How can I block this spam coming via Google?

I checked logs across all our servers and we’re no longer seeing new spam from these Google Groups reaching customer inboxes — most of it is now being caught by the spam filter rule mentioned earlier.

The KAM.cf rules also made a noticeable difference.

If these messages are still getting through on your side, it’s worth checking your scoring setup. For example, if your required score is around 8, make sure your custom rule like HK_GOOGLE_GROUPS is set significantly higher (e.g. 10+) so it guarantees a hit.

Here’s an example of how these messages are being scored on our side:
spamd: result: Y 19 - DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,GB_URI_ASTERISK,HK_GOOGLE_GROUPS,HTML_FONT_SIZE_HUGE,HTML_IMAGE_ONLY_08,HTML_MESSAGE,HTML_SHORT_LINK_IMG_1,MAILING_LIST_MULTI,RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_PASS,URIBL_ABUSE_SURBL,URIBL_DBL_BLOCKED

So even though the messages pass SPF/DKIM, the combined rule weight (especially HK_GOOGLE_GROUPS) pushes them well over the threshold.
 
Here’s another example showing the same pattern — note how everything passes SPF/DKIM/DMARC, yet the message is still clearly spam and gets caught mainly due to the Google Groups rule:

Return-path: <[email protected]>
Envelope-to: hello@<domainremoved>;
Delivery-date: Tue, 28 Apr 2026 18:04:28 +0200

Received: from mail-yw1-f200.google.com ([209.85.128.200])
by <server removed> with esmtps (TLS1.3)
(Exim 4.99.1)
for hello@<domainremoved>;

Authentication-Results:
dkim=pass;
spf=pass;
dmarc=pass;

Precedence: list
Mailing-list: list [email protected]
List-ID: <hs.chinacvcn.com>
X-Google-Group-Id: 806615142161

X-Spam-Score: 11.7 (required 8.0)

And the key part from the SpamAssassin breakdown:

pts rule name description
---- ---------------------- ---------------------------------------
10.0 HK_GOOGLE_GROUPS Message sent via Google Groups
1.9 URIBL_ABUSE_SURBL URL listed in blocklist
0.5 LOCAL_HTML_ONLY_HIGH HTML-only message
0.2 HEADER_FROM_DIFFERENT_DOMAINS
-1.0 MAILING_LIST_MULTI

Even though authentication is clean (SPF_PASS, DKIM_VALID, DMARC_PASS), the message still scores 11.7, mainly due to:

HK_GOOGLE_GROUPS (custom rule doing the heavy lifting)
URIBL hit
Typical HTML-only / list characteristics

Without a strong rule like HK_GOOGLE_GROUPS, this would likely slip through on many default configurations.
 
Hostking said:
If these messages are still getting through on your side, it’s worth checking your scoring setup. For example, if your required score is around 8
Click to expand...
As stated before, the reason is that the mails are too big and therefor not scanned by Spamassassin, my score was already set to 10.
That's also the reason that only a few big mails came through amongst with the chinacvcn.com mail too which was 6M in my case.

A stronger rule will most certainly not help if SA doesn't even scan the mail. So the solution to this is either wait for DA 1.700 or for the time being raise the limit for which Spamassassin will scan a mail in the /etc/exim.easy_spam_fighter/variables.conf.custom file like this:
EASY_SPAMASSASSIN_MAX_SIZE == 10M
or a bigger value, and rebuild the exim configuration.

Before I had this set to 2M and most mails were blocked, except the ones bigger, because SA did not even scan them due to this setting.
However, with DA 1.700 this issue will be passed, we just don't need to forget to remove the setting in the variables.conf.custom file after updating to Directadmin 1.700.
 
It seems not removing the custom setting brings exim down in the new update version.
 
Maybe try with a single = character as it's a setting now and no overrule setting anymore as the default setting is gone with the update.

If that still does not work and you want to use a limit, you might want to notify fln in the releasse thread because he said everything should keep working as is.
 
I found out that if you have an valid google account, you can opt out (somewhere in the settings, just cant remember in detail) for those google groups messages at all.
 
You might be right, but that opting out would be for that Google account only not for messages send to your server and other customers.
 
johannes said:
I found out that if you have an valid google account, you can opt out (somewhere in the settings, just cant remember in detail) for those google groups messages at all.
Click to expand...
I see those google group spam messages arrive on email addresses that do not have a google account.
Beats me to how that's allowed by google..

Also tried to report it many times to google, but pretty sure it all goes to /dev/null, so now added a spamassassin rule as was mentioned earlier in this thread
 
wila said:
eats me to how that's allowed by google..
Click to expand...
If I'm correct it's just send by Google. I know Google can pickup mail from other domains. I thought maybe it's picking up mail from other domains and then sending it, because the sender domain address is not from Google, only the MTA address.

We also report all of these mails via Spamcop to Google. Also the Spamassassin rule is present, but seems less effective for some reason. Probably because they are not using google cloud now but plain Google.
 
Seems they found a new method. Now they are not using Google groups but just gMail and just sending from numerous domains via gmail. We can't block gmail and it's a load of work to block every new domain every time.

This is an example. I changed my email to [email protected] and also masked the hostname, the rest is correct.
Code: 
Return-Path: <[email protected]>
Delivered-To: [email protected]
Received: from server.domain.com
    by server.domain.com with LMTP
    id AY/HCNjOpmr6PgcAugeUdg
    (envelope-from <[email protected]>)
    for <[email protected]>; Sun, 13 Sep 2026 18:27:04 +0200
Return-path: <[email protected]>
Envelope-to: [email protected]
Delivery-date: Sun, 13 Sep 2026 18:27:04 +0200
Received: from mail-yx1-xb146.google.com ([2607:f8b0:4864:20::b146])
    by server.domain.com with esmtps  (TLS1.3) tls TLS_AES_256_GCM_SHA384
    (Exim 4.100)
    (envelope-from <[email protected]>)
    id 1x5n2k-00000003pgm-22BN
    for [email protected];
    Sun, 13 Sep 2026 18:27:04 +0200
Received: by mail-yx1-xb146.google.com with SMTP id 956f58d0204a3-66f78d2f2a0so4818714d50.2
        for <[email protected]>; Sun, 13 Sep 2026 09:27:00 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=student-tapee-ac-th.20251104.gappssmtp.com; s=20251104; t=1789316819; x=1789921619; darn=email.com;
        h=content-type:to:from:subject:date:message-id:mime-version:from:to
         :cc:subject:date:message-id:reply-to:content-type;
        bh=qnkgstr8LN8olbVTomS26+JrRU14kK/JRv96o8tKis0=;
        b=yzEkaWZiUE8VsblK5tBwCMSj3jOA09jayCHPQmv9U/ks+dym7OgZUG3GLm3sq1oss1
         pzHgyfUpLJxaagHUuwO91OJXuhcPJ00UmiBTS5UXugK2G8yiUiMs7j/vBz2hBE/R0HnX
         +6V29pVgFhfnM6lG+wtKMc9H0GqjaR7wCqeDdJ0ICPW3yPBgo5VAk0OZ7HH7CcvMfDRO
         rrE78+dTIEmvDtfDnCYNZs0MGugwW0ItZ5iGZ0aboXFtTnpQlS/ewfqG0YaGwCqL93hC
         STkvlcKHnHewKGp9dwTZSyoFreLSNWdw2Hh8QPE20NNcj8T0HS/JCM2h1htZWhmPDClJ
         FsBw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=1e100.net; s=20251104; t=1789316819; x=1789921619;
        h=content-type:to:from:subject:date:message-id:mime-version
         :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to
         :content-type;
        bh=qnkgstr8LN8olbVTomS26+JrRU14kK/JRv96o8tKis0=;
        b=lF2neyyGggGn9zHWxcA9CoEOMQ2MT9yYXP0I84jF5ATWkRTzAiUmax7KR2SguKZ//5
         zKnuVMeXgFlAEE8j9N9dCy9Ks7WiwqK5H1jdm6WsfshT1rj54eVtjPaHvXfWf3G9Eis2
         6emKH4UHUw0RToPn9D91JYPzxlItG4yQpBsfslIs/Q0fqIkpHizhQqMGAetIl5bNQbCo
         NZMY6+BPK4ehu0m7Ydi3Xe31zWgIUrP8X4sQZJnKVo9btNtnQNG0DCbwkezWaYDA/wMX
         oq8F0MigFM9BP6/cUAILsTfDPpKbSBQSh6ReDepinoZE/Q2h3jQh/KSBjGWH7gLgOXXJ
         Epzg==
X-Gm-Message-State: AFuF++nGPaVIUGSRzuxPAaXKxK8Mt1Uc9RwlGudH2tdn+WFBYT9hLYBr
    kBq8bBcz4hvf+a91DVGhdvbkoTyGW/KdwsrmN8p+UehHyfUgJb73nHwrAJgIf0sPbl6PoiR2yvG
    rCU5wLioJMlCL8cKqrpo5NxDp6lgVWqaIkClfL0WCq+Si1bTEqstDcSRRhnE887U8DSWpe0eOWr
    r/lLOWcR8=
MIME-Version: 1.0
X-Received: by 2002:a05:690e:c8f:b0:671:203c:2fd1 with SMTP id
 956f58d0204a3-67124717155mr3712975d50.70.1789316819136; Sun, 13 Sep 2026
 09:26:59 -0700 (PDT)
Message-ID: <[email protected]>
Date: Sun, 13 Sep 2026 16:26:59 +0000
Subject: Als dank: een gratis Autokoelbox voor u
From: ANWB Ledenwaardering <[email protected]>
To: [email protected]
Content-Type: multipart/alternative; boundary="0000000000006539e2065b5fc941"
Forward-Confirmed-ReverseDNS: Reverse and forward lookup success on 2607:f8b0:4864:20::b146, -10 Spam score
X-DKIM: signer='student-tapee-ac-th.20251104.gappssmtp.com' status='pass' reason=''
DKIMCheck: Server passes DKIM test, -5 Spam score
X-Spam-Score: 0.1 (/)
X-Spam-Bar: /
X-Spam-Report: Spam detection software, running on the system "server.domain.com",
 has NOT identified this incoming email as spam.  The original
 message has been attached to this so you can view it or label
 similar future email.  If you have any questions, see
 @@CONTACT_ADDRESS@@ for details.
 
 Content preview:  Als dank voor uw lidmaatschap ligt er een gratis Autokoelbox
    voor u klaar. Beantwoord een korte vraag en claim de uwe. ANWB Ledenwaardering
    Speciaal voor onze leden
 
 Content analysis details:   (0.1 points, 7.5 required)
 
  pts rule name              description
 ---- ---------------------- --------------------------------------------------
 -0.0 RCVD_IN_DNSWL_NONE     RBL: Sender listed at https://www.dnswl.org/, no
                             trust
                             [2607:f8b0:4864:20:0:0:0:b146 listed in]
                             [list.dnswl.org]
  0.0 SPF_HELO_NONE          SPF: HELO does not publish an SPF Record
  0.0 SPF_NONE               SPF: sender does not publish an SPF Record
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
  0.0 HTML_MESSAGE           BODY: HTML included in message
  0.0 HTML_FONT_SIZE_HUGE    BODY: HTML font size is huge
  0.1 KAM_EDU_FROM           Identify if the sender is using a school / education
                             account
SpamTally: Final spam score: -14
X-Antivirus-Scanner: Clean mail though you should still use an Antivirus

--0000000000006539e2065b5fc941
Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes
Content-Transfer-Encoding: base64

Below this comes the spam. What I also do not understand is why I see this:
Content analysis details: (0.1 points, 7.5 required)
Click to expand...
So a 0.1 but the spamtally final score is -14. Where is this -14 coming from? I don't see that in the headers and it would be nice to see where that is coming from.

Is there a better way to block this then just block the used mail addresses or host every time?
Maybe there is a way to block anything coming from outlook.com or gmail.com which is originated by another domain? Except forwards ofcourse.
 
Last edited:
Richard,
Code: 
Forward-Confirmed-ReverseDNS: Reverse and forward lookup success on 2607:f8b0:4864:20::b146, -10 Spam score
X-DKIM: signer='student-tapee-ac-th.20251104.gappssmtp.com' status='pass' reason=''
DKIMCheck: Server passes DKIM test, -5 Spam score

So -10 and -5, makes -15, not sure why it ends up as -14, I'm probably overlooking something else.
 
wila said:
I'm probably overlooking something else.
Click to expand...
Thank you, I've seen the -10 after I posted but still missed the -5. That 1 which is left is not that important to me.
I've already changed both values to 0 so they won't give an advantage anymore.

However, even with that it would just be 1 or 0.1 and way not enough to block. I really don't like that Gmail can pick up mail for other domains and then people can keep sending that way and spamming.
Also this way for example SPF and DKIM are abused since the ones from Gmail are used and not from the originating domain.

Which is the reason I'm looking for a method to block anything coming from Google which is not forwarded and is not originated by Gmail.
 
You must log in or register to reply here.
Back
Top