SOLVED Global Email Filters not applying first time

[tmurdock]

Hoping someone else has seen this happen. I have set several global email filters to match certain strings in the body of an email related to some unrelentless spammers that keep changing domains and hosts but have a certain phrase that is contained in every email.

The odd thing is the global filter will not catch the email upon delivery from the spam email server (which is always different), but when a user forwards the email to me, the spam filter works and will move the email to the correct folder.

I have tried creating the filters in cPanel's Global Email Filter as well as recreating them in the exim sysfilter folder but the result is the same no matter what. Spamassassin does scan the email but it doesn't get high enough score to flag it as spam.

Any ideas?

 

[cPRex]

Hey there! What happens with the global filter? Is it supposed to move the mail to a certain folder? Do you see the filter being applied if you check the /var/log/exim_mainlog file?

 

[tmurdock]

Hi there!

Yes, the global filter is supposed to move the message into catch-all email addresses' inbox. When the original message is received from the external source the filter is not applied and does not show up in the log. However when the internal user forwards it to me, the system filter is applied and moves it correctly and shows it in the logs.

The global filter does not seem to apply on the first instance of the email being received. I have tried to move that filter to the top of the list to take precedence but it still seems to have no effect.

 

[cPRex]

Well that's odd - this might be something we have to see in action in order to assist with, so could you submit a support ticket to our team so we can take a look?

 

[tmurdock]

Sure thing, will do it now!

Thanks!

 

[cPRex]

If you can post the number here so I can follow along that would be great!

 

[tmurdock]

Sure, the ticket # is 94467967.

 

[cPRex]

Thanks for that - I'm following along with that on my end now.

 

[cPRex]

It turns out the initial message was sent with base64 encoding, so the text string of the filter technically didn't exist in the message. Solving the issue completely would mean changing the way that message is sent, or handling the filtering differently on the server side.

 

[tmurdock]

I have decided to match a text string in the headers themselves since most emails are received from one or two hosts. Thank you for all the help!

 

[cPRex]

You're very welcome! I'm glad we could help isolate the issue once we had access to the server!