E-mails being treated as spam despite having negative SA score

jhitesma

Active Member
Jun 17, 2007
25
0
51
I'm at a complete loss on this one and the client is getting really upset about e-mails ending up in their spam account. It only seems to happen with messages from one specific domain, but it's an important one they need to be receiving e-mail from. The domain is even in SA's white list but the messages are still getting redirected to their spam account

Running WHM 11.28.86 the accounts are setup with SpamAssassin, box trapper was running but has been disabled since we initially thought it was somehow to blame. They have 8 filters setup to catch spam and redirect them to a gmail account used for collecting spam. The 6 of the 8 filters look for the words "acai" "viagra" "pfizer" in the subject or header and redirect to the spam address if found. The other two filters check the X-Spam-Status and X-Spam-Bar fields and also redirect to the spam address if found.

I've used the "Filter Test" on the account level filtering cpanel page (they have no user level filters configured, I double checked.) and the messages that are getting redirected come up as "Normal Delivery" showing that they don't match any of the filters. Yet for some reason when they initially come in they are getting redirected.

The only thing odd I see in the headers are two X-Spam-Status lines:

X-Spam-Status: No, hits=0.0 required=4.0
tests=AWL: 0.048,BAYES_00: -1.665,HTML_MESSAGE: 0.001,
RDNS_NONE: 0,TOTAL_SCORE: -1.616,autolearn=ham
X-Spam-Level:
At the very top of the headers between two "Received:" headers and before the From: Sender: To: and Cc: headers. Then lower down where I expect to find them:

X-Spam-Status: No, score=-101.9
X-Spam-Score: -1018
X-Spam-Bar: ---------------------------------------------------
X-Ham-Report: Spam detection software, running on the system "OUR SERVER", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: REDACTED
Content analysis details: (-101.9 points, 8.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-100 USER_IN_WHITELIST From: address is in the user's white-list
0.0 UNPARSEABLE_RELAY Informational: message has unparseable relay lines
-1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1%
[score: 0.0000]
0.0 HTML_MESSAGE BODY: HTML included in message
-0.0 AWL AWL: From: address is in the auto white-list
X-Spam-Flag: NO
(Private information redacted in the content preview and our server name replaced with "OUR SERVER" for privacy)

So bottom line is I can't find anything configured on this account that should be forwarding these messages to their spam account instead of normal delivery. But they keep ending up in the spam account instead of the users inbox.

Any help would be greatly appreciated as the client is getting very anxious. We even tried moving them from an older server, with an older version of WHM/Cpanel, to a new server with this version. In large part because they were using box trapper on some accounts and the old server had a bug that was putting /'s into the addresses in their boxtrapper white lists causing them not to be detected. But due to these issues they've disabled boxtrapper entirely in cause it was contributing to the problem.
 

cPanelTristan

Quality Assurance Analyst
Staff member
Oct 2, 2010
7,607
40
248
somewhere over the rainbow
cPanel Access Level
Root Administrator
Can you provide the exact filters being used for these two?

X-Spam-Status
X-Spam-Bar
 

jhitesma

Active Member
Jun 17, 2007
25
0
51
Sorry for the slow reply, I had notifications enabled but never saw one that there had been a reply.

Today I was able to determine which filter is being triggered. Since the filters forward to a gmail box I added some + addressing to be able to determine which filter was causing messages to forward. And confirmed it's the one checking the X-Spam-Status:

It shows up on the account level filtering page as:

$h_X-Spam-Status: contains Yes

It has one rule setup: "Spam Status" "Contains" "yes" Redirect to [email protected]

(with the actual account name replaced by ACCOUNT)

What's odd though is sending that same message through the filter test it doesn't trigger the filter and says it would be delivered normally, which makes sense since neither "X-Spam-Status" line contains "Yes". Though I do see the Filter Trace saying "Warning: no message headers read" even though the message headers are being pasted into the input box.

Spam Status header that appears before the normal message headers:
X-Spam-Status: No, hits=0.0 required=4.0
tests=AWL: 0.047,BAYES_00: -1.665,HTML_MESSAGE: 0.001,
RDNS_NONE: 0,TOTAL_SCORE: -1.617,autolearn=ham
Spam Status header from our server in the normal location:
X-Spam-Status: No, score=-102.0

Ok, little update. I was able to get the Filter Trace to work. There was a blank line at the top of the message I was pasting which apparently was causing it to not detect any headers. With the blank line removed the Filter trace returns:

The Filter has matched the following condition(s):

$h_X-Spam-Status: contains Yes
However neither X-Spam-Status line actually does contain "Yes" The one that's being added before the message gets to our server does contain "BAYES" which has yes within it.

So I guess the new question is how to rewrite that filter so it won't trigger on "BAYES"
 

cPanelTristan

Quality Assurance Analyst
Staff member
Oct 2, 2010
7,607
40
248
somewhere over the rainbow
cPanel Access Level
Root Administrator
For the filters, you need to use equals not contains. Contains will always have BAYES in it, while equals will only have YES when it's spam.
 

jhitesma

Active Member
Jun 17, 2007
25
0
51
I would have assumed that equals would require the entire header to match. Live and learn. I changed it to "starts with" which is what I noticed most of our other clients were using since the yes/no is always the first thing.