Regular messages marked as spam

[kshivachev]

Hello,

We are experiencing the following problem : regular messages sent through our shared server are marked as spam ( you can review the screenshot for more information ). We have checked the blacklists and we are not listed anywhere. Here is the output from the exim log :

# grep domainname /var/log/exim_mainlog 
+++ 1ZtI8b-00066r-OH has not completed +++
2015-11-02 18:39:19 1ZtI8b-00066r-OH H=([192.168.1.100]) [148.0.10.196]:2355 F=<[email protected]> A=dovecot_plain:[email protected] rejected after DATA: "SpamAssassin as cpaneleximscanner detected OUTGOING smtp message as spam (9.0)"

+++ 1ZtJfg-0003dV-AU has not completed +++
2015-11-02 20:17:35 1ZtJfg-0003dV-AU H=([127.0.0.1]) [92.222.124.29]:8343 F=<[email protected]> A=dovecot_plain:[email protected] rejected after DATA: "SpamAssassin as cpaneleximscanner detected OUTGOING smtp message as spam (9.0)"

+++ 1ZtJEe-00021z-O8 has not completed +++
2015-11-02 19:49:39 1ZtJEe-00021z-O8 H=([127.0.0.1]) [92.222.124.29]:50353 F=<[email protected]> A=dovecot_plain:[email protected] rejected after DATA: "SpamAssassin as cpaneleximscanner detected OUTGOING smtp message as spam (9.0)"

+++ 1ZtJfv-0003dV-3l has not completed +++
2015-11-02 20:17:49 1ZtJfv-0003dV-3l H=([127.0.0.1]) [92.222.124.29]:8343 F=<[email protected]> A=dovecot_plain:[email protected] rejected after DATA: "SpamAssassin as cpaneleximscanner detected OUTGOING smtp message as spam (9.0)"

+++ 1ZtMIf-0004pB-63 has not completed +++
2015-11-02 23:05:58 1ZtMIf-0004pB-63 H=(ourservername) [::1]:55676 F=<[email protected]> A=dovecot_login:[email protected] rejected after DATA: "SpamAssassin as cpaneleximscanner detected OUTGOING smtp message as spam (9.0)"

Do you have any idea why the spamassasin is marking a regular messages as spam ?

Regards!

 

[cPanelMichael]

Hello

Is it happening for any message, or is it only happening with specific subjects and message contents?

Thank you.

 

[kshivachev]

Hello,

It happens to any message.

Regards!

 

[cPanelMichael]

Please ensure you are following the guidelines at:

How to Keep your Email out of the Spam Folder - cPanel Knowledge Base - cPanel Documentation

Note that you can disable SpamAssassin for outgoing email by disabling the following option under the "Apache SpamAssassin Options" tab in "WHM >> Exim Configuration Manager":

"Scan outgoing messages for spam and reject based on the Apache SpamAssassin™ internal spam_score setting"

Or, you may want to use "Scan outgoing messages for spam and reject based on defined Apache SpamAssassin™ score" and change the threshold.

Thank you.

 

[kshivachev]

Hello,

Could you please explain on what base you define the spamassasin score ? I want to know on what base my client has received such score and what he needs to fix.

Regards!

 

[cPanelMichael]

Hello

The default score is 5.0:

required_score 5.0

Thank you.

 

[oscar222]

Im getting the same message.
I change the threshold to 9.0, and a couple of months later, same message.

Only happens for a particular user
How can I view wich tests are scoring this message to more than 9 ?

 

[bloatedstoat]

Whilst I have not done this myself I believe one could copy the entire original source of a client email that fails, save it to a file on the server and thereafter pipe it into spamassassin on the command line to reveal scores on tests in the output.

For example:
/usr/local/cpanel/3rdparty/bin/spamassassin -D -t < client-email.txt 2> output.txt

 

[oscar222]

There is no summary in the logs or headers about WHAT tests are contributing to the score (I can see the report in incoming messages, but not in outgoing msg)

 

[cPanelMichael]

You may also want to experiment with disabling the following options under the "Apache SpamAssassin Options" tab in "WHM >> Service Configuration >> Exim Configuration Manager":

Enable BAYES_POISON_DEFENSE Apache SpamAssassin™ ruleset

Enable KAM Apache SpamAssassin™ ruleset

Enable the Apache SpamAssassin™ ruleset that cPanel uses on cpanel.net

It's possible one of these rulesets is the reason for the recent detection of SPAM.

Thank you.