Hello,
I'm the cPanel/WHM server admin for a client of mine, who have many of their own clients hosted on the server. My client is using a third party service, bitrix24.com, which sends out emails. Bitrix24 works with mail by requiring you to enter the details of your own SMTP server (including username and password so it can authenticate), and uses that to send its mail, so it basically acts as an SMTP client to our mail server, rather than its own mail server that delivers directly.
The problem we're having is that any mail sent that has a non-local destination gets blocked by SpamAssassin when it tries to leave our server (we scan outgoing mail for spam). If the recipient is local, it is accepted fine. If the destination is non-local, it is accepted by Exim from Bitrix24, but is scanned again by SpamAssassin on the way out of our server and is always blocked. Since there's no SpamAssassin report for outgoing scans, there's no way to tell why they are failing. /var/log/exim_rejectlog doesn't include the SpamAssassin report.
I grabbed a copy of such an email from a local account that it was also delivered to, and ran that through SpamAssassin manually. I don't know if doing it this way is identical to the scan done on outgoing mail, but it reported the two biggest issues as: HELO_DYNAMIC_IPADDR and RDNS_DYNAMIC. I understand what these are about, but most of the internet says the solution is "Fix your mail server's name" and "Trust your dynamic subnets" ... but that doesn't apply to us, since it's a third party mail server that initiates the message and we have no control over their server names or subnets.
The relevant headers (with some names changed for privacy):
So I can see above that HELO_DYNAMIC_IPADDR and RDNS_DYNAMIC could certainly apply, as the mail hopped through a couple of Bitrix24's AWS servers before coming to us. But I don't understand why it passes the first spam check (when it comes into our server) but not the second (when outgoing to a non-local recipient). I also don't want to tell Bitrix24 that the problem is with them, until I'm sure it is. It's hard to believe we'd be the first Bitrix24 customer to have this issue, but at the same time, we have no issues with other outgoing mail getting blocked as spam (unless it really is spam).
I'm wondering if anyone has any recommendations on where to go from here - either how to troubleshoot Exim/SpamAssassin further and get it to allow these through, OR determine that the problem really is with Bitrix24 so I can start discussion with them. Thanks in advance for any help!
I'm the cPanel/WHM server admin for a client of mine, who have many of their own clients hosted on the server. My client is using a third party service, bitrix24.com, which sends out emails. Bitrix24 works with mail by requiring you to enter the details of your own SMTP server (including username and password so it can authenticate), and uses that to send its mail, so it basically acts as an SMTP client to our mail server, rather than its own mail server that delivers directly.
The problem we're having is that any mail sent that has a non-local destination gets blocked by SpamAssassin when it tries to leave our server (we scan outgoing mail for spam). If the recipient is local, it is accepted fine. If the destination is non-local, it is accepted by Exim from Bitrix24, but is scanned again by SpamAssassin on the way out of our server and is always blocked. Since there's no SpamAssassin report for outgoing scans, there's no way to tell why they are failing. /var/log/exim_rejectlog doesn't include the SpamAssassin report.
I grabbed a copy of such an email from a local account that it was also delivered to, and ran that through SpamAssassin manually. I don't know if doing it this way is identical to the scan done on outgoing mail, but it reported the two biggest issues as: HELO_DYNAMIC_IPADDR and RDNS_DYNAMIC. I understand what these are about, but most of the internet says the solution is "Fix your mail server's name" and "Trust your dynamic subnets" ... but that doesn't apply to us, since it's a third party mail server that initiates the message and we have no control over their server names or subnets.
The relevant headers (with some names changed for privacy):
Code:
Return-path: <[email protected]>
Received: from mta-us-002.bitrix24.com ([50.19.124.94]:51416)
by myserver.mydomain.com with esmtpsa (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.93)
(envelope-from <[email protected]>)
id 1jnNPr-0002aM-SF; Mon, 22 Jun 2020 10:27:20 -0400
Received: from ip-10-149-184-16.ec2.internal ([10.149.184.16] helo=ec2-3-83-161-87.compute-1.amazonaws.com)
by mta-us-002.bitrix24.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.93)
(envelope-from <[email protected]>)
id 1jnNPr-0000zn-HX; Mon, 22 Jun 2020 17:27:19 +0300
Received: from localhost ([127.0.0.1] helo=ec2-3-83-161-87.compute-1.amazonaws.com)
by ec2-3-83-161-87.compute-1.amazonaws.com with smtp (Exim 4.93)
(envelope-from <[email protected]>)
id 1jnNPr-0000ge-GM; Mon, 22 Jun 2020 17:27:19 +0300
Received: (from [email protected])
by ec2-3-83-161-87.compute-1.amazonaws.com (mini_sendmail/1.3.9 23Oct2019);
Mon, 22 Jun 2020 17:27:19 MSK
(sender [email protected])I'm wondering if anyone has any recommendations on where to go from here - either how to troubleshoot Exim/SpamAssassin further and get it to allow these through, OR determine that the problem really is with Bitrix24 so I can start discussion with them. Thanks in advance for any help!
