Spam Assassin not checking forwarded mail anymore

S

Strator

Verified User
Joined
Jan 19, 2011
Messages
295
Hi guys,

Ten days ago I updated to DA 1.704 and I've received a lot of spam since then. Finally got to look into it today, and it appears that spamassassin isn't checking forwarded mail anymore. Seems to work within the same domain, but forwarding from a different domain ins bypassing spamassasin now. Checked the various threads and was surprised that nobody reported similar issues. I skipped a version or two, so the change may have come with the 1.703 or even the 1.702 update. Any idea what's going on, and why?

Thanks!
 
Thanks, that kinda rung a very distant bell, but I wouldn't have remembered on my own. According to my ancient notes (think of carvings on a stone tablet) I tried a couple of things back in the days, but it seems like in the end, all I did was turn Spam Assassin OFF for the forwarding domains - that would ensure it would be scanned before being delivered to the actual mailbox (as it hadn't been scanned before).

Is it possible that this behavior was changed in those recent updates, or do I need to look further?
 
Probably I was wrong. One of my old servers with CentOS 7 has this in /etc/exim.spamassassin.conf

Bash: 
#1.4
# Spam Assassin
spamcheck_director:
  driver = accept
  condition = ${if !eq{$acl_m_spam_assassin_has_run}{1}}
  condition = ${if !eq{$acl_c_spam_assassin_has_run}{1}}
  condition = "${if and { \
                        {!eq {$received_protocol}{spam-scanned}} \
                        {!eq {$received_protocol}{local}} \
                        {exists{${extract{5}{:}{${lookup{${lookup{$domain}lsearch*{/etc/virtual/domainowners}{$value}}}lsearch{/etc/passwd}{$value}}}}/.spamassassin/user_prefs}} \
                        {<{$message_size}{500k}} \
                } {1}{0}}"
  retry_use_local_part
  headers_remove = X-Spam-Flag:X-Spam-Report:X-Spam-Status:X-Spam-Level:X-Spam-Checker-Version
  transport = spamcheck
  no_verify

according to these settings, Exim will scan ALL incoming emails both for existing mail boxes and mail forwarders.

In this old thread https://forum.directadmin.com/threads/does-spamassassin-work-on-email-forwarding.42111/ I answered, SpamAssassin did not scan emails sent to forwarders.

Even found an old help article from DirectAdmin site in web archive:

- https://web.archive.org/web/20211024060527/https://help.directadmin.com/item.php?id=156

where it instructs on how to Change SpamAssassin to only scan local mailboxes. So it all makes me think, that the default behaviour was to scan ALL incoming emails.

So, if it does not work this way for you now, you might make sure you don't use outdated templates under directadmin/custombuild/custom/exim/ and don't have custom configs in /etc/*exim*
 
I neither have outdated templates nor custom configs (except for custom ports, which is hardly the culprit). Which I guess raises the question if it's actually working for others? Because #1 having a ton of forwards from other domains forward with spamassassin turned off to a single mail address where spam filtering happens against a single bayes database may be a special case scenario, and #2 even if others have the same issue, they may not have realized this is the reason why they have been getting more spam lately.
 
Anyone with firsthand info if this is actually working for them? Thanks!
 
So to answer my own question, it appears like this has indeed changed with the Exim changes two months ago.

OLD:
- Simply turn Spamassasin OFF for the forwarding domain

NEW:
- Turn Spamassassin ON für the forwarding domain
- Set blocking strategy to "inbox" - that way, if the receiving address has blocking strategy set to spambox, that is where it will end up at.

Likely reason nobody has complained about this is because I forward from one account to the other. As mentioned above, forwarding within the same domain didn't change, my guess is that things might not have changed either if domains are under the same account, but that is for someone else to report.
 
Strator said:
- Turn Spamassassin ON für the forwarding domain
Click to expand...
I don't really understand this. Spamassassin is on for a complete domain or it's not. You mean here that spamassassin has to be on for any domain you send or forward to?

Maybe that is why I didn't notice it, next to the fact that we don't really do internal forwarding, but it's good to know.
 
Its really simple: I run a dozen sites off a dozen accounts, but I only have one mailbox (I'm not that important). Hence, eleven of those twelve domains only do forwarding. Setting Spamassassin to OFF for those used to be the way to go. Now you need to turn Spamassassin ON and do nothing else with the spam (the receiving mailbox will handle it according to the spam tags).

What's not ideal about the new setup is that, for a single bayes database to handle it all, it now needs to be global, so I guess I'll have to make it world-readable.
 
You must log in or register to reply here.
Back
Top