Wrong script in spam detection system

Misiek

Well-Known Member
Feb 23, 2004
130
3
168
cPanel Access Level
Root Administrator
Hello,
I think there is a mistake in /etc/cpanel_exim_system_filter
I had in one of my client Spam score set to 5, then i recieved a notice that his clients get reject message :
Code:
The mail server detected your message as spam and has prevented delivery (10).
Then i checked exim_mainlog why is that
Code:
1TRhWI-000156-6O cancelled by system filter: The mail server detected your message as spam and has prevented delivery (10).
So i try to check what is the spam score of the message :

Code:
X-Spam-Status: No, score=1.4
X-Spam-Score: 14
X-Spam-Bar: +
X-Ham-Report: Spam detection software, running on the system ********, has
 identified this incoming email as possible spam.  The original message
 has been attached to this so you can view it (if it isn't spam) or label
 similar future email.  If you have any questions, see the administrator of that system for details.

 Content analysis details:   (1.4 points, 10.0 required)
 
  pts rule name              description
 ---- ---------------------- --------------------------------------------------
 -0.0 SPF_PASS               SPF: sender matches SPF record
  0.9 SPF_HELO_SOFTFAIL      SPF: HELO does not match SPF record (softfail)
  0.7 HTML_IMAGE_ONLY_28     BODY: HTML: images with 2400-2800 bytes of words
  0.0 HTML_MESSAGE           BODY: HTML included in message
 -0.2 AWL                    AWL: From: address is in the auto white-list
X-Spam-Flag: NO
Code:
X-Mailer: Apple Mail (2.1283)
X-Spam-Status: No, score=1.9
X-Spam-Score: 19
X-Spam-Bar: +
X-Ham-Report: Spam detection software, running on the system "*******", has
identified this incoming email as possible spam.  The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email.  If you have any questions, see
the administrator of that system for details.

Content preview:  

Content analysis details:   (1.9 points, 5.0 required)

 pts rule name              description
---- ---------------------- --------------------------------------------------
-0.7 RCVD_IN_DNSWL_LOW      RBL: Sender listed at http://www.dnswl.org/, low
                            trust
                            [74.125.82.41 listed in list.dnswl.org]
 0.0 FREEMAIL_FROM          Sender email is commonly abused enduser mail provider
                            (guillaumedelebecque[at]gmail.com)
-0.0 SPF_PASS               SPF: sender matches SPF record
 0.8 HTML_IMAGE_RATIO_02    BODY: HTML has a low ratio of text to image area
 0.0 HTML_MESSAGE           BODY: HTML included in message
 1.8 HTML_IMAGE_ONLY_08     BODY: HTML: images with 400-800 bytes of words
X-Spam-Flag: NO
So score is 1.4 spam score is 14 second case score 1.9 spam score 19 but the message should not be classified as spam but in /etc/cpanel_exim_system_filter i found this :

Code:
# The spam score is the "int" value.  For example a spam score of 2.5 would be 25
# and a spam score of 5.0 would be 50

if ($h_X-Spam-Score: matches \N^\d+$\N and $h_X-Spam-Score: is above 10)
then
    fail text "The mail server detected your message as spam and has prevented delivery (10)."
endif
# END - Included from /usr/local/cpanel/etc/exim/sysfilter/options/fail_spam_score_over_int
So the question now is Spam score is 14 or is it 1.4, in my opinion there is an error and should be is above 100 not above 10
 
Last edited:

Infopro

Well-Known Member
May 20, 2003
17,075
524
613
Pennsylvania
cPanel Access Level
Root Administrator
Twitter
Would you mind posting the ticket ID here please? I'd like to follow along with it if I could.

It's always best to log bugs into the system so that cPanel can track an issue against other similar issues, if needed.

Either way, you're in good hands with the ticket. :)


Thanks!
 

Misiek

Well-Known Member
Feb 23, 2004
130
3
168
cPanel Access Level
Root Administrator
Ticket ID : 3338151

A little proof that im right :)

Code:
2012-10-30 12:46:10 1TTAGn-00081k-JC cancelled by system filter: The mail server detected your message as spam and has prevented delivery (10).
2012-10-30 12:50:11 1TTAKg-0000I9-TI cancelled by system filter: The mail server detected your message as spam and has prevented delivery (10).
2012-10-30 12:51:15 1TTALi-0000U0-AZ cancelled by system filter: The mail server detected your message as spam and has prevented delivery (10).
2012-10-30 12:52:34 1TTAMz-0000hw-Qn cancelled by system filter: The mail server detected your message as spam and has prevented delivery (10).
2012-10-30 12:54:26 1TTAOo-00014w-3E cancelled by system filter: The mail server detected your message as spam and has prevented delivery (10).
2012-10-30 13:02:08 1TTAWF-0002gM-U3 cancelled by system filter: The mail server detected your message as spam and has prevented delivery (10).
2012-10-30 13:04:19 1TTAY8-00036k-8P cancelled by system filter: The mail server detected your message as spam and has prevented delivery (10).
2012-10-30 13:06:39 1TTAac-0003cC-8U cancelled by system filter: The mail server detected your message as spam and has prevented delivery (10).
2012-10-30 13:08:02 1TTAby-0003pE-0d cancelled by system filter: The mail server detected your message as spam and has prevented delivery (10).
2012-10-30 13:09:28 1TTAdM-00046O-5C cancelled by system filter: The mail server detected your message as spam and has prevented delivery (10).
2012-10-30 13:14:22 1TTAhw-0004uK-Qm cancelled by system filter: The mail server detected your message as spam and has prevented delivery (10).
2012-10-30 13:15:55 1TTAjW-0005EV-C2 cancelled by system filter: The mail server detected your message as spam and has prevented delivery (10).
2012-10-30 13:17:44 1TTAlL-0005cs-Ud cancelled by system filter: The mail server detected your message as spam and has prevented delivery (10).
2012-10-30 13:18:29 1TTAm5-0005lG-4J cancelled by system filter: The mail server detected your message as spam and has prevented delivery (10).
2012-10-30 13:18:55 1TTAmR-0005ox-NL cancelled by system filter: The mail server detected your message as spam and has prevented delivery (10).
2012-10-30 13:19:37 1TTAnB-0005yC-2r cancelled by system filter: The mail server detected your message as spam and has prevented delivery (10).
2012-10-30 13:20:53 1TTAoO-0006CF-Qy cancelled by system filter: The mail server detected your message as spam and has prevented delivery (10).
2012-10-30 13:21:33 1TTAp3-0006LA-CX cancelled by system filter: The mail server detected your message as spam and has prevented delivery (10).
2012-10-30 13:25:56 1TTAtH-00076E-I0 cancelled by system filter: The mail server detected your message as spam and has prevented delivery (10).
2012-10-30 13:27:49 1TTAv7-0007U7-0A cancelled by system filter: The mail server detected your message as spam and has prevented delivery (10).
2012-10-30 13:28:00 1TTAvI-0007WN-9J cancelled by system filter: The mail server detected your message as spam and has prevented delivery (10).
2012-10-30 13:35:49 1TTB2r-0000h0-4H cancelled by system filter: The mail server detected your message as spam and has prevented delivery (10).
2012-10-30 13:35:49 1TTB2r-0000gz-60 cancelled by system filter: The mail server detected your message as spam and has prevented delivery (10).
2012-10-30 13:36:45 1TTB3l-0000rd-H1 cancelled by system filter: The mail server detected your message as spam and has prevented delivery (10).
2012-10-30 13:37:42 1TTB4g-00013M-3j cancelled by system filter: The mail server detected your message as spam and has prevented delivery (10).
2012-10-30 13:38:20 1TTB5G-0001AR-0n cancelled by system filter: The mail server detected your message as spam and has prevented delivery (10).
2012-10-30 13:38:47 1TTB5h-0001F3-Dw cancelled by system filter: The mail server detected your message as spam and has prevented delivery (10).
2012-10-30 13:40:49 1TTB7f-0001d4-Dw cancelled by system filter: The mail server detected your message as spam and has prevented delivery (10).
2012-10-30 13:40:56 1TTB7n-0001f4-G1 cancelled by system filter: The mail server detected your message as spam and has prevented delivery (10).
2012-10-30 13:41:08 1TTB80-0001h1-EB cancelled by system filter: The mail server detected your message as spam and has prevented delivery (10).
2012-10-30 13:41:08 1TTB80-0001h2-Hm cancelled by system filter: The mail server detected your message as spam and has prevented delivery (10).
2012-10-30 13:42:59 1TTB9m-0001y2-D1 cancelled by system filter: The mail server detected your message as spam and has prevented delivery (10).
2012-10-30 13:44:15 1TTBB0-0002BO-JN cancelled by system filter: The mail server detected your message as spam and has prevented delivery (10).
2012-10-30 13:44:47 1TTBBW-0002Hp-Ks cancelled by system filter: The mail server detected your message as spam and has prevented delivery (10).
2012-10-30 13:45:16 1TTBC0-0002OY-5o cancelled by system filter: The mail server detected your message as spam and has prevented delivery (10).
2012-10-30 13:48:54 1TTBFW-00032N-CI cancelled by system filter: The mail server detected your message as spam and has prevented delivery (10).
2012-10-30 13:51:45 1TTBIG-0003cK-Al cancelled by system filter: The mail server detected your message as spam and has prevented delivery (10).
2012-10-30 13:52:17 1TTBIn-0003iY-L9 cancelled by system filter: The mail server detected your message as spam and has prevented delivery (10).
At 14:02 i made changes to system filter :) All of above had SPAM Score lower then 10.0
 
Last edited:

nyjimbo

Well-Known Member
Jan 25, 2003
1,135
1
168
New York
Just upgraded a 11.32 Centos machine to 11.34 and sure enough this damn thing came up again.

"This message was created automatically by mail delivery software.

A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:

[email protected]
The mail server detected your message as spam and has prevented delivery (100)."

Why do we have to keep dealing with this kind of nonsense.