More Track Delivery Questions

[d_j_wills]

Hi,

I've had questions before about how and why Track Delivery does things. There are still a handful of things that I don't see explained in the documentation. Here is one. I see in Track Delivery that an email has been filtered. The sender appears to be the master user ID at my hosting company and the recipient appears to be the contact email address for my domain. I don't have a clue as to who or why this email would have been generated, and since it was filtered I don't know what the email said. Here is the Track Delivery report:

Event: filtered
User: (my domain userid)
Domain: (my domain)
From Address: (this is my smtp server).inmotionhosting.com
Sender: (my domain userid)
Sent Time: Oct 20, 2020, 4:17:16 PM
Sender Host: localhost
Sender IP: 127.0.0.1
Authentication: localuser
Spam Score:
Recipient: (email address at my domain)
Delivery User: (my domain userid)
Delivery Domain: (my domain)
Delivered To: /dev/null
Router: central_filter
Transport: **bypassed**
Out Time: Oct 20, 2020, 4:17:16 PM
ID: 1kV0sO-00CmH4-88
Delivery Host: localhost
Delivery IP: 127.0.0.1
Size: 745 bytes
Result: Filtered

If I copy the From Address and paste into the Filter Test window, the test says that normal delivery will occur. None of this makes any sense to me.

Any ideas?

Thanks,

Dave

 

[d_j_wills]

Here's a suggested improvement for Track Changes.

I've been fine tuning my spam filters. To make sure that I'm not accidentally filtering valid emails, I scan the Track Delivery report. (I have found some valid emails that are filtered, possibly the one posted above.)

I don't care about emails that are delivered except to further fine tune based on delivery to a user at my domains or Box Trapper. And I don't care about emails that are rejected for RBL violations since there isn't anything I can (or should do) about it. So all I want to do is to look at emails that are filtered. And here's the issue.

There is no way to display just the filtered emails. If you de-select "Show Successes", it also de-selects filtered emails. That's odd. Apparently it classifies filtered emails as successes. And if you select only "Show Failures", it doesn't show the filtered emails.

Would be nice to have a check box that just showed filtered emails (in addition to other check boxes you might choose).

 

[cPanelLauren]

Hi @d_j_wills

I've had questions before about how and why Track Delivery does things. There are still a handful of things that I don't see explained in the documentation. Here is one. I see in Track Delivery that an email has been filtered. The sender appears to be the master user ID at my hosting company and the recipient appears to be the contact email address for my domain. I don't have a clue as to who or why this email would have been generated, and since it was filtered I don't know what the email said.

So this isn't a limitation of Track Delivery it's actually a result of the way that exim logs these transactions. This isn't something you'd be able to see but with the most verbose exim logging enabled on my own server here is what I see for a global filter:

2020-10-21 11:48:38.083 [3267] 1kVHHw-0000oz-Jy => /dev/null <[email protected]> F=<[email protected]> R=central_filter T=**bypassed** S=0 QT=1.464s DT=0.000s

R=central_filter - this is the route or item the email matched, there are three specific types of filters a system filter which is global for the whole server, a central filter which is global per cPanel account, and a virtual_user_filter which is specific to one email address
T=**bypassed** - this is the transport used for delivery and bypassed means it was completely bypassed as it didn't perform a delivery

The rest of the data there pertains to the time spent in the queue (not related to filters)

What this means is that track delivery cannot see based on the exim logs which rule in the "global filter" or central_filter was matched.


The only two ways to do this are:
A. Enter in the header information in the delivery troubleshooter as best possible
or
B. Run exim debug on the transaction/email itself

Unfortunately with your level of access, you wouldn't be able to do the latter.

If you'd like to PM the exact address that matched along with your list of global filters I can probably break that down for you though.

 

[smeko]

Hello,

Please how can i retrieve an email which is discarded (delivered to dev/null) by i filter ?

Please help because in order to filter spam i have missed important emails.

Thank you in advance,

Silvi