Email is shown as "Accepted" in the log but not delivered to Inbox

Crimpshrine

Registered
Apr 1, 2015
4
0
51
Chicago, IL
cPanel Access Level
Root Administrator
I don't know how this started happening, but it all of sudden started this year. I've never seen this issue before and I had not changed the server setting for months. I first noticed this problem with other instances, but today I have observed similar problem with different email sender.

I placed 3 online orders with [Removed] (using the same user account and maybe 5 minutes intervals between orders) and I am supposed to receive 3 separate order confirmations for each order, but I only received the 2nd one and the 3rd one. When I went in to WHM to see mail delivery log, all three confirmations are received by the server as "Accepted."

Although nowhere in Exim setup says to ban the email that has certain spam score or above or anything, so I could not figure out why this was happening.

In the 1st email confirmation (which was not delivered and I only downloaded this lost email from WHM), the header says:

-------------------------------------------------------------
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_Part_431380_-579664385.1452624137337"
OD-JMailer: ODEN PROD SERVER 1 - DEC 17 2015
X-OriginalArrivalTime: 12 Jan 2016 18:42:17.0946 (UTC) FILETIME=[F696A3A0:01D14D68]
X-Spam-Status: Yes, score=3.1
X-Spam-Score: 31
X-Spam-Bar: +++
X-Spam-Report: Spam detection software, running on the system "www2.MYSERVER.com",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
--------------------------------------------------------------


Then, the 2nd email (which was delivered to inbox), the header says:

--------------------------------------------------------------
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_Part_433380_1321388188.1452624495843"
OD-JMailer: ODEN PROD SERVER 1 - DEC 17 2015
X-OriginalArrivalTime: 12 Jan 2016 18:48:16.0425 (UTC) FILETIME=[CC423190:01D14D69]
X-Spam-Status: No, score=1.5
X-Spam-Score: 15
X-Spam-Bar: +
X-Ham-Report: Spam detection software, running on the system "www2.MYSERVER.com",
has NOT identified this incoming email as spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
--------------------------------------------------------------


Both of the email are coming from the same location, but one having very high spam score and the other half of the score.

SpamAssassin is not currently set for:
1) to reject spam score threshold
2) ratelimit spam score threshold
3) Global Subject Rewrite (this was "on" but turned "off")
4) bounce spam score threshold

SpamAssassin is currently set for:
1) BAYES_POISON_DEFENSE Apache SpamAssassin™ ruleset
2) Passive OS Fingerprinting for Apache SpamAssassin™
3) KAM Apache SpamAssassin™ ruleset
4) Apache SpamAssassin™ ruleset that cPanel uses on cpanel.net

Can anyone point out if something is wrong with my setup? I don't see consistency in each of these as sometimes it gets marked as spam and sometimes it doesn't, so I don't know how to resolve this issue. Again, this was never a problem until last year.
 
Last edited by a moderator:

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,904
2,218
463
Hello :)

Could you let us know the output from /var/log/exim_mainlog for each message so we can see the SPAM score? EX:

Code:
exigrep [email protected] /var/log/exim_mainlog
Thank you.
 

Crimpshrine

Registered
Apr 1, 2015
4
0
51
Chicago, IL
cPanel Access Level
Root Administrator
Sorry, this issue was resolved. It was taking all the email with header ***SPAM*** into a hidden IMAP folder called "spam". This folder was not necessarily subscribed in the email client and also not shown on the webmail, so this was why we thought that email was "disappearing" although the log had accepted them. Once the "spam" folder was subscribed in the email client, it loaded tons of "disappeared" email that we were looking for.

Thank you, and sorry for the hassle.
 

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,904
2,218
463
I am happy to see you were able to resolve the issue. Thank you for updating us with the outcome.
 
  • Like
Reactions: ebuka