Mailing List Archive

Spamassassin goes to folder spam
Hello

Asking for litle help.. Doevecot and sieve are running fine.. One thing now,
if receiving mail from Users-spamassassin

This mail will by forwarding from sieve to folder spam. I didn't see why
this will transfer there.



Dovecot 2.3.4.1 (f79e8e7e4) - Debain 10



Sieve



if header :contains "To" users@spamassassin.apache.org
<mailto:users@spamassassin.apache.org> {

fileinto "INBOX.Spamassassin";

}

if header :contains "X-Spam-Flag" "Yes" {

fileinto :create "Junk";

stop;

}

--

Return-Path: mauric@gmx.ch <mailto:mauric@gmx.ch>

Delivered-To: maurizio@domain.ch <mailto:maurizio@domain.ch>

Received: from nmail.caloro.ch

by nmail.caloro.ch with LMTP

id cxP8HP/ffWDaKwAAmDN1Rg

(envelope-from mauric@gmx.ch <mailto:mauric@gmx.ch> )

for maurizio@domain.ch <mailto:maurizio@domain.ch> ; Mon, 19
Apr 2021 21:54:39 +0200

Received-SPF: Pass (mailfrom) identity=mailfrom; client-ip=212.227.15.15;
helo=mout.gmx.net; envelope-from=mauric@gmx.ch
<mailto:envelope-from=mauric@gmx.ch> ; receiver=<UNKNOWN>

DMARC-Filter: OpenDMARC Filter v1.3.2 nmail.caloro.ch C914140201

Authentication-Results: nmail.caloro.ch mail.caloro.ch caloro.ch; dmarc=none
(p=none dis=none) header.from=billmail.scconsult.com

Authentication-Results: nmail.caloro.ch mail.caloro.ch caloro.ch; spf=pass
smtp.mailfrom=mauric@gmx.ch <mailto:smtp.mailfrom=mauric@gmx.ch>

DKIM-Filter: OpenDKIM Filter v2.11.0 nmail.caloro.ch C914140201

Mailing-List: contact users-help@spamassassin.apache.org
<mailto:users-help@spamassassin.apache.org> ; run by ezmlm

Precedence: bulk

list-help: mailto:users-help@spamassassin.apache.org

list-unsubscribe: mailto:users-unsubscribe@spamassassin.apache.org

List-Post: <mailto:users@spamassassin.apache.org>
mailto:users@spamassassin.apache.org

List-Id: <users.spamassassin.apache.org>

Delivered-To: mailing list users@spamassassin.apache.org
<mailto:users@spamassassin.apache.org>

X-Spam-Score: -0.001

X-Spam-Level:

X-Spam-Status: No, score=0.2 required=5.0
tests=AWL,FREEMAIL_FORGED_FROMDOMAIN,


FREEMAIL_FROM,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,

SPF_PASS,UNPARSEABLE_RELAY autolearn=ham autolearn_force=no

version=3.4.6

Received-SPF: Pass (mailfrom) identity=mailfrom; client-ip=67.149.19.3;
helo=bigsky.scconsult.com;
envelope-from=sausers-20150205@billmail.scconsult.com
<mailto:envelope-from=sausers-20150205@billmail.scconsult.com> ;
receiver=<UNKNOWN>

From: "Bill Cole" sausers-20150205@billmail.scconsult.com
<mailto:sausers-20150205@billmail.scconsult.com>

To: users@spamassassin.apache.org <mailto:users@spamassassin.apache.org>

Subject: Re: KAM_DMARC_REJECT on internal emails

Date: Mon, 19 Apr 2021 15:54:00 -0400

Message-ID:
<mailto:A6D58FA5-DCC4-4618-A6A9-0DC9065FE936@billmail.scconsult.com>
A6D58FA5-DCC4-4618-A6A9-0DC9065FE936@billmail.scconsult.com

In-Reply-To: 20210419195718.1fc402d6@gumby.homeunix.com
<mailto:20210419195718.1fc402d6@gumby.homeunix.com>

References:
20210419220521.Horde.x77pTxnvnOymeQ5bD2xJ82E@mail.simonandkate.net
<mailto:20210419220521.Horde.x77pTxnvnOymeQ5bD2xJ82E@mail.simonandkate.net>

MIME-Version: 1.0

Content-Type: text/plain; format=flowed

Mail-Copies-To: nobody

X-Spam-Source: on via in en

X-Spam-Hops:

Envelope-To: mauric@gmx.ch <mailto:mauric@gmx.ch>

X-GMX-Antispam: 5 (nemesis mail header analyzer); Detail=V3;

X-Spam-Flag: YES

X-UI-Filterresults: junk:10;V03:K0:oQ58xS3PZ3o=:ui

X-UI-Loop:V01:NQ+uvMhGdNE=:SW

X-Spam-Flag: NO

X-UI-Out-Filterresults: notjunk:1;V03:K0:oU0GgD86eVw=:3o

X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on nmail.caloro.ch

X-Virus-Scanned: clamav-milter 0.102.4 at nmail.caloro.ch

X-Virus-Status: Clean



Thanks for possible update
Re: Spamassassin goes to folder spam [ In reply to ]
Den 20-04-2021 kl. 01:12 skrev mauric@gmx.ch:
>
> Hello
>
> Asking for litle help?. Doevecot and sieve are running fine?. One
> thing now, if receiving mail from Users-spamassassin
>
> This mail will by forwarding from sieve to folder spam. I didn?t see
> why this will transfer there.
>
Your message has two X-Spam-Flag's, one with YES, and another one with
NO, and then you aren't stopping the Sieve parsing.

> ?
>
> Dovecot 2.3.4.1 (f79e8e7e4) - Debain 10
>
> ?
>
> Sieve
>
> ?
>
> if header :contains "To" users@spamassassin.apache.org
> <mailto:users@spamassassin.apache.org> {
>
> ? fileinto "INBOX.Spamassassin";
>
> }
>
> if header :contains "X-Spam-Flag" "Yes" {
>
> ? fileinto :create "Junk";
>
> ? stop;
>
> }
>
You could add "stop;" to the first one, where you file the message into
INBOX.Spamassassin, which means if it moves the message for you due to a
match, it won't go further with the check on the spam flag for that
particular message.

> --
>
> [...]
>
> Envelope-To: mauric@gmx.ch <mailto:mauric@gmx.ch>
>
> X-GMX-Antispam: 5 (nemesis mail header analyzer); Detail=V3;
>
> X-Spam-Flag: YES
>
> X-UI-Filterresults: junk:10;V03:K0:oQ58xS3PZ3o=:ui
>
> X-UI-Loop:V01:NQ+uvMhGdNE=:SW
>
> X-Spam-Flag: NO
>
From your own snippet of headers, as you can see above, it appears like
you are having two different X-Spam-Flag's to match against, which will
cause some complications and potentially unpredictable results...

--
Med venlig hilsen / Kind regards,
Arne Jensen
Re: Spamassassin goes to folder spam [ In reply to ]
On 2021-04-20 01:12, mauric@gmx.ch wrote:
> Hello
>
> Asking for litle help…. Doevecot and sieve are running fine…. One
> thing now, if receiving mail from Users-spamassassin
>
> This mail will by forwarding from sieve to folder spam. I didn't see
> why this will transfer there.
>
> Dovecot 2.3.4.1 (f79e8e7e4) - Debain 10
>
> Sieve
>
> if header :contains "To" users@spamassassin.apache.org {
>
> fileinto "INBOX.Spamassassin";

stop;

>
> }
>
> if header :contains "X-Spam-Flag" "Yes" {
>
> fileinto :create "Junk";
>
> stop;
>
> }
>

> X-Spam-Flag: YES

> X-Spam-Flag: NO

multiple spamassassin versions or not same add header can make this

but easy fix in sieve, see above
Re: Spamassassin goes to folder spam [ In reply to ]
On Tue, 20 Apr 2021, mauric@gmx.ch wrote:

> if header :contains "To" users@spamassassin.apache.org
> <mailto:users@spamassassin.apache.org> {

This header might be a better check:

List-Id: <users.spamassassin.apache.org>


--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
Our politicians should bear in mind the fact that
the American Revolution was touched off by the then-current
government attempting to confiscate firearms from the people.
-----------------------------------------------------------------------
Today: the 246th anniversary of The Shot Heard 'Round The World
Re: Spamassassin goes to folder spam [ In reply to ]
On Tue, 20 Apr 2021 01:12:18 +0200
mauric@gmx.ch wrote:

> Hello
>
> Asking for litle help.. Doevecot and sieve are running fine.. One
> thing now, if receiving mail from Users-spamassassin
>
> This mail will by forwarding from sieve to folder spam. I didn't see
> why this will transfer there.

You have two conflicting X-Spam-flag headers. This isn't why your email
wasn't filtered into the list folder, but it's the more serious problem.

Ordinarily SA will strip any pre-existing X-Spam-* headers, which
suggests some other software is calling SA as a library and writing its
own headers. If possible configure a header with a different and unique name.
Re: Spamassassin goes to folder spam [ In reply to ]
>> Hello

>>

>> Asking for litle help.. Doevecot and sieve are running fine.. One

>> thing now, if receiving mail from Users-spamassassin

>>

>> This mail will by forwarding from sieve to folder spam. I didn't see

>> why this will transfer there.



>You have two conflicting X-Spam-flag headers. This isn't why your email
wasn't filtered into the list folder, but it's the more serious problem.

>Ordinarily SA will strip any pre-existing X-Spam-* headers, which suggests
some other software is calling SA as a library and writing its own headers.

>If possible configure a header with a different and unique name.





disable now the content_filter in master.cf



smtp inet n - y - 1 postscreen

## Disable -o content_filter=spamassassin



and add here to main.cf following entry:



smtpd_milters = unix:spamass/spamass.sock,

unix:opendkim/opendkim.sock,

unix:opendmarc/opendmarc.sock,

unix:private/clamav/clamav-milter.ctl

non_smtpd_milters = $smtpd_milters



but still the double flag appair.... running with Debain 10 and installed
cpan Spamassassin.



X-Spam-Flag: YES

X-Spam-Flag: NO

X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on nmail.caloro.ch

X-Virus-Scanned: clamav-milter 0.102.4 at nmail.caloro.ch

X-Virus-Status: Clean



thanks for possible update