Rspamd October updates fix security and authentication checks

ARC trust fix released on 21 October

Rspamd 4.2.3, released on 21 October 2026, stops trusting ARC forwarders whose seals fail verification. Previously, a message naming an allowlisted signing domain could receive ARC_ALLOW_TRUSTED despite a broken seal, and its recorded authentication results could reduce the DMARC score.

The fix also requires exactly one ARC-Authentication-Results header per chain instance and waits for seal checks before publishing results. Operators using trusted ARC forwarders should review the release, upgrade through their supported deployment method, and test both valid and invalid seals.

Follow-up released on 10 October

Rspamd 4.2.2, released on 10 October 2026, fixes a heap overflow during Unicode lowercasing and an HTTP keepalive crash. It also restores DNS lookup retries used by HTTP services, including DKIM Vault, after a failed lookup at startup.

The release changes how multipart message digests are calculated. Integrations that use message or non-base64 part digests as lookup keys should review this compatibility change before upgrading. Gateway operators should also check the URL and phishing-detection fixes in the release notes.

The 1 October security update

Rspamd released version 4.2.1 on 1 October 2026. The maintainers strongly recommend upgrading because it fixes several critical memory-safety bugs, including problems in HTTP handling. It also corrects SPF and DKIM checks used when assessing incoming mail.

SPF a and mx mechanisms without an explicit prefix length now match according to the IP address family. The release also fixes SPF macro processing and DKIM body-length checks when relaxed canonicalisation is used.

Check earlier alignment changes too

Teams upgrading from before 4.2.0, released on 18 September, should also review its authentication changes. That version separates the score for aligned DKIM into R_DKIM_ALIGNED and returns an SPF permanent error when a domain publishes multiple SPF records.

What administrators should do

Check the Rspamd version on each mail gateway and plan an upgrade through your supported package or deployment method. Test representative IPv4 and IPv6 senders, DKIM verification, and any local scoring rules that depend on DKIM alignment. Version 4.2.3 also changes duplicate RBL scoring and DKIM-domain matching; review those compatibility notes if you use custom rules.

These steps are recommendations for teams operating Rspamd. The releases do not introduce a new DNS requirement for every sending domain.