Because it goes through the antispam ?

MisterM

Verified User
Joined
Jul 31, 2022
Messages
382
Hello

Regarding this error:

Rspamd should be on but was skipped for some reason: acl_c_esf_skip=0 OR (message_size=555954) >= 200K OR (acl_m_spam_user=xxxxx)==nobody
2023-01-07 10:56:14 1pE5vx-005uHh-1G <= [email protected] H=plesk-in.reseller-dns.com [103.13.115.251] P=esmtps X=TLS1.2:ECDHE-RSA-AES128-GCM-SHA256:128 CV=no S=556643 id=[email protected] T="Hello adorable Greetings!" from <[email protected]> for [email protected]

There is a way to correct it, because it goes through the antispam ?

What it is dangerous in itself.
 
Another mistake I didn't have before:

H=mail.rspamd.net [135.181.136.158] X=TLS1.2:ECDHE-RSA-AES128-GCM-SHA256:128 CV=no F=<[email protected]> rejected after DATA: Your message to <[email protected]> was classified as SPAM. Please add more content, cut down on HTML links, use fewer naughty words etc. Also, ask your IT dept to make sure your mailserver has REVERSEDNS, SPF, DKIM, and is not on any black lists. Your score: 119
 
We need your domain name to be able to help you, it can be all kinds of reasons as to why things go to spam.

You can also visit https://www.mail-tester.com and follow instructions there, you need at least a 9/10 score.
All lower scores present you with causes as to why you have a lower score.
 
Hello

Regarding this error:



There is a way to correct it, because it goes through the antispam ?

What it is dangerous in itself.
According to the support of rspamd, it asks me if there are limits for the parts, at the quota level?

Message:

Those logs don't look like rspamd logs. I'd guess the message is too big (over 200K) and scanning is skipped.
Amavisd (spamassassin) e.g. limits scanning by size. Maybe similar limits are set in directadmin.
 
Hello

Regarding this error:



There is a way to correct it, because it goes through the antispam ?

What it is dangerous in itself.
it becomes more and more annoying, why this function
acl_c_esf_skip = 0
Is negative is not with 1, because all my messages to the of the 200 ko pass through the antispam.

@zEitEr

How to activate this port?

 
According to Exim's support, I should look into it:

Have you checked your ACLs where spam scanning is done? What do you have there? Can you post the ACLs?

Where is this?
 
I replied with this via the exim mailing list, posting it here for reference:

It was skipped for one of three reasons:

1. acl_c_esf_skip resolved to 0
2. message_size was > 200K
3. acl_m_spam_user resolved to "nobody"

Number 1 means the user had spam filtering disabled. Number 2 means the email exceeded the size defined in /etc/exim.easy_spam_fighter/variables.conf (or variables.conf.custom, if relevant for you). Number 3 is likely irrelevant.

To better understand acl_c_esf_skip, you should check out I believe it's /etc/exim/rspamd/connect.conf. This file may be overwritten on DA updates, so editing it directly isn't advised without taking significant extra measures.

Most likely you should just do something like this:

echo "EASY_SPAMASSASSIN_MAX_SIZE == 25000K" >> /etc/exim.easy_spam_fighter/variables.conf.custom && systemctl restart exim

This, however, is a separate issue:

H=mail.rspamd.net [135.181.136.158] X=TLS1.2:ECDHE-RSA-AES128-GCM-SHA256:128 CV=no F=<[email protected]> rejected after DATA: Your message to <[email protected]> was classified as SPAM. Please add more content, cut down on HTML links, use fewer naughty words etc. Also, ask your IT dept to make sure your mailserver has REVERSEDNS, SPF, DKIM, and is not on any black lists. Your score: 119

If you're using Rspamd, which I think you are, you will want to find this email in /var/log/rspamd/rspamd.log (or one of the log archives in the same directory). Just do something like:

zgrep lists.rspamd.com /var/log/rspamd/* | grep "(reject)"

You'll get a list of the rules that were triggered by any emails you rejected from lists.rspamd.com. This isn't inherently a problem though, you do have spam filters on and they rejected an email as you want them to do. Whether or not this individual email was rejected appropriately is subjective, and that's where you begin to tweak your settings to your liking. It is entirely plausible that someone provided a spam sample to a message sent to the rspamd mailing list, and that your filters rejected it appropriately because it did in fact contain spam content.
 
Helllo @mxroute
echo "EASY_SPAMASSASSIN_MAX_SIZE == 25000K" >> /etc/exim.easy_spam_fighter/variables.conf.custom && systemctl restart exim
if this settles my scan story is that all messages come in no longer go through, I am a happy man is for the other DA members.
 
Back
Top