spamassassin

Tomy666

Tomy666

Verified User
Joined
Jan 12, 2020
Messages
39
Location
Poland
Hello ;)

I’m having a problem with SpamAssassin: it isn't generating a report with an attachment when delivering spam.
The option is enabled in the panel. Additionally, I set the following in `/etc/mail/spamassassin/local.cf`:

report_safe 1

I also restarted SpamAssassin and spamd .... it still isn't generating the report. Please help :)
Debian 12 , DA 1.7.1
 
Last edited:
To add to what zEitEr said: per-user settings live in /home/USERNAME/.spamassassin/user_prefs and that file wins over local.cf. Worth opening it for the affected user. If there's a report_safe 0 line in there, that's what is overriding your global setting.
Easiest way to test after changing it is to send that user a mail with the GTUBE string in the body:
XJS*C4JDBQADN1.NSBN3*2IDNEN*GTUBE-STANDARD-ANTI-UBE-TEST-EMAIL*C.34X
It always scores as spam, so you'll see straight away whether the original comes through as an attachment.
 
Hello, I have 'report' enabled in my SpamAssassin settings.
The `user_prefs` file looks like this:
Code: 
required_score 5.0
rewrite_header subject *****SPAM*****


report_safe     1




#SAFE AREA start


#SAFE AREA end

The message subject changes correctly, but the attachments are not delivered.
The message is correctly delivered to the SPAM folder, but without the attachment.
I recently migrated the VPS, though I installed SpamAssassin from beginning.
 
Hello
I’m still struggling with this issue of missing EML reports. I’m wondering if there might be a missing link between SpamAssassin and Exim.
mail.log
Code: 
spamd: connection from localhost [127.0.0.1]:59170 to port 783, fd 5
2026-11-03T10:37:40.426610+01:00 vpstest spamd[463547]: spamd: setuid to admin succeeded
2026-11-03T10:37:40.445036+01:00 vpstest spamd[463547]: spamd: checking message <[email protected]> for admin:1000
2026-11-03T10:37:42.311532+01:00 vpstest spamd[463547]: check: dns_block_rule URIBL_BLOCKED hit, creating /root/.spamassassin/dnsblock_multi.uribl.com (This means DNSBL blocked you due to too many queries. Set all affected rules score to 0, or use "dns_query_restriction deny multi.uribl.com" to disable queries)
2026-11-03T10:37:42.312823+01:00 vpstest spamd[463547]: check: dns_block_rule RCVD_IN_DNSWL_BLOCKED hit, creating /root/.spamassassin/dnsblock_list.dnswl.org (This means DNSBL blocked you due to too many queries. Set all affected rules score to 0, or use "dns_query_restriction deny list.dnswl.org" to disable queries)
2026-11-03T10:37:42.315986+01:00 vpstest spamd[463547]: spamd: clean message (0.5/3.0) for admin:1000 in 1.9 seconds, 100742 bytes.
2026-11-03T10:37:42.316989+01:00 vpstest spamd[463547]: spamd: result: .  0 - HTML_MESSAGE,RCVD_IN_DNSWL_BLOCKED,SUBJ_ALL_CAPS,URIBL_BLOCKED scantime=1.9,size=100742,user=admin,uid=1000,required_score=3.0,rhost=localhost,raddr=127.0.0.1,rport=59170,mid=<[email protected]>,autolearn=no autolearn_force=no
 
Tomy666 said:
I’m wondering if there might be a missing link between SpamAssassin and Exim.
Click to expand...
Most likely this problem is caused by both Exim and Spamassasin checking mail on those RBL lists, which should not be the case because then you get these kind of blocks.
So you have to exclude them from one of them.

Now Exim is already checking the DNSWL list so you can exclude that from spamassassin. In the spamassassin local.cf add this line:
dns_query_restriction deny list.dnswl.org
and restart spamassassin.
For the multi.uribl.com you could check this thread (click) and tips in there.
However, seems you might be better of blocking that one too and using other RBL's by Exim.
 
Thank you Richard for your response.
After adding the entry
Code: 
dns_server 127.0.0.1
dns_query_restriction deny list.dnswl.org
score RCVD_IN_DNSWL_BLOCKED 0
score __RCVD_IN_DNSWL 0

mail.log is looks good
Code: 
2026-11-04T22:35:30.486109+01:00 vpstest spamd[542545]: spamd: connection from localhost [127.0.0.1]:44358 to port 783, fd 5
2026-11-04T22:35:30.488569+01:00 vpstest spamd[542545]: spamd: setuid to admin succeeded
2026-11-04T22:35:30.502604+01:00 vpstest spamd[542545]: spamd: checking message <CAAuvrXH5o7JNVfWeVUju9So_WUKvQOkDXQ1W-yg+9BHcGcx3nw@mail.gmail.com> for admin:1000
2026-11-04T22:35:31.799035+01:00 vpstest spamd[542545]: spamd: identified spam (1000.1/3.0) for admin:1000 in 1.3 seconds, 6055 bytes.
2026-11-04T22:35:31.799293+01:00 vpstest spamd[542545]: spamd: result: Y 1000 - DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FREEMAIL_ENVFROM_END_DIGIT,FREEMAIL_FROM,GTUBE,HTML_MESSAGE,RCVD_IN_DNSWL_NONE,RCVD_IN_MSPIKE_H3,RCVD_IN_MSPIKE_WL scantime=1.3,size=6055,user=admin,uid=1000,required_score=3.0,rhost=localhost,raddr=127.0.0.1,rport=44358,mid=<CAAuvrXH5o7JNVfWeVUju9So_WUKvQOkDXQ1W-yg+9BHcGcx3nw@mail.gmail.com>,autolearn=no autolearn_force=no
2026-11-04T22:35:31.841931+01:00 vpstest spamd[542544]: prefork: child states: II


Unfortunately, reports for spam messages are still not being added.

my local.cf
Code: 
# This is the right place to customize your installation of SpamAssassin.
#
# See 'perldoc Mail::SpamAssassin::Conf' for details of what can be
# tweaked.
#
# Only a small subset of options are listed below
#
###########################################################################

#    A 'contact address' users should contact for more info. (replaces
#    _CONTACTADDRESS_ in the report template)
# report_contact [email protected]


#   Add *****SPAM***** to the Subject header of spam e-mails
#
# rewrite_header Subject *****SPAM*****



#   Save spam messages as a message/rfc822 MIME attachment instead of
#   modifying the original message (0: off, 2: use text/plain instead)
#
# report_safe 1


#   Set which networks or hosts are considered 'trusted' by your mail
#   server (i.e. not spammers)
#
# trusted_networks 212.17.35.


#   Set file-locking method (flock is not safe over NFS, but is faster)
#
# lock_method flock


#   Set the threshold at which a message is considered spam (default: 5.0)
#
# required_score 5.0


#   Use Bayesian classifier (default: 1)
#
# use_bayes 1


#   Bayesian classifier auto-learning (default: 1)
#
bayes_auto_learn 1


#   Set headers which may provide inappropriate cues to the Bayesian
#   classifier
#
# bayes_ignore_header X-Bogosity
# bayes_ignore_header X-Spam-Flag
# bayes_ignore_header X-Spam-Status


#   Whether to decode non- UTF-8 and non-ASCII textual parts and recode
#   them to UTF-8 before the text is given over to rules processing.
#
# normalize_charset 1

#   Textual body scan limit    (default: 50000)
#
#   Amount of data per email text/* mimepart, that will be run through body
#   rules.  This enables safer and faster scanning of large messages,
#   perhaps having very large textual attachments.  There should be no need
#   to change this well tested default.
#
# body_part_scan_size 50000

#   Textual rawbody data scan limit    (default: 500000)
#
#   Amount of data per email text/* mimepart, that will be run through
#   rawbody rules.
#
# rawbody_part_scan_size 500000

#   Some shortcircuiting, if the plugin is enabled
#
ifplugin Mail::SpamAssassin::Plugin::Shortcircuit
#
#   default: strongly-welcomelisted mails are *really* welcomelisted now, if
#   the shortcircuiting plugin is active, causing early exit to save CPU
#   load.  Uncomment to turn this on
#
#   SpamAssassin tries hard not to launch DNS queries before priority -100.
#   If you want to shortcircuit without launching unneeded queries, make
#   sure such rule priority is below -100. These examples are already:
#
# shortcircuit USER_IN_WELCOMELIST       on
# shortcircuit USER_IN_DEF_WELCOMELIST   on
# shortcircuit USER_IN_ALL_SPAM_TO     on

#   the opposite; blocklisted mails can also save CPU
#
# shortcircuit USER_IN_BLOCKLIST       on
# shortcircuit USER_IN_BLOCKLIST_TO    on

#   if you have taken the time to correctly specify your "trusted_networks",
#   this is another good way to save CPU
#
# shortcircuit ALL_TRUSTED             on

#   and a well-trained bayes DB can save running rules, too
#
# shortcircuit BAYES_99                spam
# shortcircuit BAYES_00                ham

report_safe 1
dns_server 127.0.0.1
dns_query_restriction deny list.dnswl.org
score RCVD_IN_DNSWL_BLOCKED 0
score __RCVD_IN_DNSWL 0
endif # Mail::SpamAssassin::Plugin::Shortcircuit
 
You must log in or register to reply here.
Back
Top