The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

[case 45360] Ham being reported as Spam - started recently

Discussion in 'E-mail Discussions' started by santrix, Nov 25, 2010.

  1. santrix

    santrix Well-Known Member

    Joined:
    Nov 30, 2008
    Messages:
    223
    Likes Received:
    2
    Trophy Points:
    18
    WHM 11.28.45

    A user (not sure if this is isolated to this user) is finding that all mail is getting this X-Spam-Report added, despite not being spam...

    X-Spam-Status: No, score=-1.1
    X-Spam-Score: -10
    X-Spam-Bar: -
    X-Spam-Report: Spam detection software, running on the system "ourserver.domain.com", has identified this incoming email as possible spam. The original message has been attached to this so you can view it (if it isn't spam) or label [...]
    Content analysis details: (-1.1 points, 5.0 required)
    pts rule name description
    ---- ---------------------- --------------------------------------------------
    0.8 SPF_NEUTRAL SPF: sender does not match SPF record (neutral)
    -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1%
    [score: 0.0000]
    X-Spam-Flag: NO


    Any ideas?

    Steve
     
  2. amxfsx

    amxfsx Member

    Joined:
    Nov 6, 2005
    Messages:
    9
    Likes Received:
    0
    Trophy Points:
    1
    We are seeing the same issue since earlier this week.
     
  3. yayyo

    yayyo Well-Known Member

    Joined:
    Jul 10, 2004
    Messages:
    61
    Likes Received:
    0
    Trophy Points:
    6
    Location:
    London, UK
    cPanel Access Level:
    Root Administrator
    I think that maybe you realised this already, but "score=-1.1" (-ve number) is saying "not only not spam, but very not spam" ;)

    Strangely enough, on occasion I've wanted to show the spam score on ALL emails and never got around to finding out how...

    How did you do it, please? LOL :D
     
  4. cPanelNick

    cPanelNick Administrator
    Staff Member

    Joined:
    Mar 9, 2015
    Messages:
    3,426
    Likes Received:
    2
    Trophy Points:
    38
    cPanel Access Level:
    DataCenter Provider
    We have recently changed the behavior to always include the spam report (for all messages) so you can backtrack why messages are marked as ham and not spam when you expected otherwise.
     
  5. rainboy

    rainboy Active Member

    Joined:
    Mar 2, 2004
    Messages:
    28
    Likes Received:
    0
    Trophy Points:
    1
    Location:
    Eindhoven
    We also receive this from clients ; which have a MINUS score ; and all messages go into SPAM. This does not seem to be only changed the behavior but seem to break somethings where it is not supposed to mark messages as spam at all.
     
  6. amxfsx

    amxfsx Member

    Joined:
    Nov 6, 2005
    Messages:
    9
    Likes Received:
    0
    Trophy Points:
    1
    Nick, some of our customers are complaining about this header being attached to the top of nearly all of their email. They don't want to have to scroll through this HAM information to read their messages. Other customers have not mentioned this, so I'm not sure why some see it, and others don't.
     
    #6 amxfsx, Nov 29, 2010
    Last edited: Nov 29, 2010
  7. cPanelNick

    cPanelNick Administrator
    Staff Member

    Joined:
    Mar 9, 2015
    Messages:
    3,426
    Likes Received:
    2
    Trophy Points:
    38
    cPanel Access Level:
    DataCenter Provider
    Could you post a screenshot of this behavior? This header should not be displayed by default. Have they customized their mail client settings to display it? If it is matching on X-Spam-Report, we could consider changing it to X-Ham-Report for HAM.
     
  8. amxfsx

    amxfsx Member

    Joined:
    Nov 6, 2005
    Messages:
    9
    Likes Received:
    0
    Trophy Points:
    1
    Hi Nick,

    The customer in question is using an Eudora email client. Attached is a saved email message. When I tested this customer's account using Outlook, I did not see the SPAM/HAM header.

    Thank you for your support.
    amxfsx
     

    Attached Files:

  9. cPanelNick

    cPanelNick Administrator
    Staff Member

    Joined:
    Mar 9, 2015
    Messages:
    3,426
    Likes Received:
    2
    Trophy Points:
    38
    cPanel Access Level:
    DataCenter Provider
    Hi amxfsx,

    It looks like your client has configured their mail setup to view all headers. This is generally not a standard configuration. Generally you would only turn this on if you needed to find out more information about the message. The spam report is something that you might want to look when viewing all headers so this seems quite appropriate.
     
  10. amxfsx

    amxfsx Member

    Joined:
    Nov 6, 2005
    Messages:
    9
    Likes Received:
    0
    Trophy Points:
    1
    Hi Nick,

    My customer gave me 2 screen shots from his Eudora client and the HAM header always shows up, even with detailed header information turned off.

    Regards,
    Brian
     
  11. Oldcrow

    Oldcrow Registered

    Joined:
    Dec 3, 2010
    Messages:
    2
    Likes Received:
    0
    Trophy Points:
    1
    Just being new to this server. I also have Spam leaving from the forum mail account..

    I beleive I have one member sending out spam. What I believe is happening, is the member contacts the forum, and the mail forwarder send spam mail to all on the forwarding list..

    I have since deleted all mail accounts including the forwarders accounts..
     
  12. mtbwacko

    mtbwacko Well-Known Member

    Joined:
    Nov 30, 2004
    Messages:
    54
    Likes Received:
    0
    Trophy Points:
    6
    Nick,

    We are having this problem as well and I have not found a solution yet. It showed up with a recent automatic update. All of my Eudora users are seeing this huge X-Spam-Report header in their emails, and all of them have "Show All Headers" turned off. Is there a solution to this yet?

    Greg
     
  13. ggouweloos

    ggouweloos Member

    Joined:
    Nov 26, 2008
    Messages:
    14
    Likes Received:
    0
    Trophy Points:
    1
    First of all it is kinda strange every non-spam mail is marked
    "has identified this incoming email as possible spam"

    We are currently running a test, it seems Horde webmail cannot determine the original message is in HTML. So it is not possible to see the original message as a popup link because Horde just does not recognize it anymore. We turned of SpamAssassin for an account to see if it matters at all.

    Getting complaints of several clients not able to read HTML parts of the emails via Horde since the latest major upgrade.
     
  14. cPanelNick

    cPanelNick Administrator
    Staff Member

    Joined:
    Mar 9, 2015
    Messages:
    3,426
    Likes Received:
    2
    Trophy Points:
    38
    cPanel Access Level:
    DataCenter Provider
    I just downloaded Eudora and I was not able to see this problem.

    Please open a ticket and post the screenshots.

    Thanks
     
  15. mtbwacko

    mtbwacko Well-Known Member

    Joined:
    Nov 30, 2004
    Messages:
    54
    Likes Received:
    0
    Trophy Points:
    6
    Nick

    Thanks for looking further into the Eudora/X-Spam-Report issues. I also opened a ticket with the below info, but there was no place to post a screen shot with the ticket so I have posted it here.

    There are two issues and all 6 of my servers running cPanel have the same problem. And these issues only apply to users of Eudora.

    1. Every email has the X-Spam-Report header visible, even with "Show All Headers" turned off (in Eudora, this is the button labelled Blah Blah Blah).

    2. Every email has this header, even those that are not spam. Every email appears to be tagged as spam. In some cases, if the email is large the X-Spam-Report header is very long, causing the user to scroll down many lines to get past the header.

    Thanks again!
    Greg
     

    Attached Files:

  16. cPanelNick

    cPanelNick Administrator
    Staff Member

    Joined:
    Mar 9, 2015
    Messages:
    3,426
    Likes Received:
    2
    Trophy Points:
    38
    cPanel Access Level:
    DataCenter Provider
    It looks like this version of Eudora shows all X- headers regardless of the setting. Even if we change the header to X-Ham-Report it will still be visible.
    At this point there isn't much we can do without reverting the behavior to the old way which would mean the loss of the ability to track why a message was not marked as spam.

    At this point I would recommend upgrading to the latest version of Eudora which does not behave in this manner: https://wiki.mozilla.org/Eudora_Releases
     
  17. pascalfringe

    pascalfringe Member

    Joined:
    Dec 6, 2010
    Messages:
    15
    Likes Received:
    0
    Trophy Points:
    1
    Location:
    Delhi, India
    Thanks for the info.

    For me this happens at mt DISCUSS plugin. Anyways, i think it happens majorly because of few webmaster, who mistakenly mark non-spam as spams on few forums.

    Things should get resolve soon. Cheers
     
  18. cPanelDon

    cPanelDon cPanel Quality Assurance Analyst
    Staff Member

    Joined:
    Nov 5, 2008
    Messages:
    2,557
    Likes Received:
    7
    Trophy Points:
    38
    Location:
    Houston, Texas, U.S.A.
    cPanel Access Level:
    DataCenter Provider
    Twitter:
    Specific to the Eudora software, I found a number of resources that indicate Eudora has a built-in feature to hide certain mail headers; this feature or Eudora configuration option is called "TabooHeaders" as detailed below:

    Eudora .ini Settings >> [Settings]
    Use a browser page search or scroll down until you see "TabooHeaders" as shown below:
    • Entry: TabooHeaders
    • Description: A comma-separated list of headers (without colons) that should not be shown when the "Show all headers" switch (the "Blah Blah Blah" icon) is off for a message. The matching is done on a prefix basis, so any header that begins with one of these values will not be shown.
    • Default Value:
      Code:
      X-UID,Received,Status,X-UIDL,Message,In-Reply,X-Priority,Mime-Version,Content,X-Persona,Resent-Message,References,Return,X400,X-400,Mail-System,Errors-To,X-List,Delivery,Disposition,X-Juno,Precedence,X-Attachments,X-MSMail,X-MimeOLE,X-Nav
    Additional knowledge base reference from Eudora.com: How do I remove unwanted headers from my messages?

    I believe that to hide the additional header ("X-Spam-Report"), all that would be needed is to adjust the Eudora TabooHeaders option to add or include "X-" in the list of headers it will hide. The following is a revised list for the TabooHeaders option based off of the default value from the Eudora web site:
    Code:
    X-,X-UID,Received,Status,X-UIDL,Message,In-Reply,X-Priority,Mime-Version,Content,X-Persona,Resent-Message,References,Return,X400,X-400,Mail-System,Errors-To,X-List,Delivery,Disposition,X-Juno,Precedence,X-Attachments,X-MSMail,X-MimeOLE,X-Nav
    Here are a few related resources that also point to the same TabooHeaders option in Eudora for suppressing the display of specific mail headers:
     
    #18 cPanelDon, Dec 10, 2010
    Last edited: Dec 10, 2010
  19. cPanelDavidG

    cPanelDavidG Technical Product Specialist

    Joined:
    Nov 29, 2006
    Messages:
    11,279
    Likes Received:
    8
    Trophy Points:
    38
    Location:
    Houston, TX
    cPanel Access Level:
    Root Administrator
    Case 45360 is addressed in version 11.28.56. Is this version (or later) available for your update tier? Find out at Downloads - cPanel Inc.
     
  20. rclemings

    rclemings Member

    Joined:
    Nov 5, 2007
    Messages:
    23
    Likes Received:
    1
    Trophy Points:
    3
    Would you consider altering the wording of this header's body as well as its label? It's not really accurate to say "has identified this incoming email as possible spam" when it has the "X-Ham-Report" label. Something like "has analyzed this incoming email" could suffice for both spam and ham, it seems to me, and would reduce potential user confusion.
     
    #20 rclemings, Jan 5, 2011
    Last edited: Jan 5, 2011
Loading...

Share This Page