---
title: "rspamd — Sender Whitelist and BAYES Data Reset in Mailcow"
aliases: [rspamd-whitelist, rspamd-bayes-reset, mailcow-spam-whitelist, rspamd-score-override]
tags: [rspamd, mailcow, email, spam, whitelist, bayes, selfhosted]
sources:
  - "daily/2026-05-08.md"
created: 2026-05-08
updated: 2026-05-08
---

# rspamd — Sender Whitelist and BAYES Data Reset in Mailcow

When a legitimate sender is blocked by rspamd (Spamhaus SBL, BAYES_SPAM, or other rules), the fastest fix is to add the sender domain to rspamd's whitelist with a large negative score override. If BAYES has already been trained on the domain's messages as spam, that training data must also be cleared.

## Key Points

- rspamd whitelist assigns a score override — a score of `-100` overrides all positive rule scores and guarantees delivery.
- Spamhaus SBL (blocklist) and BAYES_SPAM are independent signals; both must be addressed.
- BAYES training data is per-domain in Mailcow's rspamd Redis instance.
- The whitelist file lives inside the `rspamd` Docker container at `/etc/rspamd/local.d/`.
- Mailcow UI also exposes a whitelist (Mailcow Admin → Spam Filter → Whitelist) but the file-based approach gives score control.

## Whitelisting a Sender Domain

### Via Mailcow Admin UI

1. Mailcow Admin → **Spam Filter** → **Whitelist**
2. Add the domain (e.g. `axilaccountants.co.uk`) — sets score to a permissive threshold.

### Via rspamd config file (score override)

```bash
# Enter the rspamd container
docker exec -it mailcowdockerized-rspamd-mailcow-1 bash

# Create or edit the whitelist map
cat >> /etc/rspamd/local.d/whitelist_sender_domain.inc << 'EOF'
axilaccountants.co.uk
EOF

# Or use the multimap config for a score override
cat >> /etc/rspamd/local.d/multimap.conf << 'EOF'
WHITELIST_SENDER_DOMAIN {
  type = "from";
  filter = "email:domain";
  map = "${CONFDIR}/local.d/whitelist_sender_domain.inc";
  score = -100.0;
  description = "Trusted sender domains";
}
EOF
```

Reload rspamd after changes:

```bash
docker exec mailcowdockerized-rspamd-mailcow-1 rspamadm control reload
```

## Clearing BAYES Training Data

If BAYES_SPAM has been trained on a domain's messages, those weights persist in Redis and will continue scoring future messages as spam even after whitelisting.

```bash
# Connect to rspamd Redis
docker exec -it mailcowdockerized-redis-mailcow-1 redis-cli

# List all BAYES keys (to identify the scope)
KEYS bayes*

# Clear BAYES corpus for a specific sender
# rspamd uses hashed tokens — easiest fix is resetting the entire BAYES corpus
# (only do this if the corpus is small / mostly incorrect)
FLUSHDB
```

> **Warning:** `FLUSHDB` resets ALL BAYES training. On an established server, prefer per-message retraining via `rspamc learn_ham` instead.

### Retraining as Ham

```bash
# From outside the container, pipe the EML through rspamc
cat message.eml | docker exec -i mailcowdockerized-rspamd-mailcow-1 \
    rspamc learn_ham
```

## Verifying the Whitelist Works

Send a test email from the whitelisted domain and check rspamd logs:

```bash
docker logs mailcowdockerized-rspamd-mailcow-1 --since 5m | grep axilaccountants
```

Look for `WHITELIST_SENDER_DOMAIN` in the symbol list and a negative total score.

## Related Concepts

- [[wiki/concepts/apple-mail-trust-junk-headers]] — even with rspamd fixed, Apple Mail can still auto-delete if "Trust junk mail headers" is enabled
- [[wiki/concepts/dovecot-expunge-irreversible]] — emails deleted before whitelisting are gone permanently without a backup
- [[wiki/concepts/mailcow-maildir-import]] — procedure for importing recovered emails back into Mailcow

## Sources

- [[daily/2026-05-08.md]] — axilaccountants.co.uk blocked by Spamhaus SBL + BAYES_SPAM 93.84%; domain whitelisted with score -100; BAYES data cleared for the domain
