Vexim Web Plugin Rspamd Core Laravel Package

Product Decisions This Supports

• Anti-spoofing and deliverability roadmap. v1.0.2 adds recognition of DMARC-verified From addresses in the Rspamd whitelist API. This is a trust-scoring decision, not a cosmetic one: it lets the system distinguish "known sender" from "known sender whose domain actually authenticated." That directly informs whether allowlisting is safe to expose to non-technical administrators.
• Build vs. buy for mail-admin tooling. The plugin is a thin integration layer between Vexim (the PHP/web admin front end for Postfix/Courier mail servers) and Rspamd. The decision it supports is whether to extend an existing Vexim deployment with community plugins or invest in a bespoke admin surface.
• Support-cost reduction. DMARC-aware allowlisting reduces the classic false-positive loop — legitimate mail quarantined because a sender's domain isn't yet trusted — which is primarily a helpdesk cost, not an engineering one. This release is a direct lever on that metric.
• Sender-trust UX decisions. Whether the product exposes "whitelist this sender" to tenant admins, or restricts it to operators, depends on how well the allowlist resists spoofed From headers. This change materially improves that posture and can justify loosening the permission model.
• Vendor/fork strategy. With two merged PRs and a v1.0.x version line, the realistic posture is "vendor and own the diff" rather than "depend on upstream." The decision this supports is how much customization budget to reserve.

When to Consider This Package

Adopt when:

• You already run Vexim as your mail administration interface. This plugin is scoped to Vexim's plugin surface and has no standalone value outside it.
• You already run Rspamd as the filtering engine and want its whitelist manageable from the admin UI rather than by hand-editing config.
• Your operators need DMARC-aware allowlisting — i.e. you want to trust authenticated senders without blanket-trusting a spoofable header.
• You have PHP capacity in-house to read, patch, and pin a small codebase. The project is early and single-maintainer; treat it as source you adopt, not a dependency you consume.

Look elsewhere when:

• You are not on Vexim. This is a Vexim plugin, not a Laravel package — despite the PHP lineage, there is no Laravel service provider, facade, or framework integration here. If you are building a Laravel application, this is not a drop-in component; at best it is a reference implementation for calling the Rspamd API.
• You need commercial support, SLAs, or a security response process. None is evidenced.
• Your stack is Exim/Postfix-native tooling (e.g. PostfixAdmin, Mailu, Mailcow) where equivalent Rspamd integration exists with larger maintainer bases.
• You require a stable, versioned API contract. A v1.0.2 with two merged pull requests has not yet demonstrated API stability.

How to Pitch It (Stakeholders)

To executives: This is a small, low-cost integration that makes our mail filtering smarter about who it trusts. The v1.0.2 change means a sender only gets whitelisted when their domain genuinely authenticates via DMARC — which cuts down on both spoofed mail getting through and legitimate mail being wrongly quarantined. The business value is fewer support tickets and a smaller phishing surface, at effectively zero licensing cost. The trade-off is maturity: this is an early, single-maintainer project, so we should plan to own the code rather than rely on upstream.

To engineering: Scoped PHP plugin for Vexim's admin UI that wires the Rspamd whitelist API into the interface. v1.0.2 adds DMARC-verified From handling to the whitelist lookup — a small, contained change in a codebase that is easy to read end to end. Recommend vendoring it into our tree, pinning to a reviewed commit, and treating the Rspamd call as an internal interface we control. Do not assume framework-level integration; this is not a Laravel package and carries no Composer-installable abstraction for our application code.

To security/ops: The change strengthens allowlist integrity by requiring domain authentication before a From address is trusted. Verify DMARC alignment is actually enforced on the Rspamd side and not merely parsed — the plugin's guarantee is only as good as the header it reads.