1 Topic by ribas

  • ribas
  • Member
  • Offline
  • Registered: 2023-10-13
  • Posts: 6

Topic: Amavisd marking authentic messages as spam

==== REQUIRED BASIC INFO OF YOUR IREDMAIL SERVER ====
- iRedMail version: iRedMail-1.6.5
- Deployed with iRedMail Easy or the downloadable installer? downloadable installer
- Linux/BSD distribution name and version: AlmaLinux release 9.3 (Shamrock Pampas Cat)
- Store mail accounts in which backend (LDAP/MySQL/PGSQL): MySQL
- Web server (Apache or Nginx): Nginx
- Manage mail accounts with iRedAdmin-Pro? Yes
- [IMPORTANT] Related original log or error message is required if you're experiencing an issue.
====

Some messages are not being filtered correctly by Amavisd, in the tests I carried out the senderA@exemplo.com receives the flag X-Spam-Score: 1,514 and is marked as spam, below is an excerpt from the header:

X-Virus-Scanned: amavis at server.host.com
X-Spam-Flag: YES
X-Spam-Score: 1.514
X-Spam-Level: *
X-Spam-Status: Yes, score=1.514 tagged_above=0 required=0
    tests=[DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1,
    DKIM_VALID_EF=-0.1, FORGED_HOTMAIL_RCVD2=0.874,
    FREEMAIL_ENVFROM_END_DIGIT=0.25, FREEMAIL_FROM=0.6, HTML_MESSAGE=0.001,
    RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001,
    T_SCC_BODY_TEXT_LINE=-0.01] autolearn=no autolearn_force=no

The amavisd.conf configuration looks like this:

$sa_tag_level_deflt  = 6.2;  # add spam info headers if at, or above that level
$sa_tag2_level_deflt = 6.2;  # add 'spam detected' headers at that level
$sa_dsn_cutoff_level = 10;   # spam level beyond which a DSN is not sent
$sa_crediblefrom_dsn_cutoff_level = 18; # likewise, but for a likely valid From

The database configuration for the server, domain and account also has the same parameters

I am attaching a file with the debug of one of the tests I performed

Post's attachments

amavisd_sa_debug.txt 10.39 kb, file has never been downloaded. 

You don't have the permssions to download the attachments of this post.

----

Spider Email Archiver: On-Premises, lightweight email archiving software developed by iRedMail team. Supports Amazon S3 compatible storage and custom branding.

2 Reply by Cthulhu

  • Cthulhu
  • Member
  • Offline
  • Registered: 2019-06-04
  • Posts: 907

Re: Amavisd marking authentic messages as spam

False Positives are not that uncommon:

FREEMAIL_FROM
Sender email is commonly abused enduser mail provider

I don't know why it is scored as 0.6, which is absurdly high

FORGED_HOTMAIL_RCVD2
Can be a false positive aswell, since hotmail routes mails trough outlook which causes this

I suggest to adjust those scores manually or even disabling them

3 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 31,082

Re: Amavisd marking authentic messages as spam

ribas wrote:

The amavisd.conf configuration looks like this:
$sa_tag_level_deflt  = 6.2;  # add spam info headers if at, or above that level
$sa_tag2_level_deflt = 6.2;  # add 'spam detected' headers at that level
$sa_dsn_cutoff_level = 10;   # spam level beyond which a DSN is not sent
$sa_crediblefrom_dsn_cutoff_level = 18; # likewise, but for a likely valid From

Please check the per-user, per-domain and global spam policy in iRedAdmin-Pro, they overrides the ones in amavisd.conf.

4 Reply by ribas

  • ribas
  • Member
  • Offline
  • Registered: 2023-10-13
  • Posts: 6

Re: Amavisd marking authentic messages as spam

Cthulhu wrote:

False Positives are not that uncommon:

FREEMAIL_FROM
Sender email is commonly abused enduser mail provider

I don't know why it is scored as 0.6, which is absurdly high

FORGED_HOTMAIL_RCVD2
Can be a false positive aswell, since hotmail routes mails trough outlook which causes this

I suggest to adjust those scores manually or even disabling them

I understand that false positives can be normal and that changing the score would help, but I don't see how that could be the case, since the configuration for the message to be identified as spam is at 6.2 and the example I provided did not reach 2 points.

5 Reply by ribas

  • ribas
  • Member
  • Offline
  • Registered: 2023-10-13
  • Posts: 6

Re: Amavisd marking authentic messages as spam

ZhangHuangbin wrote:
ribas wrote:

The amavisd.conf configuration looks like this:
$sa_tag_level_deflt  = 6.2;  # add spam info headers if at, or above that level
$sa_tag2_level_deflt = 6.2;  # add 'spam detected' headers at that level
$sa_dsn_cutoff_level = 10;   # spam level beyond which a DSN is not sent
$sa_crediblefrom_dsn_cutoff_level = 18; # likewise, but for a likely valid From

Please check the per-user, per-domain and global spam policy in iRedAdmin-Pro, they overrides the ones in amavisd.conf.


The configuration of this account is to use the default that I informed.