Spam not send to spam folder.

Musicfreak

Verified User
Joined
Mar 14, 2017
Messages
39
Location
Netherlands
So when recieve a email that is marked as spam. The one that send the email wil get a email back saying:
Code:
 Message not delivered
There was a problem delivering your message to ..@.. See the technical details below, or try resending in a few minutes.
The response was:

550 High scoring spam message has been dropped

Reporting-MTA: dns; googlemail.com
Received-From-MTA: dns; ..@gmail.com
Arrival-Date: Thu, 21 Jun 2018 14:28:41 -0700 (PDT)
X-Original-Message-ID: <....@gmail.com>

Final-Recipient: rfc822; ...@...
Action: failed
Status: 5.0.0
Remote-MTA: dns; mail.... (IP, the server for the domain ...)
Diagnostic-Code: smtp; 550 High scoring spam message has been dropped
Last-Attempt-Date: Thu, 21 Jun 2018 14:29:00 -0700 (PDT)
But the it isn't send to my spam folder or any other folder on my mail server, so i dont know if i recieve a email/spam. ( a company called me and said they got the mail they send back with a message about spam so i tested it my self).
That it sends a email back saying its spam is nice but if you can choose to enable/disable that would be nice. Also that the email will get into my spam folder.

The settings in directadmin/spamassassin:
Code:
Where do you want the spam to go?
	Send the spam to the user's spam folder.
 
What score threshold do you wish to use?
A lower threshold will block more spam, but can potentially tag legitimate mail.
A higher threshold will let more spam through, but is less likely to tag legitimate mail.
	Medium Threshold (7.5)
 
Would you like to delete high scoring spam?
       No, do not block high scoring spam. Use only the threshold in the previous section.
 
Do you wish to rewrite the subject of a spam email?
	Yes, set the subject to the following:  *****SPAM*****
The settings in /etc/exim.easy_spam_fighter/variables.conf
Code:
EASY_HIGH_SCORE_DROP = 100
EASY_LIMIT = 55
EASY_IS_SPAM = 20
EASY_SPF_PASS = -30
EASY_SPF_SOFT_FAIL = 30
EASY_SPF_FAIL = 100
EASY_DKIM_PASS = -20
EASY_DKIM_FAIL = 100
EASY_NO_REVERSE_IP = 100
EASY_FORWARD_CONFIRMED_RDNS = -10
EASY_DNS_BLACKLIST = 50
EASY_SPAMASSASSIN_MAX_SIZE = 200K

EASY_SKIP_SENDERS = /etc/virtual/esf_skip_senders
EASY_SKIP_RECIPIENTS = /etc/virtual/esf_skip_recipients
EASY_SKIP_HOSTS = /etc/virtual/esf_skip_hosts
EASY_SKIP_IPS = /etc/virtual/esf_skip_ip

.include_if_exists /etc/exim.easy_spam_fighter/variables.conf.custom

addresslist esf_skip_senders = ${if exists{EASY_SKIP_SENDERS}{wildlsearch;EASY_SKIP_SENDERS}}
addresslist esf_skip_recipients = ${if exists{EASY_SKIP_RECIPIENTS}{wildlsearch;EASY_SKIP_RECIPIENTS}}
hostlist esf_skip_hosts = ${if exists{EASY_SKIP_HOSTS}{wildlsearch;EASY_SKIP_HOSTS}}
hostlist esf_skip_ips = ${if exists{EASY_SKIP_IPS}{EASY_SKIP_IPS}}
/etc/exim.easy_spam_fighter/variables.conf.custom
Code:
EASY_DKIM_PASS == -2
EASY_FORWARD_CONFIRMED_RDNS == -2
EASY_SPF_PASS == -2
EASY_SPAMASSASSIN_MAX_SIZE == 1000K
when i removed "EASY_HIGH_SCORE_DROP = 100"
it says "failed to expand ACL string "${if >={100}{EASY_HIGH_SCORE_DROP}}": integer expected but "EASY_HIGH_SCORE_DROP" found "

is there anything i need to change so i still recieve the email in my spam folder. No matter what the score is?
 

zEitEr

Super Moderator
Joined
Apr 11, 2005
Messages
13,854
Location
GMT +7.00
Hello,

Change

EASY_HIGH_SCORE_DROP = 100

to


EASY_HIGH_SCORE_DROP = 200

?
Code:
echo 'EASY_HIGH_SCORE_DROP = 200' >> /etc/exim.easy_spam_fighter/variables.conf.custom
 

Musicfreak

Verified User
Joined
Mar 14, 2017
Messages
39
Location
Netherlands
Hello,

Change

EASY_HIGH_SCORE_DROP = 100

to


EASY_HIGH_SCORE_DROP = 200

?
Code:
echo 'EASY_HIGH_SCORE_DROP = 200' >> /etc/exim.easy_spam_fighter/variables.conf.custom
i did change it to
EASY_HIGH_SCORE_DROP == 1500 ( double == or else it wont overwite it)
But i still dont get it in my spam folder if i send a email with the following text.

Text

XJS*C4JDBQADN1.NSBN3*2IDNEN*GTUBE-STANDARD-ANTI-UBE-TEST-EMAIL*C.34X

Text
I know this is a special like to test the spam filter. and it should be a -1000 but with the 1500 it should still recieve it in my spam folder.
 

Musicfreak

Verified User
Joined
Mar 14, 2017
Messages
39
Location
Netherlands
Check mail logs for more clues
2018-07-02 17:59:11 1fa1E5-0003JF-21 ESF score is 10009 / 1000
2018-07-02 17:59:11 1fa1E5-0003JF-21 drop message based on users high-scoring-spam setting (10009 >= 1000)
2018-07-02 17:59:11 1fa1E5-0003JF-21 H=mail-.google.com [209.85.128.176] X=TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128 CV=no F=<@gmail.com> rejected after DATA: High scoring spam message has been dropped

the score seems to be 10009 which is higher then 1000 so it gets dropped totally. But where can i find that 10009 score. i never set that score my self.

Edit:

When i send the email from my own email domain to a other email in my domain. it gets nicely into the spam folder with the correct score.
But when i send from Gmail to my domain it gets send back to gmail. and the log shows the :
drop message based on users high-scoring-spam setting (10009 >= 1000)

when i change the Gtube score to 100 instead of 1000 i get the same error but then:
drop message based on users high-scoring-spam setting (1009 >= 1000)

Seems like it adds the 9 somewhere but it also ignores the EASY_HIGH_SCORE_DROP == 1500 that is put in the /etc/exim.easy_spam_fighter/variables.conf.custom

when i check the /var/log/maillog it show this at the same time
spamd: identified spam (1000.9/7.5) for admin:1002 in 18.1 seconds, 7898 bytes.
spamd: identified spam (100.9/7.5) for admin:1002 in 18.1 seconds, 7867 bytes.

so it seems to remove the . somehow making it 1009 and nog 100.9
 
Last edited:

zEitEr

Super Moderator
Joined
Apr 11, 2005
Messages
13,854
Location
GMT +7.00
It is $spam_score_int which converts $spam_score 100.9 to 1009, and $spam_score 1000.9 to 10009.


http://exim-users.exim.narkive.com/n3dlDfT8/spam-score-int-floating-point-error
 

Musicfreak

Verified User
Joined
Mar 14, 2017
Messages
39
Location
Netherlands
It is $spam_score_int which converts $spam_score 100.9 to 1009, and $spam_score 1000.9 to 10009.


http://exim-users.exim.narkive.com/n3dlDfT8/spam-score-int-floating-point-error
I dont think that's it. Because it works good when its within its own domain the scores but from a outside domain to my domain i get this. And should it not be 101 ( if its rounded up) then and not just remove the .(dot) and show that score.
 
Top