Rspamd

Rspamd is an email security engine for filtering spam, phishing and other risky messages in self-managed mail systems. It suits administrators who want control over deployment and filtering rules, and can support anything from a small mail server to very high message volumes. Its open-source core is compelling; paid support and managed options cost more and come with a release-support caveat.

Overview

Rspamd combines reputation signals, sender authentication, message content analysis and machine learning to score and filter email. It can check SPF, DKIM, DMARC and ARC, and integrate with ClamAV or commercial antivirus engines to flag malware and dangerous attachments. Outbound filtering and impersonation protection extend its role beyond inbound spam control.

The engine runs on-premises as a gateway, keeping message data in the user's environment without a required vendor cloud. Its Apache 2.0 open-source core and integrations with Postfix, Exim and Sendmail make it a practical fit for teams that operate their own mail infrastructure. ClickHouse and Elasticsearch integrations provide a way to examine attack patterns and detection rates.

Key features

• Layered filtering: Reputation, authentication, content analysis and machine learning contribute to message scoring. This gives administrators several kinds of signal rather than a single test.
• Authentication checks: SPF, DKIM, DMARC and ARC checks help identify messages that fail sender-authentication controls.
• Malware integrations: ClamAV and commercial antivirus integrations can add checks for malware and dangerous attachment types; the antivirus engines are integrations, not the open-source core itself.
• Custom rules: A Lua API, maps and selectors let teams tailor filtering to their environment. That flexibility is useful where standard rules need adjustment, but assumes the capacity to configure and maintain them.
• Scale: Rspamd says its event-driven C core scans hundreds of messages per second per core and can scale from one server to billions of messages a day. That breadth suits growing infrastructure, though the claim is not a substitute for sizing a particular deployment.

Pricing

Pricing is based on protected mailboxes, with Rspamd using about 20 emails per mailbox per day as a rule of thumb. That makes mailbox count, rather than an individual message allowance, the clearest starting point for estimating fit.

• Open-source Rspamd — free: The self-hosted open-source core is the right place to start for teams able to operate and support their own deployment. It does not include the premium support described for paid plans.
• Scale — £100 a month: At £100 + VAT/month, it covers 5K mailboxes and can scale to your demands. It suits an organization seeking a paid option at that mailbox scale; VAT adds to the stated monthly price.
• Hosted — custom pricing: Covers custom mailbox counts with managed deployment on your infrastructure or Rspamd's. It suits teams that want deployment management rather than the self-managed open-source route.
• Enterprise — custom pricing: For 50K+ mailboxes, with priority support and SLA options. It is aimed at very large deployments where engineering support and service commitments matter.

Paid plans offer access to Rspamd's core engineers, with SLA options for enterprise users. One important trade-off applies to every deployment: documentation says support for the previous stable branch ends when a new major release becomes stable, and old releases are not supported. Teams that need long-term support for older versions should weigh that policy before committing.

Platforms

Rspamd supports Linux, macOS and self-hosted deployment. Its gateway model and integrations with Postfix, Exim and Sendmail make it a mail-infrastructure choice, not a general-purpose consumer email app.

Who it's for

Choose Rspamd if you operate mail servers and want an open-source filtering engine with authentication checks, malware integrations and room for custom rules. It is especially suited to teams that value keeping message data on their own infrastructure or need to scale filtering across large volumes.

Look elsewhere if you want a consumer-facing mail filter, a product that avoids mail-server administration, or continued support for old stable releases. Managed deployment is available through the Hosted plan, but it uses custom pricing.

Pros and cons

• Pro: The Apache 2.0 core is free and self-hosted, giving capable administrators control over deployment and message data.
• Pro: Authentication checks, content and reputation analysis, malware integrations, outbound filtering and impersonation protection cover several distinct email-security needs.
• Pro: Custom Lua rules, maps and selectors allow adaptation to local filtering requirements.
• Con: Customization and self-hosting place operational responsibility on the team; the product is not positioned as a plug-and-play consumer filter.
• Con: Paid pricing scales by protected mailbox count, and Hosted and Enterprise require custom pricing rather than a fixed published monthly amount.
• Con: Previous stable branches lose support when a new major release becomes stable, limiting the appeal for teams that need to remain on older releases.

Alternatives

For a wider category comparison, browse Email Anti-Spam Software or Email Security Gateways.

• MailWasher is worth considering for a user-facing option across Android, iOS and Windows; its free plan is limited to one email account and has no support.
• Apache SpamAssassin is a free, self-hosted alternative for those seeking command-line filtering tools and Perl modules rather than Rspamd's described engine and integrations.
• JetEmail is another freemium option, with web and API platforms and a free marketing tier for up to 1,000 subscribers.
• Mailprotector offers a free Radar email security check and product pricing through an account manager.
• MailChannels Inbound Filtering is an alternative inbound filtering product with pricing available by contacting sales.
• Mimecast Data Leak Prevention is an alternative for readers considering data leak prevention.
• Cleanmail is a paid alternative with a free trial and self-hosted and web platforms.
• Forcepoint ZTNA is another paid option, with pricing by request.

Verdict

Rspamd is a strong fit for administrators who want a self-hosted, open-source email security engine that combines authentication, scoring and malware integrations, with room to tailor rules and scale. Its main reasons to look elsewhere are the operational demands of running it and the end of support for older stable branches; teams seeking paid assistance should also account for mailbox-based pricing and custom-priced higher tiers.