May 14, 2026: iRedMail-1.8.1 has been released.

**m.hunter** · 2026-05-15 00:25:11

m.hunter
Member
Offline

Registered: 2026-05-14
Posts: 3

Topic: Bayesian Spam filtering not working

==== REQUIRED BASIC INFO OF YOUR IREDMAIL SERVER ====
- iRedMail version (check /etc/iredmail-release): 1.4.0 MARIADB edition.
- Deployed with iRedMail Easy or the downloadable installer? Unsure
- Linux/BSD distribution name and version: centOS 8.3
- Store mail accounts in which backend (LDAP/MySQL/PGSQL): MySql
- Web server (Apache or Nginx): Nginx
- Manage mail accounts with iRedAdmin-Pro? No
- [IMPORTANT] Related original log or error message is required if you're experiencing an issue.
====

We have been receiving a lot of spam lately and it appears the Bayesian filters are not operating at all.

In the maillog the Hits: variable is always showing a '-' instead of an actual score. I have been unable to find some documentation that gives me any insight for that issue.
i.e.
May 14 11:34:06 mail amavis[86138]: (86138-04) Passed CLEAN, <no-reply@forum.iredmail.org> -> <me@mydomain.com>, Hits: -, tag=0, tag2=0, kill=0, queued_as: 4gGZB60VSvzXlts, L/0/0/0

SpamAssassin is configured to run embedded under amavis.
I have trained the filter with over 1200 spam and 240 ham messages and made sure that bayesian db is in /var/spool/amavisd/.spamassassin/ and owned by amavis.

Any suggestions would be appreciated.

----

Spider Email Archiver: On-Premises, lightweight email archiving software developed by iRedMail team. Supports Amazon S3 compatible storage and custom branding.

**ZhangHuangbin** · 2026-05-15 20:11:24

ZhangHuangbin
iRedMail Developers
Offline

Registered: 2009-05-06
Posts: 31,683

Re: Bayesian Spam filtering not working

"Hits: -" means Amavisd doesn't perform spam scanning at all, not just bayes.
What's the full log line? Maybe this sender is whitelisted?

**m.hunter** · 2026-05-19 23:07:27

m.hunter
Member
Offline

Registered: 2026-05-14
Posts: 3

Re: Bayesian Spam filtering not working

Thanks for the explanation of the '-'.

Here is the entire maillog entry for that incoming email with extra line breaks so it is more readable:

May 14 11:34:04 mail postfix/postscreen[82986]: PASS NEW [172.105.68.48]:53624

May 14 11:34:04 mail postfix/smtpd[86194]: connect from mail.iredmail.org[172.105.68.48]

May 14 11:34:05 mail postfix/smtpd[86194]: Anonymous TLS connection established from mail.iredmail.org[172.105.68.48]: TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)

May 14 11:34:05 mail postfix/smtpd[86194]: 4gGZB569lJzXltq: client=mail.iredmail.org[172.105.68.48]

May 14 11:34:05 mail postfix/cleanup[86033]: 4gGZB569lJzXltq: message-id=<>

May 14 11:34:05 mail postfix/qmgr[374]: 4gGZB569lJzXltq: from=<no-reply@forum.iredmail.org>, size=1694, nrcpt=1 (queue active)

May 14 11:34:05 mail amavis[86138]: process_request: fileno sock=10, STDIN=0, STDOUT=1

May 14 11:34:05 mail amavis[86138]: (86138-04) ESMTP [127.0.0.1]:10024 /var/spool/amavisd/tmp/amavis-20260514T113009-86138-X5OvrkGe: <no-reply@forum.iredmail.org> -> <myaddress@mydomain.com> SIZE=1694 BODY=8BITMIME Received: from mail.myserver.com ([127.0.0.1]) by mail.myserver.com (mail.myserver.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP for <myaddress@mydomain.com>; Thu, 14 May 2026 11:34:05 -0400 (EDT)

May 14 11:34:05 mail amavis[86138]: (86138-04) smtp connection cache, dt: 116.8, state: 0

May 14 11:34:06 mail amavis[86138]: (86138-04) body hash: f81d69e4bd9c980e9bc9a0c233a3023c

May 14 11:34:06 mail amavis[86138]: (86138-04) trace: ESMTP://[127.0.0.1]:53454 < ESMTPS://[172.105.68.48]:53624 < ESMTPSA://139.162.146.87

May 14 11:34:06 mail amavis[86138]: (86138-04) dkim: VALID third-party signature by d=iredmail.org, From: <no-reply@forum.iredmail.org>, a=rsa-sha256, c=relaxed/relaxed, s=dkim, i=@iredmail.org

May 14 11:34:06 mail amavis[86138]: (86138-04) Checking: njCUniNnVflW [172.105.68.48] <no-reply@forum.iredmail.org> -> <myaddress@mydomain.com>

May 14 11:34:06 mail amavis[86138]: (86138-04) 2822.From: <no-reply@forum.iredmail.org>

May 14 11:34:06 mail amavis[86138]: (86138-04) p001 1 Content-Type: text/plain, 8bit, size: 445, SHA1 digest: ea9b02ddceecd922ccce5415053a52cb6efc6fc3

May 14 11:34:06 mail amavis[86138]: (86138-04) Checking for banned types and filenames

May 14 11:34:06 mail amavis[86138]: (86138-04) collect banned table[0]: myaddress@mydomain.com, tables: DEFAULT=>Amavis::Lookup::RE=ARRAY(0x5638482d0d38)

May 14 11:34:06 mail amavis[86138]: (86138-04) p.path myaddress@mydomain.com: "P=p001,L=1,M=text/plain,T=asc"

May 14 11:34:06 mail amavis[86138]: (86138-04) do_notify_and_quar: ccat=Clean (1,0) ("1":Clean, "0":CatchAll) ccat_block=(), qar_mth=

May 14 11:34:06 mail amavis[86138]: (86138-04) delivery method is 1, recips: myaddress@mydomain.com

May 14 11:34:06 mail amavis[86138]: (86138-04) smtp session: setting up a new session

May 14 11:34:06 mail amavis[86138]: (86138-04) new socket using IO::Socket::IP to [127.0.0.1]:10025, timeout 35

May 14 11:34:06 mail postfix/10025/smtpd[85893]: connect from localhost[127.0.0.1]

May 14 11:34:06 mail amavis[86138]: (86138-04) smtp greeting: 220 mail.myserver.com ESMTP Postfix, dt: 1.3 ms

May 14 11:34:06 mail amavis[86138]: (86138-04) smtp cmd> EHLO mail.myserver.com

May 14 11:34:06 mail amavis[86138]: (86138-04) smtp resp to EHLO: 250 mail.myserver.com\nPIPELINING\nSIZE 15728640\nETRN\nENHANCEDSTATUSCODES\n8BITMIME\nDSN\nSMTPUTF8

May 14 11:34:06 mail amavis[86138]: (86138-04) AUTH not needed, user='', MTA offers ''

May 14 11:34:06 mail amavis[86138]: (86138-04) smtp cmd> MAIL FROM:<no-reply@forum.iredmail.org> BODY=7BIT

May 14 11:34:06 mail amavis[86138]: (86138-04) smtp cmd> RCPT TO:<myaddress@mydomain.com> ORCPT=rfc822;myaddress@mydomain.com

May 14 11:34:06 mail amavis[86138]: (86138-04) smtp cmd> DATA

May 14 11:34:06 mail postfix/smtpd[86194]: disconnect from mail.iredmail.org[172.105.68.48] ehlo=2 starttls=1 mail=1 rcpt=1 data=1 quit=1 commands=7

May 14 11:34:06 mail postfix/10025/smtpd[85893]: 4gGZB60VSvzXlts: client=localhost[127.0.0.1]

May 14 11:34:06 mail amavis[86138]: (86138-04) smtp resp to MAIL (pip): 250 2.1.0 Ok

May 14 11:34:06 mail amavis[86138]: (86138-04) smtp resp to RCPT (pip) (<myaddress@mydomain.com>): 250 2.1.5 Ok

May 14 11:34:06 mail amavis[86138]: (86138-04) smtp resp to DATA: 354 End data with <CR><LF>.<CR><LF>

May 14 11:34:06 mail amavis[86138]: (86138-04) smtp cmd> QUIT

May 14 11:34:06 mail postfix/cleanup[85821]: 4gGZB60VSvzXlts: message-id=<4gGZB60VSvzXlts@mail.myserver.com>

May 14 11:34:06 mail postfix/10025/smtpd[85893]: disconnect from localhost[127.0.0.1] ehlo=1 mail=1 rcpt=1 data=1 quit=1 commands=5

May 14 11:34:06 mail postfix/qmgr[374]: 4gGZB60VSvzXlts: from=<no-reply@forum.iredmail.org>, size=2331, nrcpt=1 (queue active)

May 14 11:34:06 mail amavis[86138]: (86138-04) smtp resp to data-dot (<myaddress@mydomain.com>): 250 2.0.0 Ok: queued as 4gGZB60VSvzXlts, dt: 1.2 ms

May 14 11:34:06 mail amavis[86138]: (86138-04) Amavis::Out::SMTP::Session close, disconnecting

May 14 11:34:06 mail amavis[86138]: (86138-04) njCUniNnVflW FWD from <no-reply@forum.iredmail.org> -> <myaddress@mydomain.com>, BODY=7BIT 250 2.0.0 from MTA(smtp:[127.0.0.1]:10025): 250 2.0.0 Ok: queued as 4gGZB60VSvzXlts

May 14 11:34:06 mail amavis[86138]: (86138-04) status counters: InMsgsStatus{Relayed,RelayedUntagged,RelayedUntaggedInbound}

May 14 11:34:06 mail amavis[86138]: (86138-04) Passed CLEAN {RelayedInbound}, [172.105.68.48]:53624 [139.162.146.87] ESMTP/ESMTP <no-reply@forum.iredmail.org> -> <myaddress@mydomain.com>, (ESMTPS://[172.105.68.48]:53624 < ESMTPSA://139.162.146.87), Queue-ID: 4gGZB569lJzXltq, mail_id: njCUniNnVflW, b: -B1p5L2cm, Hits: -, size: 1691, queued_as: 4gGZB60VSvzXlts, Subject: "Welcome to iRedMail! (raw: =?UTF-8?B?V2VsY29tZSB0byBpUmVkTWFpbCE=?=)", From: <no-reply@forum.iredmail.org>, X-Mailer: PunBB_Mailer, helo=mail.iredmail.org, dkim_i=@iredmail.org, dkim_sd=dkim:iredmail.org, 113 ms

May 14 11:34:06 mail amavis[86138]: (86138-04) _WARN: Argument "x" isn't numeric in sprintf at /usr/sbin/amavisd line 15845.

May 14 11:34:06 mail amavis[86138]: (86138-04) _WARN: Argument "x" isn't numeric in sprintf at /usr/sbin/amavisd line 15847.

May 14 11:34:06 mail amavis[86138]: (86138-04) _WARN: Argument "x" isn't numeric in sprintf at /usr/sbin/amavisd line 15849.

May 14 11:34:06 mail amavis[86138]: (86138-04) Passed CLEAN, <no-reply@forum.iredmail.org> -> <myaddress@mydomain.com>, Hits: -, tag=0, tag2=0, kill=0, queued_as: 4gGZB60VSvzXlts, L/0/0/0

May 14 11:34:06 mail amavis[86138]: (86138-04) sending SMTP response: "250 2.0.0 from MTA(smtp:[127.0.0.1]:10025): 250 2.0.0 Ok: queued as 4gGZB60VSvzXlts"

May 14 11:34:06 mail postfix/amavis/smtp[85826]: 4gGZB569lJzXltq: to=<myaddress@mydomain.com>, relay=127.0.0.1[127.0.0.1]:10024, delay=0.32, delays=0.2/0/0/0.12, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[127.0.0.1]:10025): 250 2.0.0 Ok: queued as 4gGZB60VSvzXlts)

May 14 11:34:06 mail postfix/qmgr[374]: 4gGZB569lJzXltq: removed

May 14 11:34:06 mail amavis[86138]: (86138-04) size: 1691, TIMING [total 121 ms] - SMTP greeting: 1.5 (1%)1, SMTP EHLO: 0.6 (0%)2, SMTP pre-MAIL: 0.6 (1%)2, SMTP MAIL: 1.1 (1%)3, lookup_sql: 2.3 (2%)5, SMTP pre-DATA-flush: 1.4 (1%)6, SMTP DATA: 0.4 (0%)6, check_init: 0.4 (0%)7, digest_hdr: 2.8 (2%)9, digest_body_dkim: 46 (38%)47, collect_info: 4.0 (3%)50, gen_mail_id: 4.9 (4%)54, mime_decode: 6 (5%)59, get-file-type1: 10 (9%)68, parts_decode: 0.1 (0%)68, check_header: 0.4 (0%)68, decide_mail_destiny: 1.0 (1%)69, notif-quar: 0.3 (0%)69, fwd-connect: 4.2 (3%)73, fwd-mail-pip: 13 (10%)83, fwd-rcpt-pip: 0.2 (0%)83, fwd-data-chkpnt: 0.1 (0%)83, write-header: 0.4 (0%)84, fwd-data-contents: 0.0 (0%)84, fwd-end-chkpnt: 2.1 (2%)86, prepare-dsn: 0.6 (1%)86, report: 1.8 (2%)88, main_log_entry: 11 (9%)97, sql-update: 2.7 (2%)99, SMTP pre-response: 0.2 (0%)99, SMTP response: 0.2 (0%)99, unlink-1-files: 0.2 (0%)100, rundown: 0.5 (0%)100

May 14 11:34:06 mail amavis[86138]: (86138-04) load: 0 %, total idle 236.482 s, busy 0.604 s

May 14 11:34:06 mail postfix/pipe[85901]: 4gGZB60VSvzXlts: to=<myaddress@mydomain.com>, relay=dovecot, delay=0.07, delays=0.01/0/0/0.05, dsn=2.0.0, status=sent (delivered via dovecot service (doveconf: Warning: NOTE: You can get a new clean config file with: doveconf -Pn > dovecot-new.conf d))

May 14 11:34:06 mail postfix/qmgr[374]: 4gGZB60VSvzXlts: removed

There shouldn't be any specific whitelisting for that sender.

**ZhangHuangbin** · 2026-05-20 10:58:07

ZhangHuangbin
iRedMail Developers
Offline

Registered: 2009-05-06
Posts: 31,683

Re: Bayesian Spam filtering not working

Could you please show me the X-Spam-* headers of this received email?

**m.hunter**

m.hunter
Member
Offline

Registered: 2026-05-14
Posts: 3

Re: Bayesian Spam filtering not working

ZhangHuangbin wrote:

Could you please show me the X-Spam-* headers of this received email?

There were no X-Spam-* headers added, only a 'X-Virus-Scanned: Debian amavis at mail.iredmail.org'

May 14, 2026: iRedMail-1.8.1 has been released.

Bayesian Spam filtering not working

Posts: 5

1 Topic by m.hunter 2026-05-15 00:25:11

Topic: Bayesian Spam filtering not working

2 Reply by ZhangHuangbin 2026-05-15 20:11:24

Re: Bayesian Spam filtering not working

3 Reply by m.hunter 2026-05-19 23:07:27

Re: Bayesian Spam filtering not working

4 Reply by ZhangHuangbin 2026-05-20 10:58:07

Re: Bayesian Spam filtering not working

5 Reply by m.hunter Yesterday 22:29:34

Re: Bayesian Spam filtering not working

Posts: 5