1 (edited by roshanjonah 2017-02-13 13:29:30)

Topic: Not classifying spam correctly

==== Required information ====
- iRedMail version (check /etc/iredmail-release):
- Linux/BSD distribution name and version:
- Store mail accounts in which backend (LDAP/MySQL/PGSQL):
- Web server (Apache or Nginx):
- Manage mail accounts with iRedAdmin-Pro?
- Related log if you're reporting an issue:

The system running is not classifying spam messages as spam. I paste the headers of the email (see attachment) to this utlity online and it says its a definite spam but the mail system is not scanning for variables like EMPTY_MESSAGE, NML_ADSP_CUSTOM_MED, MIME_NO_TEXT.

pts rule name               description
---- ---------------------- --------------------------------------------------
1.0 HK_RANDOM_FROM         From username looks random
0.0 FREEMAIL_FROM          Sender email is commonly abused enduser mail provider
                            (amykristenfbbv[at]gmail.com)
-0.0 RCVD_IN_DNSWL_NONE     RBL: Sender listed at http://www.dnswl.org/, no
                            trust
                            [74.125.82.194 listed in list.dnswl.org]
0.0 DKIM_ADSP_CUSTOM_MED   No valid author signature, adsp_override is
                            CUSTOM_MED
0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily valid
2.3 EMPTY_MESSAGE          Message appears to have no textual parts and no
                            Subject: text
0.0 T_DKIM_INVALID         DKIM-Signature header exists but is not valid
1.2 NML_ADSP_CUSTOM_MED    ADSP custom_med hit, and not from a mailing list
1.9 MIME_NO_TEXT           No (properly identified) text body parts
1.0 BODY_URI_ONLY          Message body is only a URI in one line of text or for
                            an image

How do I make SpamAssasin/Amavisd scan for those variables and thereby increase spam score and be classified as spam.

Please help.

Regards,
Roshan Jonah

----

Spider Email Archiver: On-Premises, lightweight email archiving software developed by iRedMail team. Supports Amazon S3 compatible storage and custom branding.

2

Re: Not classifying spam correctly

Scanning email by calling SpamAssassin (SA) directly and Amavisd+SA is slightly different. You can try to turn on debug mode in Amavisd to show the rules in mail header.

FYI: http://www.iredmail.org/docs/no.x-spam.headers.html

3

Re: Not classifying spam correctly

ZhangHuangbin wrote:

Scanning email by calling SpamAssassin (SA) directly and Amavisd+SA is slightly different. You can try to turn on debug mode in Amavisd to show the rules in mail header.

FYI: http://www.iredmail.org/docs/no.x-spam.headers.html

I put those through and restarted Amavisd. The problem is it is actually inserting the headers but the spamassasin variables like EMPTY_MESSAGE is not being checked.

4

Re: Not classifying spam correctly

Do you mean your message contains empty mail body?

5

Re: Not classifying spam correctly

ZhangHuangbin wrote:

Do you mean your message contains empty mail body?

Yes that is correct. Here is one example of email that has been allowed without EMPTY_MESSAGE tag. It has not been flagged and neither does it scan for EMPTY_MESSAGE.

I put same message on this utility (http://spamcheck.postmarkapp.com/) that also uses same spamassasin and it picks it up correctly. It puts it down as SPAM but the server puts it down as NOT spam as seen by SPAM-FLAG. X-Spam-Flag: NO

Even the spam score is much lower than what it should be. It should be around 8.7 but it gives only 3.009

I am not sure why it is not picking up so many of such messages.

6

Re: Not classifying spam correctly

I'm afraid that it's better post to Amavisd mailing list, it relies on how Amavisd calls SpamAssassin:
https://amavis.org/#support

7

Re: Not classifying spam correctly

we have a fresh install for iRedMail-0.9.6 and Pro-2.5.0. 

receiving a root email daily:

/etc/cron.daily/spamassassin:
Job for spamassassin.service failed. See 'systemctl status spamassassin.service' and 'journalctl -xn' for details.
invoke-rc.d: initscript spamassassin, action "reload" failed.

any idea on the fix for this?

8

Re: Not classifying spam correctly

LegacyGroup wrote:

/etc/cron.daily/spamassassin:
Job for spamassassin.service failed. See 'systemctl status spamassassin.service' and 'journalctl -xn' for details.
invoke-rc.d: initscript spamassassin, action "reload" failed.

Show us output of command "'systemctl status spamassassin.service'". we need to know detailed error log. Cannot help much without log.

Also, please always create new topic for your own question, do not hijack other's topic.