PHPackages                             bilias/rqwatch - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Utility & Helpers](/categories/utility)
4. /
5. bilias/rqwatch

ActiveProject[Utility & Helpers](/categories/utility)

bilias/rqwatch
==============

Rqwatch is a quarantine and map management system for Rspamd

v1.7.0(3mo ago)54[1 issues](https://github.com/bilias/rqwatch/issues)MPL-2.0PHPPHP ^8.3

Since Nov 10Pushed 2mo ago2 watchersCompare

[ Source](https://github.com/bilias/rqwatch)[ Packagist](https://packagist.org/packages/bilias/rqwatch)[ Docs](https://github.com/bilias/rqwatch)[ RSS](/packages/bilias-rqwatch/feed)WikiDiscussions master Synced 1mo ago

READMEChangelog (3)Dependencies (24)Versions (5)Used By (0)

Rqwatch
=======

[](#rqwatch)

**Rqwatch** is a quarantine and map management system for [Rspamd](https://rspamd.com), written in PHP.

It provides an intuitive web interface to monitor all incoming emails passing through your mail gateway, accessible to both administrators and recipient users.

An API is available to insert data from Rspamd. This API is used by the Rspamd [Metadata Exporter](https://docs.rspamd.com/modules/metadata_exporter) plugin to export raw emails and Rspamd headers and symbols and store that metadata in a database.

Depending on the action taken by Rspamd and the configuration, raw emails can also be saved in local quarantine storage to be examined and released by administrators or recipient users, if desired. This is particularly useful for rejected or discarded emails, which in a default Rspamd setup would be lost, leaving the recipient unaware of them.

Additionally, an administrator can monitor all email traffic and the information provided by Rqwatch, taking appropriate actions to improve Anti-Spam and Anti-Virus control and minimize false positives and false negatives.

Apart from monitoring, this system can also be used as a complete map management and distribution point for Rspamd, independent of other functionalities.

Rqwatch is able to operate in two modes:

- Local mode (single-host), where the Web and API components run on the same host as Rspamd.
- [Distributed](docs/DISTRIBUTED.md) mode, where the API servers run on the same hosts as Rspamd, while the Web servers (public or private) run on separate hosts.
    In this mode, the Web servers communicate with the corresponding API servers to retrieve mail data and release messages as needed.

In both modes, Rspamd communicates with Rqwatch API running on the same host, introducing only minimal overhead, without affecting Rspamd’s spam decisions or block its operation — even if mail import fails, Rspamd keeps running as usual.

Rqwatch comes packed with a variety of [features](#features). From detailed email traffic monitoring to actionable insights and Quarantine and maps management, Rqwatch provides administrators with extra tools to make the most of Rspamd’s powerful anti-spam capabilities.

- [Rqwatch](#rqwatch)
- [Features](#features)
    - [Architecture](#architecture)
    - [Components](#components)
    - [Web](#web)
        - [Mail Logs and Quarantine](#mail-logs-and-quarantine)
        - [Authentication](#authentication)
        - [Access Control](#access-control)
        - [Users](#users)
        - [Aliases](#aliases)
        - [Maps](#maps)
        - [Redis Caching](#redis-caching)
    - [API for Rspamd - RSPAMD API (metadata\_importer)](#api-for-rspamd---rspamd-api-metadata_importer)
    - [Mail API](#mail-api)
    - [CLI](#cli)
- [](docs/INSTALL.md)[Installation](docs/INSTALL.md)
- [](docs/CONFIGURE.md)[Configuration](docs/CONFIGURE.md)
- [](docs/SCREENSHOTS.md)[Screenshots](docs/SCREENSHOTS.md)
- [INFO](#info)
    - [Similar software](#similar-software)
    - [](CHANGELOG.md)[Changelog](CHANGELOG.md)
    - [](ROADMAP.md)[Roadmap](ROADMAP.md)
    - [](NOTICE.md)[Third-Party Software Notice](NOTICE.md)
    - [](LICENSE)[License: Mozilla Public License Version 2.0](LICENSE)

Features
========

[](#features)

Architecture
------------

[](#architecture)

- Custom MVC framework (+more than MVC)
- Router
- Authentication and Access Control middlewares per route
- Pretty URLs
- Can run either in Local mode (Web/API on same host), or [Distributed](docs/DISTRIBUTED.md)mode (Web/API on different hosts).
    Dedicated Mode, where Rqwatch runs separately than Rspamd could also work in theory, however this setup has not been tested.
- Supports /subfolder in base URL
- Default config file + local override file

Components
----------

[](#components)

- Symfony components (http-foundation, router, form, mailer, console etc)
- Eloquent ORM/Query Builder for MySQL/MariaDB connection
- Twig Views
- Monolog Logging
- .env file for sensitive parameters (+ config options that are not cached)
- MaxMind GeoIP reader
- composer installation

Web
---

[](#web)

### Mail Logs and Quarantine

[](#mail-logs-and-quarantine)

All mail metadata received by Rqwatch metadata\_importer API are stored in the database.

Depending on configuration, raw emails can also be stored in the local Quarantine (on each API server).
Web servers contact the corresponding API servers to retrieve mail data and release messages as needed.

The following functionalities are supported:

- Search mails by filters
- Top reports
- Show mail metadata
- Show mail headers
- Show Rspamd symbols
- Show virus report
- Quick links for white/black lists

If mail is stored in Quarantine:

- Show raw mail (text/html)
- Show/save mail attachments
- Notify recipient via CLI command run from cron
- Release mail (to original and/or alternate recipients)
- Track notification and release datetime
- Show Quarantined mails per day

Admin users have full access. Users have limited access and only to their data.

### Authentication

[](#authentication)

- Basic authentication
- Database authentication
- LDAP authentication

### Access Control

[](#access-control)

- Admin users can read/release all emails and edit all maps
- Normal users can read/release only their emails (+ aliases) and edit their maps
- DB Admin users / LDAP Admin users
- /admin web endpoint for admins

### Users

[](#users)

- Add/Delete Local (DB) user
- Edit user
- Login as user
- Search

### Aliases

[](#aliases)

User mail aliases can be added in order for the user to have access to multiple recipient addresses.

- Add/Delete mail aliases
- Search

### Maps

[](#maps)

The Web interface provides map management and URL endpoints for Rspamd

- Basic Maps with common fields of Rspamd multimap module (mail\_from, rcpt\_to, mime\_from, ip)
- Combined Maps with two fields combination for custom lua plugins provided by Rqwatch (mail\_from/rcpt\_to, mime\_from/rcpt\_to etc)
- Personal User Maps (Combined only) based on user rcpt\_to address
- Custom Maps with a custom field. Can hold any type of field that Rspamd supports (asn, url, email, ip, text etc)
- Multi entry inserts
- Enable/Disable/Delete per entry per map
- Search entries
- Edit entries

A GetMapApi was also initially implemented, however it's been disabled by default.
Rspamd downloads map files locally from the web server and this does not put additional stress on the database.

### Redis Caching

[](#redis-caching)

- Redis Session support (+ sentinel)
- Redis Config caching
- Redis Rspamd stats caching

API for Rspamd - RSPAMD API (metadata\_importer)
------------------------------------------------

[](#api-for-rspamd---rspamd-api-metadata_importer)

- Mail metadata and raw email (depending on configuration) is inserted to database and local storage, using the metadata\_exporter plugin of Rspamd
- Dedicated Authentication and IP RSPAMD\_API access list

Mail API
--------

[](#mail-api)

The Mail API is used in [Distributed](docs/DISTRIBUTED.md) mode, where Web components connect to it.

- Release Mail via remote API
- Get Mail via remote API
- Web client validates remote API SSL/TLS
- Web client is authenticated to remote API
- Dedicated Authentication and IP access control list

CLI
---

[](#cli)

- Update map files if needed (cron)
- Mail notifications to users (cron)
- Quarantine cleanup (cron)
- User add

[Installation](docs/INSTALL.md)
===============================

[](#installation)

[Configuration](docs/CONFIGURE.md)
==================================

[](#configuration)

[Screenshots](docs/SCREENSHOTS.md)
==================================

[](#screenshots)

INFO
====

[](#info)

Similar software
----------------

[](#similar-software)

**Rqwatch** was initially inspired by [MailWatch](https://mailwatch.org), which is used with [MailScanner](https://www.mailscanner.info).
Although we wanted a similar look and functionality (since we have used it for many years), it's a completely different project - a rewrite without any code from there.

[mailcow](https://mailcow.email/) has a quarantine system; ideas taken from there too ([metadata\_exporter](https://github.com/mailcow/mailcow-dockerized/blob/master/data/conf/rspamd/local.d/metadata_exporter.conf))
[rspamd-quarantine](https://github.com/sys4/rspamd-quarantine) (python - never used it)
[rspamd-quarantine](https://github.com/fedmik/rspamd-quarantine) (PHP - never used it)

[Changelog](CHANGELOG.md)
-------------------------

[](#changelog)

[Roadmap](ROADMAP.md)
---------------------

[](#roadmap)

[Third-Party Software Notice](NOTICE.md)
----------------------------------------

[](#third-party-software-notice)

[License: Mozilla Public License Version 2.0](LICENSE)
------------------------------------------------------

[](#license-mozilla-public-license-version-20)

###  Health Score

40

—

FairBetter than 88% of packages

Maintenance81

Actively maintained with recent releases

Popularity8

Limited adoption so far

Community8

Small or concentrated contributor base

Maturity53

Maturing project, gaining track record

 Bus Factor1

Top contributor holds 100% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~30 days

Total

4

Last Release

95d ago

### Community

Maintainers

![](https://www.gravatar.com/avatar/c948b7bb52be2fe605c266883948c85f3d22558e07f3e4e1c9871dbdd2ca510e?d=identicon)[bilias](/maintainers/bilias)

---

Top Contributors

[![bilias](https://avatars.githubusercontent.com/u/47315739?v=4)](https://github.com/bilias "bilias (729 commits)")

---

Tags

anti-spamquarantinerspamdantispamrspamd

### Embed Badge

![Health badge](/badges/bilias-rqwatch/health.svg)

```
[![Health](https://phpackages.com/badges/bilias-rqwatch/health.svg)](https://phpackages.com/packages/bilias-rqwatch)
```

###  Alternatives

[prestashop/prestashop

PrestaShop is an Open Source e-commerce platform, committed to providing the best shopping cart experience for both merchants and customers.

9.0k15.4k](/packages/prestashop-prestashop)[ec-cube/ec-cube

EC-CUBE EC open platform.

78527.0k1](/packages/ec-cube-ec-cube)[sylius/sylius

E-Commerce platform for PHP, based on Symfony framework.

8.4k5.6M651](/packages/sylius-sylius)[contao/core-bundle

Contao Open Source CMS

1231.6M2.4k](/packages/contao-core-bundle)[shopware/platform

The Shopware e-commerce core

3.3k1.5M3](/packages/shopware-platform)[sulu/sulu

Core framework that implements the functionality of the Sulu content management system

1.3k1.3M152](/packages/sulu-sulu)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)