1 Topic by dave.opc (edited by dave.opc 2025-04-10 17:50:30)

  • dave.opc
  • Member
  • Offline
  • Registered: 2019-07-08
  • Posts: 106

Topic: x-spam-status

==== REQUIRED BASIC INFO OF YOUR IREDMAIL SERVER ====
- iRedMail version (check /etc/iredmail-release): 1.7.1
- Deployed with iRedMail Easy or the downloadable installer? DL
- Linux/BSD distribution name and version: ubuntu 24.04
- Store mail accounts in which backend (LDAP/MySQL/PGSQL): mysql
- Web server (Apache or Nginx): nginx
- Manage mail accounts with iRedAdmin-Pro? Yes
- [IMPORTANT] Related original log or error message is required if you're experiencing an issue.
====

What can it be? Some emails are not marked with x-spam-status

Return-Path: <sales25@worldbenz.com>
Delivered-To: spam@*****.co
Received: from mail.domain.replaced (mail.domain.replaced [127.0.0.1])
    by mail.domain.replaced (Postfix) with ESMTP id 4ZYDsj1mryz8vfm
    for <spam@*****.co>; Thu, 10 Apr 2025 12:24:25 +0300 (MSK)
Authentication-Results: mail.domain.replaced (amavis); dkim=pass (2048-bit key)
    reason="pass (just generated, assumed good)" header.d=domain.replaced
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=domain.replaced; h=
    content-type:message-id:mime-version:x-mailer:subject:to:from
    :date; s=dkim; t=1744277065; x=1746869066; bh=S/ze+iPDVHT5Z0g8UQ
    NvfLGLfLwD9Ga1Zr5nMX0Th24=; b=f+W+0fdg5eK2aYHIrINkYoZdBLv99cKL2/
    SFdQU0QecPSkYeajNTRPpbi4NWAV3Uc17UzJibUupcBlIMFz5sqmteu2R0wrGApw
    jhSzDrYWpNIW0c2CCZNhXlepXFa6ZOeUPa/gjeZeYDxrMNNFJwwEUII3tZ3LChL9
    5U2C65ogb4C9JkcGEjnp0g2V8SkbkRkvlZ2AtwTM8wTppnskp2yCpxh/vg8YVlTt
    5aPJpMv0VFaXEbPjGdzX/sf5nuxlw2eq8LBsPWqqPaa1asGwMilFw/MCXnOfyjJ+
    ij8LOm57wMBQfXux/3t38u2UtqjvRfkM/kVxZCNQmQMr7YeYtbDA==
Authentication-Results: mail.domain.replaced (amavis); dkim=pass (1024-bit key)
    header.d=worldbenz.com
Received: from mail.domain.replaced ([127.0.0.1])
    by mail.domain.replaced (mail.domain.replaced [127.0.0.1]) (amavis, port 10026)
    with ESMTP id isLBTgR5OIYn for <spam@*****.co>;
    Thu, 10 Apr 2025 12:24:25 +0300 (MSK)
Received: by mail.domain.replaced (Postfix, from userid 2000)
    id 4ZYDsj0Srrz8vZj; Thu, 10 Apr 2025 12:24:25 +0300 (MSK)
X-Sieve: Pigeonhole Sieve 0.5.21 (f6cd4b8e)
X-Sieve-Redirected-From: arm@*****group.com
Delivered-To: arm@*****group.com
Received: from mail.domain.replaced (mail.domain.replaced [127.0.0.1])
    by mail.domain.replaced (Postfix) with ESMTP id 4ZYDsh6sj0z8vPX
    for <arm@*****group.com>; Thu, 10 Apr 2025 12:24:24 +0300 (MSK)
X-Virus-Scanned: Debian amavis at mail.domain.replaced
Received: from mail.domain.replaced ([127.0.0.1])
    by mail.domain.replaced (mail.domain.replaced [127.0.0.1]) (amavis, port 10024)
    with ESMTP id B8cHJdhWU-_5 for <arm@*****group.com>;
    Thu, 10 Apr 2025 12:24:18 +0300 (MSK)
Received: from mail-m49206.qiye.163.com (mail-m49206.qiye.163.com [45.254.49.206])
    by mail.domain.replaced (Postfix) with ESMTPS id 4ZYDsX0yDmz8sfh
    for <Arm@*****group.com>; Thu, 10 Apr 2025 12:24:15 +0300 (MSK)
Received: from DESKTOP-Q0KI0SD (unknown [14.155.124.211])
    by smtp.qiye.163.com (Hmail) with ESMTP id 1161e8a26
    for <Arm@*****group.com>; Thu, 10 Apr 2025 17:24:03 +0800 (GMT+08:00)
Date: Thu, 10 Apr 2025 17:23:22 +0800
From: "sales25@worldbenz.com" <sales25@worldbenz.com>
To: Arm <Arm@*****group.com>
Subject: RE: RE: At your fingertips! SUPER Special appreciate truck/rail retas to Almaty/Astana for you.
X-Priority: 3
X-GUID: 560EAA39-DC36-442B-A61B-7FE04EB60EC7
X-Has-Attach: no
X-Mailer: Foxmail 7.2.25.306[cn]
Mime-Version: 1.0
Message-ID: <2025041017162720331012@worldbenz.com>
Content-Type: multipart/related;
    boundary="----=_001_NextPart020218537748_=----"
X-HM-Spam-Status: e1kfGhgUHx5ZQUpXWQgPGg8OCBgUHx5ZQUlOS1dZFg8aDwILHllBWSg2Ly
    tZV1koWUFITzdXWS1ZQUlXWQ8JGhUIEh9ZQVlCGhlCVk4eS0wZSEsYTR5PGVYVFAkWGhdVEwETFh
    oSFyQUDg9ZV1kYEgtZQVlKT1VKTk5VSklPVUlKSllXWRYaDxIVHRRZQVlPS0hVSktISkhNSlVKS0
    tVSkJLS1kG
X-HM-Tid: 0a961f037af703adkunm1161e8a26
X-HM-MType: 1
X-HM-Sender-Digest: e1kMHhlZQR0aFwgeV1kSHx4VD1lBWUc6ODI6MBw*KDJIODAcGD9RKS4e
    LR4wCy5VSlVKTE9PSUxMS09PQkhCVTMWGhIXVQgaFx4ISU47DBQJFx8ZHhUBVRgUFkVZV1kSC1lB
    WUpPVUpOTlVKSU9VSUpKWVdZCAFZQU5LSUlITDcG
DKIM-Signature:a=rsa-sha256;
    b=gZ9r4spY7KJCXQg0Z5zCKCi8Zzi4VFx94vnT5ogTY64DftyGXKLjwJweLAOJ3xU7fQxLeJo1Xt+7k0qlhH2y7iK2Kl2WSIjFJN7tXr5uJqGZCZLtjkExbolwCHO+7hBNlOV1c7qhKJGAjhu9Yf6D3roYeGTZAV7rYqZ6oFqZKh4=; s=default; c=relaxed/relaxed; d=worldbenz.com; v=1;
    bh=+CPpejMr/azTKsx7iCilOnq1d5Ojwqux827aCIADJZc=;
    h=date:mime-version:subject:message-id:from;

this is mostly happens on spam mails
all normal emails seems to have x-spam-status

X-Virus-Scanned: Debian amavis at mail.domain.replaced
X-Spam-Flag: NO
X-Spam-Score: -2.099
X-Spam-Level:
X-Spam-Status: No, score=-2.099 tagged_above=-100 required=4.5
    tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1,
    DKIM_VALID_EF=-0.1, DMARC_PASS=-0.001, FREEMAIL_FROM=0.001,
    HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=disabled

----

Spider Email Archiver: On-Premises, lightweight email archiving software developed by iRedMail team. Supports Amazon S3 compatible storage and custom branding.

2 Reply by dave.opc (edited by dave.opc 2025-04-10 17:59:41)

  • dave.opc
  • Member
  • Offline
  • Registered: 2019-07-08
  • Posts: 106

Re: x-spam-status

probably that email was forwarded as it has x-sieve-redirected-from status and that's why it's not analized? the redirect is happening on the same mail server

as i have the same spam letter to another account, that doesn't redirect mails and there we can see x-spam

Return-Path: <sales25@worldbenz.com>
Delivered-To: spam@*****.co
Received: from mail.domain.replaced (mail.domain.replaced [127.0.0.1])
    by mail.domain.replaced (Postfix) with ESMTP id 4ZYDsj1M5Wz8vfk
    for <spam@*****.co>; Thu, 10 Apr 2025 12:24:25 +0300 (MSK)
X-Virus-Scanned: Debian amavis at mail.domain.replaced
X-Spam-Flag: NO
X-Spam-Score: 0.611
X-Spam-Level:
X-Spam-Status: No, score=0.611 tagged_above=-100 required=4.5
    tests=[BAYES_50=0.8, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1,
    DKIM_VALID_EF=-0.1, DMARC_PASS=-0.001, HTML_FONT_LOW_CONTRAST=0.001,
    HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001,
    T_KAM_HTML_FONT_INVALID=0.01] autolearn=disabled
Authentication-Results: mail.domain.replaced (amavis); dkim=pass (1024-bit key)
    header.d=worldbenz.com
Received: from mail.domain.replaced ([127.0.0.1])
    by mail.domain.replaced (mail.domain.replaced [127.0.0.1]) (amavis, port 10024)
    with ESMTP id VZ079RbVe1Un for <spam@*****.co>;
    Thu, 10 Apr 2025 12:24:20 +0300 (MSK)
Received: from mail-m15594.qiye.163.com (mail-m15594.qiye.163.com [101.71.155.94])
    by mail.domain.replaced (Postfix) with ESMTPS id 4ZYDsZ1NjJz8vWl
    for <office@*****.co>; Thu, 10 Apr 2025 12:24:17 +0300 (MSK)
Received: from DESKTOP-Q0KI0SD (unknown [14.155.124.211])
    by smtp.qiye.163.com (Hmail) with ESMTP id 1161e8a29
    for <office@*****.co>; Thu, 10 Apr 2025 17:24:04 +0800 (GMT+08:00)
Date: Thu, 10 Apr 2025 17:23:22 +0800
From: "sales25@worldbenz.com" <sales25@worldbenz.com>
To: office <office@*****.co>
Subject: RE: RE: At your fingertips! SUPER Special appreciate truck/rail retas to Almaty/Astana for you.
X-Priority: 3
X-GUID: 560EAA39-DC36-442B-A61B-7FE04EB60EC7
X-Has-Attach: no
X-Mailer: Foxmail 7.2.25.306[cn]
Mime-Version: 1.0
Message-ID: <2025041017162720331012@worldbenz.com>
Content-Type: multipart/related;
    boundary="----=_001_NextPart020218537748_=----"
X-HM-Spam-Status: e1kfGhgUHx5ZQUpXWQgPGg8OCBgUHx5ZQUlOS1dZFg8aDwILHllBWSg2Ly
    tZV1koWUFITzdXWS1ZQUlXWQ8JGhUIEh9ZQVkZHUgfVhkZQ0sYTx1JHUIeSVYVFAkWGhdVEwETFh
    oSFyQUDg9ZV1kYEgtZQVlKT1VKTk5VSklPVUlKSllXWRYaDxIVHRRZQVlPS0hVSktISk9NQ1VKS0
    tVSkJLS1kG
X-HM-Tid: 0a961f037f0d03adkunm1161e8a29
X-HM-MType: 1
X-HM-Sender-Digest: e1kMHhlZQR0aFwgeV1kSHx4VD1lBWUc6Ohg6IRw*TjJRFjA2TTgaKRg0
    DhUKCSNVSlVKTE9PSUxMS09OQ01IVTMWGhIXVQgaFx4ISU47DBQJFx8ZHhUBVRgUFkVZV1kSC1lB
    WUpPVUpOTlVKSU9VSUpKWVdZCAFZQU5LSUlITzcG
DKIM-Signature:a=rsa-sha256;
    b=gZ9r4spY7KJCXQg0Z5zCKCi8Zzi4VFx94vnT5ogTY64DftyGXKLjwJweLAOJ3xU7fQxLeJo1Xt+7k0qlhH2y7iK2Kl2WSIjFJN7tXr5uJqGZCZLtjkExbolwCHO+7hBNlOV1c7qhKJGAjhu9Yf6D3roYeGTZAV7rYqZ6oFqZKh4=; s=default; c=relaxed/relaxed; d=worldbenz.com; v=1;
    bh=+CPpejMr/azTKsx7iCilOnq1d5Ojwqux827aCIADJZc=;
    h=date:mime-version:subject:message-id:from;

3 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 31,325

Re: x-spam-status

dave.opc wrote:

X-Sieve-Redirected-From: arm@*****group.com

Email was originally sent to this arm@*****group.com, the question is, does the email received by arm@ has X-Spam-* headers? If yes, then those headers might be removed by sieve while redirecting.

4 Reply by dave.opc (edited by dave.opc 2025-04-11 20:55:55)

  • dave.opc
  • Member
  • Offline
  • Registered: 2019-07-08
  • Posts: 106

Re: x-spam-status

ZhangHuangbin wrote:

Email was originally sent to this arm@*****group.com, the question is, does the email received by arm@ has X-Spam-* headers? If yes, then those headers might be removed by sieve while redirecting.

the mail itself is already deleted from the mailbox, but i found it in the logs

helo=mail-m49206.qiye.163.com, Tests: [BAYES_50=0.8,DKIM_SIGNED=0.1,DKIM_VALID=-0.1,DKIM_VALID_AU=-0.1,DKIM_VALID_EF=-0.1,DMARC_PASS=-0.001,HTML_FONT_LOW_CONTRAST=0.001,HTML_MESSAGE=0.001,SPF_HELO_NONE=0.001,SPF_PASS=-0.001,T_KAM_HTML_FONT_INVALID=0.01], autolearn=disabled, autolearnscore=-0.188

if i understand correctly the mail got x-spam-status on delivery to arm@ mailbox.

any chance to keep those headers while redirecting mails?