Wanted and Unwanted Email Filtering Questions

[CAGS]

HI all,

I hope there is someone out there that can recognise this problem and offer some advice?

I have been using CPanel's email filters for several years and have gradually added more rules to both account and global filters to delete unwanted emails from specific addresses without encountering any real problems.

However, over the last 6 months or so, I have been getting more and more "spam" emails (which don't seem to be getting picked up by CPanels spam filters) from several "new" high level domains such as .pro, .icu, .it and .co, so I have gradually set up global filters to delete all emails ending in these domains. It seemed to take a while for the system to properly implement these new rules, but things seem to have settled down now, except......

1) Every now and then (once or twice a week) a filtered email which clearly fits the rule, will pop up in the inbox. Why?

2) More importantly, on checking "Track Delivery" I have discovered that occasionally a genuine email gets filtered out for no apparent reason as it does not fit any filter rules and has a spam score below the "mark as spam" and "delete new spam" settings. One such email today had a spam score of -7. At the moment I have the system set to delete all filtered emails, so apart from the "View Details" link on Track Delivery, I have nothing else to go on as to why these genuine email are being deleted. I don't really want to set filtered emails to go to my spam folder as I get about 50+ a day and the genuine emails are relatively few and far between. It is extremely frustratiing that the system doesn't provide any information as to which filter rule has been used to filter a particular email.

As a work round, I have started to add "whitelist" filters at the top of the filter list in the hope that future emails from the affected sender will not get deleted again, but of course, as I don't know in advance which genuine senders are going to be filtered, this is a case of bolting the stable door etc.

I am at my wits end and would appreciate any advice on how I can resolve this issue before I loose a really important email.

Thanks for reading this and for any advice you can offer.

 

[keat63]

I've had similar and it's usually down to a conflicting rule.
Could you have any other filters or rules which might counteracts the .pro, .icu, .it and .co, filter, and visa versa ?

 

[cPanelMichael]

Hello @CAGS,

cPanel & WHM version 84 includes new functionality to address this need without setting up custom filter rules. You can read more about this at:

How to block emails by wildcard across a server

Exim Version 4.91-5 WHM version 78.0.23 There are many email domains that are receiving spams from the same source emails, SpamAssassin is impractical as this blocks wildcard domains only on a per-account basis. What I want to do: -- Check a sending domain matches a set pattern or a wildcard...

forums.cpanel.net

Filter Incoming Emails by Domain - Version 84 Documentation - cPanel Documentation

documentation.cpanel.net

Filter Incoming Emails by Country - Version 84 Documentation - cPanel Documentation

documentation.cpanel.net

Thank you.

 

[CAGS]

Thanks for your replies Keat63 and CPanelMichael. Apologies for the delay, but having posted the question I was then away from home for a few days so could not respond immediately.

Keat63 - I had thought that there might be some conflicts in the various rules I have set up, but a quick review did not highlight anything obvious. However I will take some time over the next few days to go through all the rules again to check, and have a go at tidying them up, as I do have some "User" filters which might be clashing with "Global" filters.

CPanelMichael - Thanks to you also, but before I delve into all of this, can you advise how I can update my CPanel and access WHM. At the moment, my hosting provider only provides access to CPanel version 82.0.15 (according to the little logo at the bottom of the front page) and I have only a vaugue idea what WHM is, and no idea how to use it. My hosting provider is TSOHost, should I be contacting them?
In general terms however the filters I have set up to stop specific domains and high level domains (eg .icu ) DO seem to work 99% of the time. It is just the occasional spam email which creeps through and, much more importantly, the occasional genuine email which gets caught by the filters for no apparent reason, which I would like to resolve.
Is there any way that I can view a report on a filtered email to see what filter it was caught by?

Thanks both again. Responses much appreciated.