The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Email getting sent to /dev/null

Discussion in 'E-mail Discussions' started by DimensionZero, Oct 25, 2011.

  1. DimensionZero

    DimensionZero Member

    Joined:
    Jul 26, 2007
    Messages:
    11
    Likes Received:
    0
    Trophy Points:
    1
    Location:
    Vancouver, BC
    I've been having a weird issue lately with one person trying to email me...
    I found an old thread that was similar (http://forums.cpanel.net/f5/emails-not-delivered-60273.html), and made sure there were no filters.

    I do have a forwarder setup on my email to send a copy to another address but I even tried removing it and recreating it to be sure it wasn't something off there but that hasn't made any difference...

    Here's the log entry in exim_mainlog

    Any ideas?

    Thanks!!
     
  2. Infopro

    Infopro cPanel Sr. Product Evangelist
    Staff Member

    Joined:
    May 20, 2003
    Messages:
    14,478
    Likes Received:
    203
    Trophy Points:
    63
    Location:
    Pennsylvania
    cPanel Access Level:
    Root Administrator
    Twitter:
    Have you modified any settings in cPanel > Mail section > SpamAssassin?
     
  3. DimensionZero

    DimensionZero Member

    Joined:
    Jul 26, 2007
    Messages:
    11
    Likes Received:
    0
    Trophy Points:
    1
    Location:
    Vancouver, BC
    I added the person's email into SpamAssassin's whitelist when this happened the first time just to make sure, it wasn't that. But even looking at the log entry, SpamAssassin says it's good so I'm not sure what's sending it into the void.
     
  4. cPanelTristan

    cPanelTristan Quality Assurance Analyst
    Staff Member

    Joined:
    Oct 2, 2010
    Messages:
    7,623
    Likes Received:
    21
    Trophy Points:
    38
    Location:
    somewhere over the rainbow
    cPanel Access Level:
    Root Administrator
    There is definitely a filter that exists indicated by this portion of the log:

    What have you checked precisely? There are filters that can be made in the following locations:

    /etc/vfilters/domain.com
    /home/username/etc/domain.com/emailuser/

    Above domain.com represents the domain name, username represents the cPanel username, and emailuser represents the local part (first part) of the email address such as admin in the email address admin@domain.com.

    Now, what I suspect you've done is add an Account Level Filter that would be in /etc/vfilters/domain.com file for the domain in question. In that filter, you probably put the following:

    Code:
    if
     $h_X-Spam-Status: contains "YES"
    then
     save "/dev/null" 660
    endif
    This means if any email comes in with a Spam Status containing YES, that the message will be discarded. This sounds great on the surface, but all Spam messages flagged by SpamAssassin have BAYES in them for Bayesian filtering. Since YES is part of (contained in) BAYES, every message would be discarded.

    Now, if that isn't the case, then you will need to remove each filter in /etc/vfilters/domain.com file (make a backup copy and then remove the filters) and remove the filters in /home/username/etc/domain.com/emailuser location. This is definitely a filter, you just have to figure out what filter it happens to be. Looking for any filter that has contains in it rather than equals would be one of the first signs. Using contains is a poor filtering method and will trigger unexpected results.
     
  5. DimensionZero

    DimensionZero Member

    Joined:
    Jul 26, 2007
    Messages:
    11
    Likes Received:
    0
    Trophy Points:
    1
    Location:
    Vancouver, BC
    Hi Tristan,

    There are no filters on the domain in /etc/vfilters which was something I had checked before as per the other forum posts, but I did find one in the /home/username/etc/domain.com/emailuser/ directory which was autogenerated by cpanel which reads:

    Code:
    #Delete Spam
    if
     $h_X-Spam-Status: begins "Yes"
    then
     save "/dev/null" 660
    endif
    
     
  6. cPanelTristan

    cPanelTristan Quality Assurance Analyst
    Staff Member

    Joined:
    Oct 2, 2010
    Messages:
    7,623
    Likes Received:
    21
    Trophy Points:
    38
    Location:
    somewhere over the rainbow
    cPanel Access Level:
    Root Administrator
    Are there any other filters in that file at all besides that one? Using "begins" shouldn't cause an issue, although you are welcome to remove the filter temporarily to see the results.

    Also, this wouldn't have been auto generated by cPanel, since cPanel doesn't configure the filters automatically. The filter would have been created by the email user in cPanel > User Level Filtering section.
     
  7. DimensionZero

    DimensionZero Member

    Joined:
    Jul 26, 2007
    Messages:
    11
    Likes Received:
    0
    Trophy Points:
    1
    Location:
    Vancouver, BC
    Ohhh right, I misread the comments in the file about it being auto generated.

    There's nothing else in the file, I'll try removing that one filter to see if it makes any difference.

    Any other thoughts?
     
  8. DimensionZero

    DimensionZero Member

    Joined:
    Jul 26, 2007
    Messages:
    11
    Likes Received:
    0
    Trophy Points:
    1
    Location:
    Vancouver, BC
    Hmm, so after removing that filter, mail is coming in again, but I found something interesting.

    Seems like the mail that would have normally been deleted never had the X-Spam-Status header in them. Why would that be? Found out today I wasn't getting mail from someone else until I removed the filter... Any ideas why some of the mail isn't being checked for spam?

    Just like the other, SpamAssassin reported it as NOT spam.

    Do you think I could adjust the filter to check for the existence of "X-Spam-Status" header before checking the status?
     
  9. cPanelTristan

    cPanelTristan Quality Assurance Analyst
    Staff Member

    Joined:
    Oct 2, 2010
    Messages:
    7,623
    Likes Received:
    21
    Trophy Points:
    38
    Location:
    somewhere over the rainbow
    cPanel Access Level:
    Root Administrator
    If SpamAssassin reported an email as not spam, it has to have the X-Spam-Status header in it. You'll only see that header in the full header details.

    I believe you should change the filter to be equals rather than begins for X-Spam-Status since equals means it has to equal YES for being spam.
     
Loading...

Share This Page