Why We Built Custom Spam Symbols: Filling the Gap Between Score and Context
Rspamd is one of the best open-source spam scanning engines available. It checks SPF, DKIM, DMARC, URL reputation, content patterns, Bayesian classification, and hundreds of other signals. For most email, it makes the right call.
But there is a gap it cannot fill on its own: sender reputation based on real user behavior.
The gap
Rspamd analyzes the email itself: headers, content, authentication, structure. What it does not know is how actual humans responded to previous emails from that sender. Did people whitelist them? Block them? Mark them as spam?
A brand-new spammer with a freshly registered domain, valid SPF, signed DKIM, and clean HTML will score low on every Rspamd check. The email looks legitimate. But if 15 Cleanbox users have already reported the sender as spam in the past 48 hours, that context changes everything.
The CLEANBOX_* symbols
We wrote a custom Lua module for Rspamd that injects crowd-sourced sender reputation data into the scanning process. Before Rspamd scores an email, our Node.js server queries the feedback database and sends reputation data as custom HTTP headers. The Lua module converts these into scoring symbols:
| Symbol | Score | When it triggers |
|---|---|---|
CLEANBOX_BLOCK | +8.0 | 10+ users reported this sender, 90%+ spam ratio. Near-certain spam. |
CLEANBOX_QUARANTINE | +5.0 | 5+ users reported, 70%+ spam ratio. Very suspicious. |
CLEANBOX_GREYLIST | +2.0 | 3+ users reported, more spam than ham. Worth watching. |
CLEANBOX_TRUSTED | -2.0 | 5+ teams whitelisted or prioritized this sender. Community-validated trust. |
CLEANBOX_UNCOMMON | +1.0 | First-ever contact across all Cleanbox users. No history, slight caution. |
CLEANBOX_BULK_ESP | +0.5 | Sent via known bulk email service provider infrastructure (Mailchimp, SendGrid, Amazon SES, etc.). |
How the network effect works
This creates a feedback loop that gets stronger with every user:
- A spammer sends to 100 Cleanbox users
- The first 3 users report it as spam →
CLEANBOX_GREYLISTactivates (+2.0 for everyone else) - By 5 reports →
CLEANBOX_QUARANTINE(+5.0). Combined with other Rspamd scores, this pushes the total above most quarantine thresholds. - By 10 reports →
CLEANBOX_BLOCK(+8.0). Combined with any other positive signals, this exceeds virtually every reject threshold.
The first few targets take the hit. Everyone after them is protected automatically. The more users Cleanbox has, the faster this response becomes.
The trust side
CLEANBOX_TRUSTED is equally important. When 5+ teams independently whitelist or prioritize a sender, that is a strong signal of legitimacy. The -2.0 score reduction means trusted senders are less likely to be caught by aggressive spam thresholds.
This solves a common false positive scenario: a legitimate sender with slightly unusual headers or formatting triggers enough minor Rspamd rules to push the total above the threshold. The trust score from community whitelisting compensates for those minor triggers.
CLEANBOX_BULK_ESP
The subtlest symbol. A +0.5 score for emails sent via known bulk email service providers. This does not mean the email is spam — many legitimate newsletters use Mailchimp or SendGrid. But bulk ESP infrastructure is also the delivery mechanism for mass spam campaigns. The slight score increase nudges these emails closer to thresholds without blocking them on its own.
Combined with other signals, it helps separate legitimate newsletters (which also have BAYES_HAM, DKIM_ALLOW, and CLEANBOX_TRUSTED) from spam campaigns that happen to use the same infrastructure.
Using symbols in filters
Beyond scoring, all CLEANBOX_* symbols are available as filter conditions. You can create filters like "deny all emails with CLEANBOX_BLOCK" or "move CLEANBOX_BULK_ESP emails to a Marketing folder."
For the full technical breakdown of how spam scoring works in Cleanbox, see Rspamd Spam Symbols Explained.
