Rspamd, an open-source spam-filtering system designed to protect email servers from spam, phishing, and other unwanted messages, has released version 4.3, which fixes several flaws that might cause Rspamd workers to crash or stop accepting connections. These include malformed HTTP headers, empty Deliver-To values, and use-after-free issues affecting Milter sessions.
The release additionally strengthens HTTP connection handling. Previously, pooled connections could be reused without accounting for TLS verification settings or destination addresses. Rspamd 4.3 corrects this and expands protections against requests to local and special-purpose network addresses.
Phishing detection has improved as well. Rspamd now evaluates differences between a link’s displayed address and its actual destination separately from general phishing detection. Plus, new trust maps identify services allowed to rewrite links, while default scoring remains conservative to reduce false positives.
On the authentication side, SPF records are now evaluated in their original order, correcting cases where misordered checks could produce inaccurate results. DKIM verification is also stricter, rejecting duplicate signature tags, invalid key types, and RSA keys shorter than 1024 bits. In addition, ARC verification now applies tighter restrictions when trusting forwarded authentication results.
Rspamd 4.3 also introduces more detailed SMTPUTF8 address validation, including checks for Unicode normalization, internationalized domain names, and invalid characters. New symbols distinguish malformed ASCII addresses from those containing invalid eight-bit characters.
Attachment inspection has improved to detect suspicious files more reliably. Archive scanning now handles alternative filenames correctly, preventing attackers from hiding executable files behind extra archive entries. Filename checks also account for trailing spaces, dots, and other naming tricks that could disguise executable extensions.
For HTML emails, parsing improvements make it harder to hide suspicious content using CSS rules, excessive HTML elements, or malformed markup. A new HTML_TINY_PIXEL_TRACKER rule identifies messages with little meaningful content but tiny external tracking images, a technique sometimes used to probe whether email addresses are active.
Finally, administrators should be aware that some changes can affect existing filtering configurations. In particular, separating URL mismatch scoring from phishing detection, stricter SPF and DKIM validation, and changes to symbol option formatting may require adjustments to custom rules.
For more information, see the Rspamd 4.3 release notes.
