Knowledgebase

Overview

The RelayCountry plugin enables administrators to adjust spam scoring thresholds for email traffic relayed through specific geographic regions. This guide provides instructions for configuring country-based scoring, verifying plugin functionality, and analyzing traffic sources within the Warden interface.

Prerequisites

A valid MaxMind API key and synchronized GeoIP databases are required before configuration. For registration and database download procedures, refer to the official documentation: MaxMind License Key Setup.

Configure RelayCountry Scoring

1. Navigate to Warden > Settings > Plugin Settings > RelayCountry.
2. Select the target countries and assign them to the Bad relay countries list.
3. Configure the scoring threshold:
   • Maintain the default Bad relay score of 3.25 for moderate scoring adjustments.
   • Set the Bad relay score to 10.0 to automatically classify all mail from these countries as spam.
4. Click Update to save and apply the configuration.

Verify Plugin Functionality

Enable verbose mode in Amavis to monitor rule matching and confirm proper plugin operation. Detailed instructions are available here: Enable Verbose Mode in Amavis.

Once enabled, expand the message log entry using the plus icon. A successful match will display a relaycountry identifier:

relaycountry=RU

In this example, traffic is being relayed through Russia (RU). Additionally, verify that the RELAYCOUNTRY_BAD rule appears in the matched rules list for flagged messages.

Lookup Country by IP Address

After the MaxMind databases are synchronized, administrators can resolve an IP address to its corresponding country directly within Warden:

1. Locate the target message in the log.
2. Click the client addr field.
3. Select information from the context menu to view geolocation details.

Add Relay-Country Header to Messages

To append the X-Spam-Relay-Countries header to all processed messages, modify the SpamAssassin and Amavis configuration files:

1. Open /etc/mail/spamassassin/local.cf. Within the ifplugin Mail::SpamAssassin::Plugin::RelayCountry block, insert the following directive:

add_header all Relay-Countries _RELAYCOUNTRY_

Edit the Amavis configuration file based on your operating system:

• AlmaLinux/CloudLinux/RHEL: /etc/amavisd/warden.conf
• Debian/Ubuntu: /etc/amavis/conf.d/99-warden

Add the following line immediately before the 1; # ensure a defined return statement:

$allowed_added_header_fields{lc('X-Spam-Relay-Countries')} = 1;

Restart the Amavis service to apply changes:

// AlmaLinux/CloudLinux/RHEL
systemctl restart amavisd

// Debian Ubuntu
systemctl restart amavis

The X-Spam-Relay-Countries header will now be present on all messages processed by Amavis.

Analyze Spam Sources by Country

Utilize Warden reporting tools to identify high-volume spam sources and adjust scoring policies accordingly:

1. Navigate to Warden > Reports > Spam - Client Addr Country to view organizations generating the highest volume of flagged spam.
2. Navigate to Warden > Reports > Clean - Client Addr Country to review traffic classified as legitimate. If suspicious traffic is incorrectly marked as clean, add the corresponding country to the Bad relay countries list to enforce stricter scoring.

Troubleshooting & Common Issues

• Verbose mode not displaying entries: Confirm that Amavis verbose logging is correctly enabled and that the MaxMind databases are properly downloaded and accessible.
• Custom headers missing after configuration: Verify that configuration files were saved without syntax errors, the directives match exactly as specified, and the Amavis service was restarted following modifications.
• Inaccurate country classification: Ensure the MaxMind GeoIP database is up to date. Outdated databases may result in incorrect geolocation matching and scoring behavior.