SOLVED Mark "not spam" in roundcube

[Nicola Urbinati]

Hi,

It occurs that some mails between the same domain or between domains on the same server are put in the Spam directory.
Using Roundcube, I put them back in Incoming dir, but they come back in the Spam dir.

Here is an example:

Return-Path: <[email protected]>
Delivered-To: [email protected]
Received: from srvcp01.example.com
by srvcp01.example.com with LMTP
id ACr5DkmAfVx5FygAf5IjpA
(envelope-from <[email protected]>)
for <[email protected]>; Mon, 04 Mar 2019 20:45:13 +0100
Return-path: <[email protected]>
Envelope-to: [email protected]
Delivery-date: Mon, 04 Mar 2019 20:45:13 +0100
Received: from [::1] (port=36196 helo=srvcp01.example.com)
by srvcp01.example.com with esmtpa (Exim 4.91)
(envelope-from <[email protected]>)
id 1h0tWP-00B1Vg-Bf
for [email protected]; Mon, 04 Mar 2019 20:45:09 +0100
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="=_908127cc2d9daa6ad4fefa28a4e0456a"
Date: Mon, 04 Mar 2019 20:45:09 +0100
From: Servizio Informazioni <[email protected]>
To: [email protected]
Subject: Prova
Organization: Dreamlord Press
Message-ID: <[email protected]>
X-Sender: [email protected]
User-Agent: Roundcube Webmail/1.3.7
X-DreamlordPress-MailScanner-Information: Please contact the ISP for more information
X-DreamlordPress-MailScanner-ID: 1h0tWP-00B1Vg-Bf
X-DreamlordPress-MailScanner: Found to be clean
X-DreamlordPress-MailScanner-SpamCheck: not spam (whitelisted),
SpamAssassin (not cached, score=-0.998, required 5,
ALL_TRUSTED -1.00, HTML_MESSAGE 0.00, URIBL_BLOCKED 0.00)
X-DreamlordPress-MailScanner-From: [email protected]
X-Spam-Status: No

It seems not to be flagged as spam.
The very same message, with swapped sender-receiver, ends in Incoming not in Spam, so something strange is happening on one of the mail accounts.

 

[cPanelMichael]

Hello @Nicola Urbinati,

Can you post the entry from /var/log/exim_mainlog for one of the affected messages? EX:

exigrep subject /var/log/exim_mainlog

Replace "subject" with the subject associated with one of the emails affected by this issue.

Thank you.

 

[Nicola Urbinati]

Hi,

Here is the output of that code.

2019-03-04 20:41:02 1h0tSQ-00B14q-1A <= [email protected] H=(srvcp01.urbaman.it) [::1]:60074 P=esmtpa A=dovecot_login:[email protected] S=1404 [email protected] T="Prova" for [email protected]
2019-03-04 20:41:04 1h0tSQ-00B14q-1A => urbaman <[email protected]> R=virtual_user T=dovecot_virtual_delivery C="250 2.0.0 <[email protected]> XFr1DlB/fVzzECgAf5IjpA Saved"
2019-03-04 20:41:04 1h0tSQ-00B14q-1A Completed

2019-03-04 20:43:53 1h0tVB-00B1IG-Qz <= [email protected] H=(srvcp01.urbaman.it) [::1]:34816 P=esmtpa A=dovecot_login:[email protected] S=1460 [email protected] T="Prova" for [email protected]
2019-03-04 20:43:56 1h0tVB-00B1IG-Qz => info <[email protected]> R=virtual_user T=dovecot_virtual_delivery C="250 2.0.0 <[email protected]> eTdjOvt/fVwyFCgAf5IjpA Saved"
2019-03-04 20:43:56 1h0tVB-00B1IG-Qz Completed

2019-03-04 20:45:09 1h0tWP-00B1Vg-Bf <= [email protected] H=(srvcp01.urbaman.it) [::1]:36196 P=esmtpa A=dovecot_login:[email protected] S=1404 [email protected] T="Prova" for [email protected]
2019-03-04 20:45:13 1h0tWP-00B1Vg-Bf => urbaman <[email protected]> R=virtual_user T=dovecot_virtual_delivery C="250 2.0.0 <[email protected]> ACr5DkmAfVx5FygAf5IjpA Saved"
2019-03-04 20:45:13 1h0tWP-00B1Vg-Bf Completed

2019-03-04 21:03:06 1h0tnm-00B354-Ab <= [email protected] H=(srvcp01.urbaman.it) [::1]:55428 P=esmtpa A=dovecot_login:[email protected] S=1412 [email protected] T="Prova" for [email protected]
2019-03-04 21:03:08 1h0tnm-00B354-Ab Sender identification U=domain D=domain.it [email protected]
2019-03-04 21:03:08 1h0tnm-00B354-Ab SMTP connection outbound 1551729788 1h0tnm-00B354-Ab domain.it [email protected]
2019-03-04 21:03:09 1h0tnm-00B354-Ab => [email protected] R=dkim_lookuphost T=dkim_remote_smtp H=mail.glockapps.com [52.4.163.16] X=TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=yes C="250 2.0.0 OK: queued as c965cd40571fdbcdb3862402b00d1b55"
2019-03-04 21:03:09 1h0tnm-00B354-Ab Completed

And these are the last two tests, with the same result (the first goes to inbox, the second to spam)

2019-03-05 01:31:00 1h0xz2-00BTFS-Qc <= [email protected] H=(srvcp01.urbaman.it) [::1]:51756 P=esmtpa A=dovecot_login:[email protected] S=1460 [email protected] T="Prova" for [email protected]
2019-03-05 01:31:07 1h0xz2-00BTFS-Qc => info <[email protected]> R=virtual_user T=dovecot_virtual_delivery C="250 2.0.0 <[email protected]> W8qCJEvDfVwduCkAf5IjpA Saved"
2019-03-05 01:31:07 1h0xz2-00BTFS-Qc Completed

2019-03-05 01:31:32 1h0xzY-00BTI9-4M <= [email protected] H=(srvcp01.urbaman.it) [::1]:52334 P=esmtpa A=dovecot_login:[email protected] S=1404 [email protected] T="Prova" for [email protected]
2019-03-05 01:31:35 1h0xzY-00BTI9-4M => urbaman <[email protected]> R=virtual_user T=dovecot_virtual_delivery C="250 2.0.0 <[email protected]> mAYBJGfDfVwduCkAf5IjpA Saved"
2019-03-05 01:31:35 1h0xzY-00BTI9-4M Completed

 

[cPanelMichael]

Hello @Nicola Urbinati,

I don't see anything that indicates why those emails are automatically moved to the SPAM folder. Can you open a support ticket so we can take a closer look to see why that's happening? You can post the ticket number here and we'll link this thread to it.

Thank you.

 

[Nicola Urbinati]

Ticket: 11596945

 

[cPanelMichael]

Hello,

To update, it looks like it was an individual email client connected via IMAP that was moving the message to the SPAM folder. Let us know if you have any additional concerns.

Thank you.

 

[Nicola Urbinati]

Correct, thank you.

I have no more issues on this front.