Rejecting Google Groups Spam Mail with Stalwart Mail (Full Config & Rationale)

Google Groups became our biggest spam source. Because posts are relayed by other tenants, DKIM/SPF often look fine and simple filters under‑react. We solved this by rejecting all Google Groups messages during SMTP. That stops the flood before Inbox/Junk and returns a clear 5xx to the poster.

What you have to do in the Stalwart UI

1. Create one rule (Spam filter → Rules → Add)
   
   ID:
   icod-ggroups-any

   1	icod-ggroups-any

   
   
   Scope / Event:
   header

   1

   header

   
   
   Priority:
   8

   1

   8

   
   
   Click Add condition and add these rows (note the quotes in the then field):
   • if
     name_lower == 'x-google-group-id'

     1	name_lower == 'x-google-group-id'

     then
     'REJ_GOOGLE_GROUPS'

     1	'REJ_GOOGLE_GROUPS'

   • if
     name_lower == 'list-archive' && contains(value_lower, 'groups.google.com')

     1	name_lower == 'list-archive' && contains(value_lower, 'groups.google.com')

     then
     'REJ_GOOGLE_GROUPS'

     1	'REJ_GOOGLE_GROUPS'

   • if
     name_lower == 'list-post' && contains(value_lower, 'groups.google.com')

     1	name_lower == 'list-post' && contains(value_lower, 'groups.google.com')

     then
     'REJ_GOOGLE_GROUPS'

     1	'REJ_GOOGLE_GROUPS'

   • if
     name_lower == 'list-help' && contains(value_lower, 'groups.google.com')

     1	name_lower == 'list-help' && contains(value_lower, 'groups.google.com')

     then
     'REJ_GOOGLE_GROUPS'

     1	'REJ_GOOGLE_GROUPS'

   • if
     name_lower == 'list-subscribe' && contains(value_lower, 'groups.google.com')

     1	name_lower == 'list-subscribe' && contains(value_lower, 'groups.google.com')

     then
     'REJ_GOOGLE_GROUPS'

     1	'REJ_GOOGLE_GROUPS'

   • if
     name_lower == 'list-unsubscribe' && contains(value_lower, 'groups.google.com')

     1	name_lower == 'list-unsubscribe' && contains(value_lower, 'groups.google.com')

     then
     'REJ_GOOGLE_GROUPS'

     1	'REJ_GOOGLE_GROUPS'

   • if
     name_lower == 'list-id' && contains(value_lower, 'googlegroups.com')

     1	name_lower == 'list-id' && contains(value_lower, 'googlegroups.com')

     then
     'REJ_GOOGLE_GROUPS'

     1	'REJ_GOOGLE_GROUPS'

   Important: the tag in then must be quoted like

   'REJ_GOOGLE_GROUPS'

   1	'REJ_GOOGLE_GROUPS'

   or the UI will treat it as a variable and error.

2. Create one score/action (Spam filter → Scores & Actions → Add)
   
   Tag name:
   REJ_GOOGLE_GROUPS

   1	REJ_GOOGLE_GROUPS

   
   
   Score or action:
   reject

   1

   reject

Immediate effect

• Group posts are rejected during SMTP with a 5xx. Nothing is stored; nothing to triage.
• Posters see a bounce and can contact us directly instead of broadcasting via lists.

#spam #google #email