cryptobox change that now fails closed. It extends the 4.1.x audit into the new line.

    View source ↗
  5. 1mo ago

    4.2.0: public suffix lookup and attachment content extraction

    The largest release in this window, with a public suffix component, attachment extraction and a single symbol scheduler. It adds detection depth while carrying the hostile-input work forward.

    View source ↗
  6. 3mo ago

    Closes an arbitrary file read reachable by any TCP client

    Continues the input-hardening pass that has run through every 4.1.x release, this time gating File, Path and Shm message sources behind a flag that defaults on now and off in the next major — a deliberate deprecation path rather than a silent break. The fuzzy subsystem gains sender authentication facts shared with storages, and the PDF parser learns font-aware decoding, both extending components rebuilt earlier in the cycle.

    View source ↗