SpamSieve Berg — intelligent email security for Linux servers

SpamSieve Berg grew out of a practical need: understand what is happening across many mailboxes and stop unwanted mail without losing legitimate correspondence. The platform runs alongside Linux mail infrastructure and gives administrators a clear view of mailbox health, suspicious messages, filtering decisions, and the background work that keeps everything current.

The challenge

A conventional spam filter usually exposes little more than its final verdict. This project needed a broader operational layer: compare signals across mailboxes, recognise one campaign even when senders change, learn from operator decisions, and keep automated actions reversible. The interface also had to explain its reasoning rather than asking an administrator to trust an opaque score.

What was built

• A mailbox health overview covering indexing, manual labels, and authentication results.
• A suspicious-message queue, detailed review card, and clear spam, legitimate, or uncertain decisions.
• Message clustering and bulk training with a preview before any group action.
• A correlation engine that detects mass campaigns and presents representative evidence.
• Threat Radar views for SPF, DKIM, DMARC, local-domain spoofing, senders, domains, and IP signals.
• Adjustable DNSBL and URIBL policy, automatic quarantine, and a 72-hour rescue path.
• Allow and block lists, Roundcube mailbox controls, user roles, two-factor login, and an external Basic Auth gate.
• Operational analytics, HTML/CSV/JSON reports, background-job controls, diagnostics, and full-platform backups.

Engineering approach

The solution is self-hosted and integrated with a Linux mail environment, Hestia, and Roundcube. Its server side uses PHP 8.4 and MariaDB. Classification combines email-authentication results, reputation sources, message similarity, and human training. The multilingual interface supports light and dark themes while keeping the underlying evidence visible to the operator.

Outcome and status

An administrator can see not only that a message is risky, but why the platform reached that conclusion and what an approval will do. This reduces repetitive review, makes coordinated campaigns easier to spot, and avoids irreversible deletion as a default response. SpamSieve Berg remains in active development; the current version already brings monitoring, training, policy control, and day-to-day operations into one coherent panel.