Spam Assassin not checking forwarded mail anymore

[Strator]

Hi guys,

Ten days ago I updated to DA 1.704 and I've received a lot of spam since then. Finally got to look into it today, and it appears that spamassassin isn't checking forwarded mail anymore. Seems to work within the same domain, but forwarding from a different domain ins bypassing spamassasin now. Checked the various threads and was surprised that nobody reported similar issues. I skipped a version or two, so the change may have come with the 1.703 or even the 1.702 update. Any idea what's going on, and why?

Thanks!

 

[zEitEr]

Hello,

Correct me if I'm wrong, but that was the default behaviour of SpamAssassasin for ages. If SpamAssassin on your server used to check forwarded emails, you might have achieved it by a custom setup. DirectAdmin changed a method SpamAssassin is connected to Exim recently, probably this broke your setup.

Related:

- https://docs.directadmin.com/change...d-exim-and-spam-filtering-service-integration

spamassassin isn't checking forwarded mail anymore

 

[Strator]

Thanks, that kinda rung a very distant bell, but I wouldn't have remembered on my own. According to my ancient notes (think of carvings on a stone tablet) I tried a couple of things back in the days, but it seems like in the end, all I did was turn Spam Assassin OFF for the forwarding domains - that would ensure it would be scanned before being delivered to the actual mailbox (as it hadn't been scanned before).

Is it possible that this behavior was changed in those recent updates, or do I need to look further?

 

[zEitEr]

Probably I was wrong. One of my old servers with CentOS 7 has this in /etc/exim.spamassassin.conf

#1.4
# Spam Assassin
spamcheck_director:
  driver = accept
  condition = ${if !eq{$acl_m_spam_assassin_has_run}{1}}
  condition = ${if !eq{$acl_c_spam_assassin_has_run}{1}}
  condition = "${if and { \
                        {!eq {$received_protocol}{spam-scanned}} \
                        {!eq {$received_protocol}{local}} \
                        {exists{${extract{5}{:}{${lookup{${lookup{$domain}lsearch*{/etc/virtual/domainowners}{$value}}}lsearch{/etc/passwd}{$value}}}}/.spamassassin/user_prefs}} \
                        {<{$message_size}{500k}} \
                } {1}{0}}"
  retry_use_local_part
  headers_remove = X-Spam-Flag:X-Spam-Report:X-Spam-Status:X-Spam-Level:X-Spam-Checker-Version
  transport = spamcheck
  no_verify

according to these settings, Exim will scan ALL incoming emails both for existing mail boxes and mail forwarders.

In this old thread https://forum.directadmin.com/threads/does-spamassassin-work-on-email-forwarding.42111/ I answered, SpamAssassin did not scan emails sent to forwarders.

Even found an old help article from DirectAdmin site in web archive:

- https://web.archive.org/web/20211024060527/https://help.directadmin.com/item.php?id=156

where it instructs on how to Change SpamAssassin to only scan local mailboxes. So it all makes me think, that the default behaviour was to scan ALL incoming emails.

So, if it does not work this way for you now, you might make sure you don't use outdated templates under directadmin/custombuild/custom/exim/ and don't have custom configs in /etc/*exim*

 

[Strator]

I neither have outdated templates nor custom configs (except for custom ports, which is hardly the culprit). Which I guess raises the question if it's actually working for others? Because #1 having a ton of forwards from other domains forward with spamassassin turned off to a single mail address where spam filtering happens against a single bayes database may be a special case scenario, and #2 even if others have the same issue, they may not have realized this is the reason why they have been getting more spam lately.