Defending the Inbox: Spam Protection with Rspamd and Redis

Defending the Inbox: Spam Protection with Rspamd and Redis

Building on the AWS SES setup from Post 1, this post adds a spam filtering layer for incoming email stored in S3.

The spam problem

Publishing email addresses in DNS — which is required for email to work — means spammers will find them. Every admin@, support@, and hello@ address is effectively public. Without filtering, that S3 bucket becomes a dump for junk.

An analytical consumer, not an inline filter

Traditional spam filters intercept mail at the moment it arrives (inline with the SMTP connection), rejecting spam before it's accepted. This setup works differently: SES receives the message and stores the raw email file in S3 first. A sync worker then picks it up, sends it to Rspamd for analysis, and acts on the verdict.

The benefit of this decoupled approach: if Rspamd goes down, email still arrives safely in S3; it just isn't filtered until the service recovers.

What Rspamd does

Rspamd is a high-performance, open-source spam filtering system. It analyzes each message against multiple signals:

• Bayesian classification: learns from past decisions; the more spam and legitimate mail you train it on, the sharper it gets.
• Real-time blocklists (RBLs): checks the sending IP against known spam sources.
• Fuzzy hashing: detects bulk spam campaigns by recognizing near-identical messages.
• Rate limiting: flags unusual sending patterns.

Each message receives a numeric score. Rspamd recommends one of three actions:

• Deliver (ham) — score is below the threshold; route to inbox normally
• Flag — borderline score; tag with a spam header so your email client can filter it
• Reject — clearly spam; delete the S3 object and don't deliver

Now, I'll be honest: I didn't know much about these parameters, and I still don't. The spam detection world is a big rabbit hole, and people make entire careers out of it. I don't plan on becoming an expert, but with the help of AI, I was able to set up a good enough system, and it can be tweaked over time to improve.
For a small glimpse, see the screenshots of the Rspamd dashboard below.

Redis as the backend

Redis is an in-memory data store that Rspamd uses to hold Bayesian statistics, rate-limiting state, and scan history. Running lookups in memory (rather than on disk) keeps analysis fast. To isolate Rspamd's data from other services sharing the same Redis instance, it uses a dedicated database index.

I already had a Redis instance running, just needed to add a new database.

Web dashboard

Rspamd includes a built-in web dashboard accessible at rspamd.joao-coelho.com (behind TLS via Let's Encrypt).
It shows recent scan results, spam scores, and lets you manually train the Bayesian classifier — marking a message as spam or legitimate mail to improve future accuracy.

Operational footprint

Despite doing sophisticated multi-signal analysis, Rspamd uses about 150MB of RAM on the VPS — lightweight enough to coexist with a dozen other services on a $15/month server.

What's next

With SES, S3, and Rspamd in place, incoming mail is now received, stored, and screened. But .eml files sitting in a storage bucket still aren't an inbox you can open in an email client. The final post closes that gap:

• Post 3: The Final Mile: Self-Hosted Email Server with Dovecot and Postfix