Confirm that this DirectAdmin server actually uses Rspamd rather than another filtering engine. Obtain an authorized sample with its full headers and approximate delivery time. Record the current user filtering settings and protect message contents from unnecessary disclosure.

1. Find the message in the mail logs and Rspamd history or logs, using the queue ID and time. On a standard installation the Rspamd log is commonly /var/log/rspamd/rspamd.log.
2. Identify the matched symbols, total score and resulting action. Separate authentication failures, reputation checks and content rules instead of assuming the largest score is always wrong.
3. Review the affected user filtering settings in DirectAdmin. Prefer a scoped customer adjustment when that solves the requirement, rather than changing all server thresholds.
4. For a server configuration change, use the supported CustomBuild persistence mechanism and Rspamd local overrides. Save the previous files, validate with rspamadm configtest, and inspect the effective configuration before reloading the service.
5. Retest an authorized sample and a normal legitimate message. If the issue is incorrect sender SPF, DKIM or DMARC, repair the sender configuration rather than permanently bypassing authentication checks.

After an authorised administrator drafts a narrow Rspamd configuration change, validate it using the installed utility. This command checks configuration; it does not deliver messages, remove quarantine entries or reload the running mail-filter service.

sudo rspamadm configtest

Read the result: A successful configuration test establishes that the utility accepts the configuration structure. It does not establish that the new thresholds or rules classify mail correctly. A broad allow rule can be syntactically valid while allowing spoofed or unwanted messages through.

Keep the previous supported override file and test the proposed behaviour with authorised representative messages before deployment. On DirectAdmin, preserve changes through the documented CustomBuild configuration mechanism so an update does not silently discard them. After a reviewed reload, compare symbols, scores and actions rather than relying only on a clean configtest result.

Only after understanding how the rule matches authenticated and unauthenticated mail. A visible From address can be forged, so a broad exception may trust messages the legitimate domain never sent.

Confirm the intended setting applies only to the expected recipients or senders and that the selected action changes appropriately. Monitor subsequent legitimate and unwanted mail so an apparent improvement does not simply mean all filtering stopped.

If configuration validation fails, restore the previous override before restarting. If filtering becomes unavailable, inspect the Rspamd service and dependencies and how Exim handles that failure. Avoid public exposure of the Rspamd controller or sharing its administrative credentials.

• Investigating a growing Exim mail queue on DirectAdmin
• Diagnosing Dovecot login errors on DirectAdmin
• Making persistent per-domain web-server changes in DirectAdmin
• Planning a DirectAdmin multi-server DNS setup

• DirectAdmin: Preventing Spam
• docs.rspamd.com: Settings
• docs.rspamd.com: Configuration