1 Topic by echo5

  • echo5
  • Member
  • Offline
  • Registered: 2016-05-17
  • Posts: 23

Topic: Spam filtering not working

==== Required information ====
- iRedMail version:  0.9.3
- Linux/BSD distribution name and version: RHEL 7.2
- Store mail accounts in which backend: mySQL (mariaDB)
- Web server: Apache
- Manage mail accounts with iRedAdmin-Pro?: No
====

Greetings,

I am getting spam email that I cannot get iRedMail to tag as spam and put into spam folders. I tried changing amavisd.conf to set "$final_spam_destiny       = D_DISCARD;" and restarted amavisd daemon but 300+ spam messages get delivered to INBOX of one user every day.

Any suggestions on what I can do to get iRedMail to process messages and handle spam correctly?

Thanks!

----

Spider Email Archiver: On-Premises, lightweight email archiving software developed by iRedMail team. Supports Amazon S3 compatible storage and custom branding.

2 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 31,172

Re: Spam filtering not working

If spams get low spam scores, you may want to decrease the Amavisd setting "$sa_tag2_level_deflt =".

3 Reply by echo5

  • echo5
  • Member
  • Offline
  • Registered: 2016-05-17
  • Posts: 23

Re: Spam filtering not working

ZhangHuangbin wrote:

If spams get low spam scores, you may want to decrease the Amavisd setting "$sa_tag2_level_deflt =".

The spam emails are not getting tagged or scored at all. Here is headers from a SPAM:

Return-Path: <PrivateJetHire@may29ooieu.fatheru.top>
Delivered-To: user@domain.tld
Received: from iredmail-server (localhost [127.0.0.1])
    by iredmail-server (Postfix) with ESMTP id 212EA416C7F5
    for <user@domain.tld>; Tue, 17 May 2016 08:04:07 -0700 (PDT)
X-Virus-Scanned: amavisd-new at iredmail-server
Received: from iredmail-server ([127.0.0.1])
    by iredmail-server (iredmail-server [127.0.0.1]) (amavisd-new, port 10024)
    with ESMTP id Cqx2KrvWRNNr for <user@domain.tld>;
    Tue, 17 May 2016 08:03:46 -0700 (PDT)
Received: from may29ooieu.fatheru.top (unknown [198.105.166.66])
    by iredmail-server (Postfix) with ESMTP id 2F8C4416C7F3
    for <user@domain.tld>; Tue, 17 May 2016 08:03:41 -0700 (PDT)
Date: Tue, 17 May 2016 08:17:58 -0700
Message-ID: <020966c6629575c6d66af6e7f661a27a.Camel.Grume.omshoes@ombac.org>
To: <user@domain.tld>
Subject: Private Jet Rentals are more affordable than you thought
Content-Type: multipart/alternative; boundary="8756299_12697861_8756299"
Obsequiousness: 8756299-020966c6629575c6d66af6e7f661a27a-12697861
From: Private Jet Hire <PrivateJetHire@may29ooieu.fatheru.top>
Mime-Version: 1.0

But this email, same recipient user, same server, same day, 16 minutes apart gets the spam tagged and sent to Junk:

Return-Path: <godhead@ron.aunqaf.us>
Delivered-To: user@domain.tld
Received: from iredmail-server (localhost [127.0.0.1])
    by iredmail-server (Postfix) with ESMTP id A6C44416C7FD
    for <user@domain.tld>; Tue, 17 May 2016 08:18:53 -0700 (PDT)
X-Virus-Scanned: amavisd-new at iredmail-server
X-Spam-Flag: YES
X-Spam-Score: 10.184
X-Spam-Level: **********
X-Spam-Status: Yes, score=10.184 tagged_above=2 required=6.2
    tests=[CANT_SEE_AD=1, HTML_MESSAGE=0.001, HTML_TAG_BALANCE_BODY=0.712,
    MPART_ALT_DIFF=0.724, RAZOR2_CF_RANGE_51_100=0.365,
    RAZOR2_CF_RANGE_E8_51_100=2.43, RAZOR2_CHECK=1.729, RDNS_NONE=1.274,
    URIBL_ABUSE_SURBL=1.948, URIBL_BLOCKED=0.001]
    autolearn=no autolearn_force=no
Received: from iredmail-server ([127.0.0.1])
    by iredmail-server (iredmail-server [127.0.0.1]) (amavisd-new, port 10024)
    with ESMTP id Ra26lYb3kDqL for <user@domain.tld>;
    Tue, 17 May 2016 08:18:31 -0700 (PDT)
Received: from aunqaf.us (unknown [104.129.45.38])
    by iredmail-server (Postfix) with ESMTP id 50355416C7FB
    for <user@domain.tld>; Tue, 17 May 2016 08:17:58 -0700 (PDT)
Subject: ***Spam*** Join The Millions Of Americans Digitizing Their Memories
From: "iMemories" <imemories@civics.aunqaf.us>
To: <user@domain.tld>
Date: Tue, 17 May 2016 08:03:39 -0700
List-Unsubscribe: <mailto:unsubscribe@frock.aunqaf.us>
Content-Type: multipart/related; boundary="d99dfd8d520c154d_46df6d25ee6e9d7aa"
MIME-Version: 1.0
Message-ID: <0.0.0.39.1D1B04D5421D7C8.1EF284@aunqaf.us>

4 Reply by ss2win

  • ss2win
  • Member
  • Offline
  • Registered: 2016-04-30
  • Posts: 15

Re: Spam filtering not working

In /etc/amavisd/amavisd.conf, set  sa_tag_level_deflt = "-100" to tag all emails. The way it's configured now it won't tag anything 2 and below.

5 Reply by echo5

  • echo5
  • Member
  • Offline
  • Registered: 2016-05-17
  • Posts: 23

Re: Spam filtering not working

ss2win wrote:

In /etc/amavisd/amavisd.conf, set  sa_tag_level_deflt = "-100" to tag all emails. The way it's configured now it won't tag anything 2 and below.

I set sa_tag_level_deflt to -100. At least I'll see how these hundreds of spam messages that are getting through are getting scored.

Thanks for the pointer