Operational visibility for your Rspamd deployment
Know what reached users, what blocked it, and which detection layers earn their cost — without grepping logs.
Who it's for
ESPs & hosting providers
Map your identity provider's organizations onto tenants: every customer signs into the same console and sees only their own traffic, tuning only within limits you set — while you keep the global view of the whole cluster.
Enterprise mail teams
Every verdict is explainable — see why a message was rejected or delivered, and validate tuning changes against replayed traffic before they ship.
Security leads
Ground-truth accuracy metrics, per-layer impact analysis — and a dated threat-posture page that answers a SOC 2, ISO 27001 or NIS2 questionnaire from your deployment's own records, exportable as PDF, CSV and JSON.
Why teams deploy Rspamd Console
Your logs show what fired. Console shows what mattered — and what to do about it.
See what actually matters
Detection Impact separates layers that fire from layers that decide verdicts. One deployment found an RBL with 98% coverage but only 2% decisive contribution — and switched it off with minimal effect on catch rate.
Cut incident response from hours to minutes
Campaign clustering turns 500 near-miss messages into one decision. LLM-assisted authoring goes from observation to deployed rule in about 60 seconds. Rules, maps and scoring policy change live from the console — preview any change against real captured mail, apply it, revert it. No restarts, no service interruption.
A wrong reject is no longer lost mail
Quarantine keeps a recoverable copy of every rejected message. Release a false positive with one click — signed, re-injected through your MTA, delivered seconds later — and train the filter from the same row. Repeat deliveries fold into one entry, and a whole campaign is one release-or-delete decision, not five hundred.
Automate without losing the wheel
Auto-triage proposes corrective actions, a second adversarial model judges each one, and by default nothing runs until an operator approves it. Admins choose which action types the judge may auto-apply — the proposing model never approves its own work. Every applied action is verified by rescan and revertible, and your own AI agents can drive the same action layer, with the same permissions and the same audit trail as an operator.
Prove your accuracy
Feedback & Replay measures real false positives and false negatives, not symbol hit counts, and re-runs your labelled corpus against the live config. On the benchmark corpus, Premium Neural cuts false positives ~20× vs Bayes at the same recall.
Catch the spam that hides in images
Image-only pitches, QR codes, banners sliced into tiles: a multimodal model reads them while a borderline message waits out its greylist delay, so nothing slows the mail flow. When the sender retries, the verdict sees what the images actually say — and one analysis covers an entire campaign, not every copy of it.
Your own name is a brand too
The brand a BEC crew spoofs most is yours. Brand Protection derives every recipient's company identity on the fly — no list to maintain — and flags senders who claim it across alphabets, spellings and lookalike tricks, while built-in exceptions keep real colleagues writing from personal mailboxes safe.
Simple until you need the cockpit
The Protection page runs the whole filter in outcome language: four named strictness levels, each previewed against your own last week's mail before you commit, and a live flow graph of where every message went. Hand-tuned deployments are respected, one click reverts — and the full expert console is always underneath.
Answers for your security review
The four questions every infrastructure and security team asks first.
Mail stays in your network
Scan data lives in your ClickHouse; streams and caches in your Redis. Content reaches an LLM provider only through features you explicitly enable — with a self-hosted model, everything stays in-house.
No config writes
Scan data access is read-only. Learn operations go through Rspamd's controller API, and rule deployment writes to HTTP-served map files that Rspamd polls — configuration files are never touched.
Runs air-gapped
The containers run entirely within your infrastructure. Only the optional LLM features make external calls, and you choose when and what to send.
Drops into your cluster
No migration, no patches, no custom builds: a container alongside your existing Rspamd 4.1+ cluster — single-node or HA — using the ClickHouse and Redis you already run.
The decisions your logs can't show
Protection
Four strictness levels — each previewed against your own last week's mail before you apply.
Detection Impact
Which layers decide verdicts — not just which ones fire.
Campaigns
500 near-misses clustered into one row, one decision.
Quarantine
Rejected mail, recoverable: one-click signed release, campaigns folded into single rows.
Vision
Image-only phishing read and scored — one analysis covers the whole campaign.
Dynamic Settings
Preview a policy change against real captured mail before it goes live.
Rspamd Console ships with the Enterprise and Hosted plans. See pricing
Frequently asked questions
Ready to see what your logs can't show you?
Talk to the Rspamd team about operational visibility for your Rspamd deployment.