outgoing mail taged as spam

Forum for getting help with Project Gamera, Spamassassin, Clamav, qmail-scanner and other anti-spam tools.
shane
New Forum User
New Forum User
Posts: 4
Joined: Tue Feb 14, 2006 3:05 pm

outgoing mail taged as spam

Unread post by shane »

Hi,

Since I've installed qmail-scanner all my outgoing mail is being tagged as spam. I installed qmail scanner according to the instructions on this website:
yum install qmail-scanner
then run the qmail-scanner-reconfigure script
/usr/bin/qmail-scanner-reconfigure
When I send mail it says the following in qmail-queue.log:
Tue, 14 Feb 2006 11:02:47 PST:31550: +++ starting debugging for process 31550 (ppid=31544) by uid=2020
Tue, 14 Feb 2006 11:02:47 PST:31550: w_c: elapsed time from start 0.001764 secs
Tue, 14 Feb 2006 11:02:47 PST:31550: return-path='shane@webqualityhost.net', recips='shane.nelson@webqualityhost.net'
Tue, 14 Feb 2006 11:02:47 PST:31550: from='Shane Nelson <shane@webqualityhost.net>', subj='test', via SMTP from 64.114.68.136
Tue, 14 Feb 2006 11:02:47 PST:31550: SA: yup, this smells like SPAM - hits=17.5/5.0/5.0 - tagging message...
Tue, 14 Feb 2006 11:02:47 PST:31550: SA: finished scan in 0.103257 secs - hits=17.5/5.0
Tue, 14 Feb 2006 11:02:47 PST:31550: p_s: finished scan in 0.018367 secs
Tue, 14 Feb 2006 11:02:47 PST:31550: ini_sc: finished scan of "/var/spool/qmailscan/tmp/webqualityhost.net113994376772231550"...
Tue, 14 Feb 2006 11:02:47 PST:31550: ------ Process 31550 finished. Total of 0.158788 secs
How do I stop it from scaning outgoing mail?
breun
Long Time Forum Regular
Long Time Forum Regular
Posts: 2813
Joined: Sat Aug 20, 2005 9:30 am
Location: The Netherlands

Unread post by breun »

Maybe you just need to find out *why* spamassassin is giving your mail so much spam points. Maybe your domain has been blacklisted? Check your maillog to see which spamassassin tests were triggered. You can lookup the meaning of the abbreviations on http://spamassassin.apache.org/tests.html.
shane
New Forum User
New Forum User
Posts: 4
Joined: Tue Feb 14, 2006 3:05 pm

spam points from AWL test?

Unread post by shane »

Alright, I searched around until I figured out how to enable verbose headers...
X-Spam-Status: Yes, hits=13.4 required=5.0
X-Spam-Level: +++++++++++++
X-Spam-Report: SA TESTS
13 AWL AWL: Auto-whitelist adjustment
Received: from unknown (HELO ?192.168.1.120?) (64.114.68.136)
by webqualityhost.net with SMTP; 15 Feb 2006 15:58:47 -0800
Meanwhile the maillog says:
Feb 15 16:02:36 webqualityhost spamd[19282]: identified spam (13.0/5.0) for qmailq:2520 in 1.2 seconds, 494 bytes.
Feb 15 16:02:36 webqualityhost qmail: 1140048156.820116 new msg 1245279
Feb 15 16:02:36 webqualityhost qmail: 1140048156.820231 info msg 1245279: bytes 1019 from <shane@webqualityhost.net> qp 19290 uid 2520
Feb 15 16:02:36 webqualityhost qmail-scanner[19276]: Clear:RC:0(64.114.68.136):SA:1(13.0/5.0): 1.194532 494 shane@webqualityhost.net snelson100@yahoo.com test <43F3C11C.3070705@webqualityhost.net> 1140048155.19278-0.webqualityhost.net:5 orig-webqualityhost.net114004815572219276:494
Does this mean I am getting 13 spam points from the AWL test?: 13 AWL AWL: Auto-whitelist adjustment

Is it a problem that thunderbird is identifiying itself as the 192.168.1.120 instead of the public IP?
breun
Long Time Forum Regular
Long Time Forum Regular
Posts: 2813
Joined: Sat Aug 20, 2005 9:30 am
Location: The Netherlands

Unread post by breun »

shane
New Forum User
New Forum User
Posts: 4
Joined: Tue Feb 14, 2006 3:05 pm

Unread post by shane »

Thanks for helping...

So, when I tested spamassassin by sending this message:

XJS*C4JDBQADN1.NSBN3*2IDNEN*GTUBE-STANDARD-ANTI-UBE-TEST-EMAIL*C.34X

It gave me a spamscore of 1000 which has since been used to send my AWL level into the spam range.

Thanks again for helping to sort this out.
shane
New Forum User
New Forum User
Posts: 4
Joined: Tue Feb 14, 2006 3:05 pm

Unread post by shane »

Uhm... I'm running:
spamassassin --remove-addr-from-whitelist=shane@webqualityhost.net
SpamAssassin auto-whitelist: removing address: shane@webqualityhost.net
But it is still labeling my messages as spam due to AWL. I can't get the command to work, and I can't find a way to get spamassassin to show me the AWL... any ideas?
breun
Long Time Forum Regular
Long Time Forum Regular
Posts: 2813
Joined: Sat Aug 20, 2005 9:30 am
Location: The Netherlands

Unread post by breun »

I'm sorry, I don't really have any experience with AWL. I just googled that one for you. You might want to ask some spamassassin mailinglist or something.
netweblogic
Forum User
Forum User
Posts: 29
Joined: Mon Jan 12, 2009 2:31 pm

Re: outgoing mail taged as spam

Unread post by netweblogic »

this is way too late, but if anyone (like me) comes across this problem, I found a simpler solution would be to add something like.

Code: Select all

whitelist_from	*@yourdomain.com
in your /etc/mail/spamassassin/local.cf file.

It's a quick solution, but the downside is you open yourself to spam with from headers using your domain. Better to make it more specific, so :

Code: Select all

whitelist_from	user@yourdomain.com
faris
Long Time Forum Regular
Long Time Forum Regular
Posts: 2321
Joined: Thu Dec 09, 2004 11:19 am

Re: outgoing mail taged as spam

Unread post by faris »

Excellent. I'm glad that's sorted.

I quite regularly send a gtube test message and it doesn't seem to cause AWL problems for me for some reason. I wonder why? But AWL is a strange beast :-)

How did you get extended headers in your email anyway? I thought it wasn't possible with qmail-scanner, without messing things up? Obviously I was wrong.

Faris.
--------------------------------
<advert>
If you want to rent a UK-based VPS that comes with friendly advice and support from a fellow ART fan, please get in touch.
</advert>
scott
Atomicorp Staff - Site Admin
Atomicorp Staff - Site Admin
Posts: 8355
Joined: Wed Dec 31, 1969 8:00 pm
Location: earth
Contact:

Re: outgoing mail taged as spam

Unread post by scott »

To get the extended headers going, youve got to set it up in verbose mode. You do take a performance hit when you do that though
faris
Long Time Forum Regular
Long Time Forum Regular
Posts: 2321
Joined: Thu Dec 09, 2004 11:19 am

Re: outgoing mail taged as spam

Unread post by faris »

verbose in the spamassassin config, or in the qmail-scanner.ini?

I remember fiddling around with the spamassassin config a while ago and getting nowhere.

Or was that when I was trying to get it to add full headers even when the message was "clean". I can't remember :-(

Faris.
--------------------------------
<advert>
If you want to rent a UK-based VPS that comes with friendly advice and support from a fellow ART fan, please get in touch.
</advert>
scott
Atomicorp Staff - Site Admin
Atomicorp Staff - Site Admin
Posts: 8355
Joined: Wed Dec 31, 1969 8:00 pm
Location: earth
Contact:

Re: outgoing mail taged as spam

Unread post by scott »

I dont recall, I never use it for performance reasons. The qmail-scanner website does talk about it though
Troy McClure
Forum Regular
Forum Regular
Posts: 196
Joined: Tue May 10, 2005 1:24 pm

Re: outgoing mail taged as spam

Unread post by Troy McClure »

I have a similar problem with some of my domains. I have gotten my users to enable smtp authentication on their clients and all is ok, until I have them use port 587 as the smtp port (for some reason this has to be done for Outlook 2007). Once they use this port for a while, outgoing messages start getting marked as spam if they are from a dynamic ip address. Does anyone have any idea why this would be happening? I see the reasons they are scoring high in the logs, but when I submit from port 25, it doesn't get scored at all. Is there a reason that port 587 doesn't recognize that the user is authenticate through smtp and allow the mail to go through?
Troy McClure
Forum Regular
Forum Regular
Posts: 196
Joined: Tue May 10, 2005 1:24 pm

Re: outgoing mail taged as spam

Unread post by Troy McClure »

After looking into this a little further, it seems that when my users use port 25, they are really just using poplock and so the messages aren't getting scanned. So the port really doesn't matter here I guess since the if I disable poplock then my outgoing messages are scanned. How do I prevent users with dynamic ip addresses from getting marked as spam going out? All of my users that use dynamic ip addresses are having this problem. Here is a test result from one of the messages.

Code: Select all

AWL,BAYES_80,DOS_OE_TO_MX,DYN_RDNS_SHORT_HELO_HTML,HTML_MESSAGE,RCVD_IN_PBL,RCVD_IN_SORBS_DUL,RDNS_DYNAMIC
This keeps happening with all my dynamic ip users. It just takes time. I looked up some of these and found that DOS_OE_TO_MX should be prevented from smtp authentication, but that is how this message was sent. Why would this be happening if they are authenticating?
breun
Long Time Forum Regular
Long Time Forum Regular
Posts: 2813
Joined: Sat Aug 20, 2005 9:30 am
Location: The Netherlands

Re: outgoing mail taged as spam

Unread post by breun »

It seems like you're using DNSBL's that contain IP addresses of dial-up users (RCVD_IN_PBL, RCVD_IN_SORBS_DUL, RDNS_DYNAMIC), so that's why they are being punished by SpamAssassin.
Lemonbit Internet Dedicated Server Management
Post Reply