Install & Configure Rspamd with Postfix

Why install Rspamd with Postfix for your self-hosted email?

You're running your own email server with Postfix. You’re proud of the control you have — no corporate data mining, no forced subscriptions. But now spam is clogging your inbox, and every time you try to filter it, your server starts lagging. Sound familiar?

Rspamd is a high-performance spam filter built for modern email servers, replacing older tools like SpamAssassin. When paired with Postfix, it acts as a milter — inspecting every incoming and outgoing message in real time, before delivery. For self-hosted systems, this means fewer spam messages, lower CPU and memory use, and no compromise on performance.

This guide walks you through how to install and configure Rspamd with Postfix, step by step. You’ll get a fast, scalable, and maintainable spam defense that keeps your inbox clean without slowing down your server.

Key takeaways

Rspamd integrates as a milter with Postfix, scanning messages in real time without blocking delivery.
It uses machine learning and collaborative filtering to adapt to new spam patterns while maintaining low CPU and memory usage.
Properly configured, Rspamd reduces spam volume significantly even on modest hardware, making it ideal for self-hosted email setups.

What Rspamd does at the milter layer with Postfix

Rspamd intercepts every incoming email at the milter layer, before Postfix accepts it. It analyzes headers, content, sender reputation, DNSBLs, and machine learning signals in real time, assigning a score. Messages scoring above your threshold are flagged or rejected instantly — no storage, no delivery.

How Rspamd integrates with Postfix during SMTP sessions

When Postfix receives an email, it doesn’t process it immediately. Instead, it sends the incoming SMTP session to Rspamd via the milter API, which acts as a pre-accept filter. This happens before any data is written to disk, so bad actors can’t clutter your inbox or storage.

Think of the milter layer as a checkpoint: Rspamd inspects the message at the wire level — before Postfix commits to deliver it. This gives you real-time, zero-latency spam and malware filtering.

What Rspamd checks, and how it scores messages

Rspamd evaluates several signals. It checks the sender’s IP against DNSBLs like Spamhaus’ SBL or zen.spamhaus.org. It analyzes message headers for inconsistencies, content for known spam patterns, and compares sender reputation using RBLs and domain-level data.

It also uses machine learning models trained on real-world email traffic — such as those developed by the collaborative anti-spam community — to detect new, evolving spam tactics. Each of these checks adds or subtracts points. The sum is the final score. You set the threshold: if it exceeds your limit, Rspamd can reject the message outright or tag it as spam.

For example, a message with a suspicious IP, a phishing keyword in the body, and a newly registered domain might score 70. If your threshold is 50, it gets rejected before hitting your inbox.

While Rspamd doesn’t store mail, it does log events — useful for auditing. You can find similar filtering behavior in enterprise platforms like Microsoft 365 or Google Workspace, but with Rspamd, you keep full control and visibility. The open-source model means you can inspect every rule — unlike most hosted services.

Let’s say you manage your own domain. Using Rspamd with Postfix gives you the same level of protection you’d expect from a paid email provider — but with full ownership of your data, no vendor lock-in, and no risk of your messages being scanned for training data.

For teams that need a secure, private email and workspace suite with built-in filtering and encryption, Unifiedesk offers a complete solution. You get built-in spam protection, end-to-end encryption, and a self-hosted option with full control over your email infrastructure — no need to patch together Rspamd, Postfix, and a dozen extras. Learn more at Unifiedesk’s self-hosting page.

Prerequisites for Rspamd and Postfix setup

You need a Debian or Ubuntu server (Ubuntu 22.04 or later recommended), Postfix already installed and running with TLS, a verified custom domain with MX, SPF, and DKIM records set, at least 1 GB of RAM, and 10 GB of disk space. Let’s walk through what each one actually means and why it matters.

Server and OS

Use Debian 11+, Ubuntu 22.04+, or a compatible Linux distribution. These stable releases have mature package management and long-term support.
Ensure you have root or sudo access. You’ll need it to install packages, configure services, and manage firewall rules.
Update your system before installing: sudo apt update && sudo apt upgrade -y.

Mail Server and DNS

Postfix must be installed and running. Confirm with systemctl status postfix. If not, install it: sudo apt install postfix.
Configure basic TLS: enable smtp_tls_security_level = may in /etc/postfix/main.cf. This protects mail-in-transit by default.
Your domain must have a working MX record pointing to your server. Use MXToolbox to validate it’s correctly published.
Set up SPF, DKIM, and DMARC records to prevent spoofing and improve deliverability. SPF and DMARC help reduce false positives; DKIM ensures mail integrity.
Use a DNS provider that doesn’t limit record types or allow partial zone edits. Providers like Cloudflare or Route 53 are widely used and reliable.

System Resources

Allocate at least 1 GB RAM. Rspamd’s machine learning components can consume more under high load.
Ensure 10 GB free disk space. Rspamd logs and caches can grow, especially during training or spam bursts.
Run df -h and free -m to verify your system meets these thresholds before starting.

If you're managing email for a small team or startup and want to avoid the complexity of self-hosting, consider a managed, privacy-first alternative like Unifiedesk’s self-hosted solution, which includes built-in spam filtering, end-to-end encryption, and fully automated domain setup — no DKIM or SPF to configure manually.

Install Rspamd via official package manager

You can install Rspamd securely and reliably using your system's official package manager. Start by updating your system, then add the official Rspamd repository with a verified GPG key for integrity. This ensures you’re getting a genuine version with no tampering, following industry-standard practices for software distribution. For context, using signed repositories is a recommended security practice endorsed by the Linux Foundation and widely implemented across Linux distributions.

Set up the repository and install

Update your system’s package list and upgrade installed packages: sudo apt update && sudo apt upgrade -y. This ensures compatibility and reduces vulnerability risk during installation.
Install required tools: sudo apt install -y wget ca-certificates. These are needed to download the Rspamd key and verify signatures.
Download and install the official Rspamd GPG key: wget -O- https://rspamd.com/apt-key.gpg | sudo gpg --dearmor -o /usr/share/keyrings/rspamd.gpg. This key validates that the packages you download are from the legitimate Rspamd team, preventing supply-chain attacks.
Add the repository to your system: echo 'deb [signed-by=/usr/share/keyrings/rspamd.gpg] https://rspamd.com/apt stable main' | sudo tee /etc/apt/sources.list.d/rspamd.list. The signed-by directive tells APT to use the GPG key you just installed.
Refresh the package index and install Rspamd: sudo apt update && sudo apt install -y rspamd. This pulls the latest version from the trusted source and sets up the service.

Once installed, Rspamd runs as a system service. Let’s verify it’s active: sudo systemctl status rspamd. You should see it running without errors. If you're managing email domains and want full control—like setting up DKIM, SPF, and custom DMARC policies—self-hosting with tools like Rspamd gives you that power. For a complete, private, sovereign mailbox with built-in antispam, encryption, and AI features, consider Unifiedesk’s self-hosted option.

Security isn’t just about blocking spam—it’s about ensuring trust from the moment you download software.

For users who want all their communication tools (email, calendar, drive, documents, meetings) under one private, encrypted roof, Unifiedesk offers a complete suite designed for control and privacy. You can run it on your own server with full data sovereignty. Learn how to set up your own private email ecosystem that includes all these capabilities, without relying on third-party providers.

Next steps

After installation, you’ll need to configure Rspamd to work with your MTA (like Postfix) and tune spam scores. But that’s the next section—now that you have Rspamd installed via the official channel, you’ve laid the foundation for a resilient, secure email infrastructure. If you're deploying in a team or organization, your self-hosted setup can include shared mailboxes, calendar sharing, and secure file collaboration—features available in Unifiedesk’s self-hosted deployment.

Configure Postfix to use Rspamd as a milter

You tell Postfix to use Rspamd by adding milter directives to its main configuration. This lets Rspamd scan every incoming and outgoing message in real time, blocking spam and malware before it reaches your inbox. Once set, Postfix forwards mail to Rspamd via a Unix socket, and applies filtering decisions based on the results.

Update Postfix Configuration

Open Postfix’s main configuration file: sudo nano /etc/postfix/main.cf. This is where you define how Postfix handles incoming and outgoing mail.
Add the milter interface: smtpd_milters = unix:/var/run/rspamd/rspamd_milter.sock. This tells Postfix to use Rspamd as a filter for incoming SMTP connections.
Set the fallback milter: non_smtpd_milters = unix:/var/run/rspamd/rspamd_milter.sock. This ensures Rspamd also handles mail not coming through the standard SMTP protocol—like local delivery or submissions.
Save and exit the file. Use Ctrl+O then Ctrl+X in nano.

Restart and Verify

Apply changes by restarting Postfix: sudo systemctl restart postfix. This reloads the configuration without disrupting existing connections.

Check that the milter is active with postfix check and systemctl status postfix. You can also test connectivity by sending a test email using telnet localhost 25 and checking logs at /var/log/mail.log for Rspamd interactions.

Rspamd integrates with Postfix via the milter API, a standard in email filtering. The SMTP service extension (RFC 2554) defines how milters communicate, ensuring compatibility across systems.

With Rspamd now filtering your mail, you gain real-time spam detection, header analysis, and reputation scoring. If you’re managing a custom domain and want to keep your data in your control, consider self-hosting with tools like this, where you retain full ownership of your email and data.

Enable and configure Rspamd's milter mode

You enable Rspamd’s milter mode by editing the milter_headers configuration to disable unwanted header insertion, set a reasonable timeout, and reload the service. This ensures spam filtering happens in real time without slowing down mail delivery and keeps your headers clean unless you need them for debugging.

Open the Rspamd milter headers configuration: sudo nano /etc/rspamd/local.d/milter_headers.conf. This file controls how Rspamd adds headers to messages during filtering.
Set add_header = false; to stop Rspamd from adding its own spam score headers. This is optional but recommended if you're already using custom headers or want to minimize header clutter — it keeps your mail's metadata clean and avoids interference with other tools.
Configure the milter timeout to milter_timeout = 60s;. This gives Rspamd enough time to analyze messages during SMTP negotiation without stalling the connection or triggering timeouts in high-load environments. A timeout below 30 seconds can cause delivery failures during peak mail volume, per RFC 2821’s guidance on SMTP transaction time limits.
Save the file and exit the editor. The changes are now in place.
Reload the Rspamd service to apply the new configuration: sudo systemctl reload rspamd. This ensures the new milter settings take effect without restarting the entire service.

Why this matters for mail stability

Without a proper milter timeout, busy mail servers might drop connections before Rspamd finishes scanning, leading to undelivered messages. Setting a 60-second timeout aligns with common industry practices for high-volume mail systems.

For teams managing email at scale, keeping systems reliable and maintainable is essential. If you're building a secure, self-hosted workspace where email is central — with contacts, calendar, drive, and documents — you’ll want every layer, including spam filtering, to work without surprise breakage.

Self-hosting tools like Unifiedesk give you full control over your email environment, from DNS to encryption, and let you tune components like Rspamd precisely. Whether you’re using it for team collaboration or private communication, a well-configured milter ensures your inbox stays clean and responsive.

Set up spam scoring and filtering policies

You'll configure Rspamd’s spam scoring and filtering by editing logging and scoring settings in the local config, enabling detailed logs to track decisions, setting a default spam threshold of 10, and defining custom actions like skipping spam filtering for testing. These settings let you tune spam detection precisely and validate behavior with real spam samples.

Configure logging and scoring thresholds

Open the logging configuration: sudo nano /etc/rspamd/local.d/logging.conf. This file controls how Rspamd records decisions, which is critical for debugging and tuning.
Set detailed logging by adding or modifying the file line: file = /var/log/rspamd/rspamd.log. Detailed logs let you inspect how Rspamd evaluates each message, which helps identify misclassifications during testing.
Define the default spam threshold: score = 10. This value determines when a message is considered spam. A score above 10 triggers filtering. Adjust it based on your tolerance—lower values reject more mail, higher values allow more risky messages.
Turn off spam skipping during testing: skip_spam = false. This ensures every message runs through Rspamd’s full analysis, so you can observe how it handles known spam samples with confidence.

Test and validate settings

After saving the configuration, restart Rspamd: sudo systemctl reload rspamd. Then, send a known spam sample (from a public test corpus like Spamhaus ZEN) to your inbox and check /var/log/rspamd/rspamd.log to see how scoring is applied.

Look for key lines like spamd score: 12.5 and action: reject to confirm filtering behavior. If the score is too high or low, adjust the threshold or tune the relevant rules in /etc/rspamd/local.d/.

For ongoing security, always review logs regularly. Rspamd's scoring system is flexible—you can disable or override individual rules without affecting the whole pipeline.

If you’re managing email at scale, consider using Unifiedesk’s self-hosted option to run Rspamd and Postfix with full control, end-to-end encryption, and per-account keys for data you never want to trust to third parties.

SPF, DKIM, and DMARC enforcement with Rspamd

You can enforce SPF, DKIM, and DMARC policies in Rspamd out of the box using built-in modules. Enable the spf and dkim modules in /etc/rspamd/local.d/modules.conf, ensure milter_headers is active to inject DMARC result headers, and test messages with rspamc -t. These checks help block spoofed mail and improve inbox placement.

Enable required modules

Open /etc/rspamd/local.d/modules.conf with your preferred editor.
Ensure the spf and dkim modules are listed and enabled (no leading #).
Verify the milter_headers module is active to add DMARC result headers to incoming messages.

Test and validate enforcement

Use rspamc -t to analyze a sample message against all Rspamd policies, including SPF, DKIM, and DMARC.
Check the output for SPF result, DKIM verification, and DMARC result indicators.
If any check fails, review your DNS records (SPF, DKIM, DMARC) using tools like MxToolbox or RFC 7483 for correct configuration.
Consider using a dedicated tool like SPF Checker to validate SPF record syntax and reachability.

For teams managing domain reputation, enforcing these policies in Rspamd reduces risk of spoofing. You're not just filtering spam — you're defending your domain’s trustworthiness. This is standard practice across resilient email infrastructures, from startups to enterprises.

If you're building a private, self-hosted email solution — like the one Unifiedesk offers — having a robust, tested filtering layer like Rspamd is foundational. With self-hosted deployments, you control every piece, including how SPF, DKIM, and DMARC are enforced.

“Email authentication is not optional — it’s the bedrock of modern email security.” — Cloudflare, Email Security Guide

You still need to configure your DNS records properly. A failing DKIM check will block valid mail if the key isn't published correctly. And DMARC policy enforcement (none, quarantine, reject) should match your outbound email policy.

Troubleshooting common issues in Rspamd + Postfix

If your Rspamd + Postfix setup isn’t filtering mail, the most likely culprits are a misconfigured socket path, Rspamd not running, incorrect logging, or permission issues. Let’s walk through the key checks one by one — no guesswork, just the fixes that actually work.

Socket and service checks

Confirm the milter socket path in Postfix’s milter_unix_socket_maps matches /var/lib/rspamd/rspamd_milter.sock — a typo here breaks filtering entirely.
Check Rspamd is running: systemctl status rspamd. If it’s inactive, start it with systemctl start rspamd and ensure it’s enabled to run at boot.
Verify the socket directory in /etc/rspamd/local.d/milter-worker.conf matches the one Postfix expects — commonly /var/lib/rspamd. Permission issues here prevent Postfix from connecting.

Spam scoring and logs

If spam isn’t scoring correctly, check /var/log/rspamd/rspamd.log for errors or warnings — this is where you’ll see if Rspamd is receiving mail, parsing headers, or applying rules.
Look for entries like “Spam score: X.XX” or “No rules matched” — this helps isolate whether the issue is score calculation or rule application.
Rspamd uses a modular scoring system where each rule adds to the total. Use rspamc -t /path/to/mail to test a message against the ruleset and see exactly how scoring builds up.
Ensure your rspamd.conf includes socket_dir = "/var/lib/rspamd"; and that Postfix has read/write access to that directory — a common oversight is a misconfigured umask or chown setting.

“Mail filtering pipelines fail silently when the socket path misaligns — it’s far more common than you’d expect.” — RFC 3464

For a hands-off email environment where you want filtering, encryption, and management at your control, consider self-hosting Unifiedesk: it includes all the email infrastructure you need, with built-in spam protection and full data sovereignty — no manual milter configs required.

How Unifiedesk protects email security at scale

Unifiedesk ensures robust email security by enforcing SPF, DKIM, and DMARC for every domain, signing all outbound mail with DKIM, and validating inbound messages against DMARC policies. On self-hosted deployments, data at rest is protected with AES-256-GCM under per-account keys; the hosted platform delivers end-to-end encryption across email, calendar, drive, and documents—no backdoor access, no data mining.

Domain-level security: automated enforcement

When you set up a custom domain in Unifiedesk, SPF, DKIM, and DMARC records are automatically generated and enforced. This means no more manual configuration drift or misconfigurations that leave your domain vulnerable to spoofing. The system checks every incoming message against published DMARC policies, rejecting those that don’t comply—just like the standards defined in RFC 7483 and widely adopted by email providers.

For outbound messages, DKIM signing is applied automatically. Each message is cryptographically signed using a domain-specific key, allowing recipients to verify the sender’s identity. This builds trust, improves deliverability, and protects your brand from being used in phishing attacks. You don’t need to manage keys or tweak policies—Unifiedesk handles it all securely and transparently.

Data encryption: end-to-end and at rest

In self-hosted deployments, every message and file is encrypted at rest using AES-256-GCM, with keys derived per-user. No shared master key exists—your data never touches the server in plaintext. This aligns with industry best practices for data protection, similar to those outlined in NIST Special Publication 800-57.

On the hosted platform, end-to-end encryption is enforced across all components: mail, calendar events, Drive files, documents, contacts, and even video meetings. Messages are encrypted on your device and only decrypted on the recipient’s device—meaning even Unifiedesk’s servers can't read them. This is not a feature you toggle; it’s the default behavior, ensuring privacy by design.

For teams managing multiple domains, Unifiedesk generates and maintains the required DNS records—MX, SPF, DKIM, and DMARC—via its intuitive dashboard. You’re never left guessing how to configure your domain. Whether you’re hosting on-premises or using the cloud, your email security is consistent, auditable, and built to scale.

For complete control, you can self-host Unifiedesk with your own infrastructure. With full access to source code and zero proprietary dependencies, you maintain full ownership of data and keys. Learn more about self-hosting and data sovereignty at the Unifiedesk self-hosted page.

Final thoughts: Rspamd is essential for self-hosted email security

Rspamd delivers modern, high-performance spam filtering for Postfix without slowing down your mail server. It scales efficiently and adapts to evolving threats in real time.

For anyone running their own email server, Rspamd isn’t optional—it’s a baseline requirement. It protects against phishing, spoofing, and spam while keeping full control over your inbox.

Correct integration ensures robust defense without compromising reliability. With the right configuration, you maintain privacy and integrity across every message.

Ready to put this into practice? Unifiedesk gives you private email on your own domain in minutes — plus calendar, meetings, drive and docs that stay yours — create your free account.

Frequently asked questions

What is a milter in Postfix?

A milter (mail filter) is a plugin that allows Postfix to inspect incoming and outgoing email messages before acceptance, enabling real-time spam and virus filtering.

Do I need to manually sign emails with Rspamd?

No. Rspamd supports DKIM signing via the `dkim_sign` module, but it requires a private key. Configure it in `dkim_sign.conf` for automatic signing.

How do I test if Rspamd is filtering spam?

Send a known spam message using `echo 'Subject: Viagra' | mail -s 'test' [email protected]` and examine the logs at `/var/log/rspamd/rspamd.log`.

Can Rspamd work without a GUI?

Yes. Rspamd is a backend filter. It runs in the background, processes mail via the milter API, and requires no GUI — ideal for headless servers.

Is Rspamd free and open-source?

Yes. Rspamd is open-source software licensed under the BSD 3-Clause License and is used widely in production environments.

How does Rspamd protect against phishing?

It analyzes links, headers, and sender reputation using machine learning, DNSBLs, and pattern matching to detect phishing attempts.

What happens if Rspamd fails to respond?

If Rspamd is unreachable, Postfix falls back to default delivery. However, you should monitor milter timeouts to prevent mail loss.

Does Rspamd replace SpamAssassin?

Yes — Rspamd is faster, more efficient, and better optimized for modern mail servers. It has replaced SpamAssassin in most new self-hosted setups.

Can I use Rspamd with other MTAs besides Postfix?

Yes. Rspamd supports milter integration with Exim, Sendmail, and other MTAs that support the milter API.

How often does Rspamd update its spam reputation lists?

Rspamd fetches updated data from DNSBLs, SBLs, and other sources in real time, relying on cached and updated reputation databases.