The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Server isn't spam assassin scanning some emails

Discussion in 'E-mail Discussions' started by floppyfringe, Dec 4, 2014.

  1. floppyfringe

    floppyfringe Active Member

    Joined:
    Jan 21, 2010
    Messages:
    28
    Likes Received:
    0
    Trophy Points:
    1
    cPanel Access Level:
    Root Administrator
    A number of spam messages are getting through, it seems all of them have the following in the headers:

    X-Spam-Status: No, score=
    X-Spam-Score:
    X-Spam-Bar:
    X-Ham-Report:
    X-Spam-Flag: NO

    We are starting to wonder if our SA on the cPanel servers was down. But now we are thinking SA is not checking emails because SA thinks that it has been checked and found not to be spam already.

    Is anyone else finding this? Quite a lot of spam is getting through, and we're starting to think the spammer has added the headers to claim the email is spam free and prevent further checking.

    We've even tried turning spam assassin off for a few days and still the above headers are present (checked exim logs and queue is empty). Someone has to be adding these blank headers.

    Does anyone know if SA only scans once? Is there a way of forcing our server to scan (or "re-scan") emails?

    Thanks
     
  2. madmanmachines

    madmanmachines Well-Known Member

    Joined:
    Nov 28, 2014
    Messages:
    94
    Likes Received:
    3
    Trophy Points:
    8
    cPanel Access Level:
    Root Administrator
    Hi,

    I see many users not enable SpamAssassin entirely. Please check WHM > Home »Service Configuration »Service Manager and ensure that "spamd" or "Spam Assassin" is enabled. Additionally some users forget to do the opposite, so ensure it is enabled in the desired cPanel account under "Spam Assassin". If no icon is present in cPanel for Spam Assassin, please check the corresponding feature list for the account at WHM > Home »Packages »Feature Manager. As well, you may wish that all accounts use Spam Assassin, which you may set at WHM > Home »Service Configuration »Exim Configuration Manager > SpamAssassin Options by selecting " Apache SpamAssassin™: Forced Global ON".

    If you have already ensured the above, I would check to see that the spam daemon is actually running. You can check with the following command from SSH:

    Code:
    ps aux|grep spamd|grep -v spam
    Or you could go ahead and jump the gun and issue a restart of the daemon:

    Code:
    /scripts/restartsrv_spamd
    Let us know what you find.

    Thanks,
     
  3. floppyfringe

    floppyfringe Active Member

    Joined:
    Jan 21, 2010
    Messages:
    28
    Likes Received:
    0
    Trophy Points:
    1
    cPanel Access Level:
    Root Administrator
    We did globally disable SA and only left a few domains who got the strange "Not Spam No Score" headers.

    X-Spam-Status: No, score=
    X-Spam-Score:
    X-Spam-Bar:
    X-Ham-Report:
    X-Spam-Flag: NO

    It is globally re-enabled now, but we still see the above, and it seems to prevent our servers from scanning email :(

    Is there anything within EXIM that searches to see if the email has already been checked and the above is enough to prevent the server from doing another SA scan?

    I wasn't that keen on posting this here in case it is a way that spammers are fooling cPanel from not doing SA scans.
     
  4. madmanmachines

    madmanmachines Well-Known Member

    Joined:
    Nov 28, 2014
    Messages:
    94
    Likes Received:
    3
    Trophy Points:
    8
    cPanel Access Level:
    Root Administrator
    Hi,

    Did you run the suggested commands to ensure that the spam daemon is running? You may need to submit a ticket to cPanel directly so they can take a look, which would also keep your data confidential.

    Thanks,
     
  5. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    30,678
    Likes Received:
    653
    Trophy Points:
    113
    cPanel Access Level:
    Root Administrator
    Hello :)

    Feel free to open a support ticket using the link in my signature so we can take a closer look. You can post the ticket number here so we can update this thread with the outcome.

    Thank you.
     
Loading...

Share This Page