Rspamd 4.2 has been released as a major update to the open-source spam filtering system, bringing better phishing detection, faster URL processing, improved attachment scanning, and several WebUI enhancements.
One major improvement is expanded inspection of email attachments. Rspamd can now analyze SVG, XLSX, PPTX, and DOCX files more deeply and detect suspicious elements like external links, embedded scripts, macros, remote resources, and other content used in phishing campaigns.
SVG files receive particular attention in this release as well, with Rspamd now able to analyze visible text, links, redirects, forms, embedded content, and remote resources instead of treating them simply as image files.
On the URL processing side, according to the developers, public suffix lookups are about seven times faster, and the new implementation improves support for more complex domain suffix rules.
Moreover, Rspamd 4.2 changes how filtering rules are scheduled internally. The previous separate processing stages are replaced with a single execution plan, making rule dependencies more predictable. Administrators can inspect the order using the new rspamadm configdump -e command.
DKIM handling is also refined. Messages with a valid DKIM signature now get an additional benefit when the signing domain matches the sender domain, helping distinguish properly authenticated mail from messages signed by unrelated domains.
The WebUI has several useful improvements. Administrators can now more easily check fuzzy storage health, view improved Bayes statistics, monitor server latency and uptime, and spot version or configuration differences between servers in a cluster.
ClickHouse users also get new indexing improvements designed to speed up searches for items such as senders, Message-IDs, IP addresses, URLs, subjects, and attachment hashes.
Finally, the release includes reliability and security fixes, including better limits when parsing untrusted data and fixes for crashes and race conditions involving filtering maps.
More details are available in the official Rspamd 4.2 changelog.
