Page 1 of 2
outgoing mail taged as spam
Posted: Tue Feb 14, 2006 3:13 pm
by shane
Hi,
Since I've installed qmail-scanner all my outgoing mail is being tagged as spam. I installed qmail scanner according to the instructions on this website:
yum install qmail-scanner
then run the qmail-scanner-reconfigure script
/usr/bin/qmail-scanner-reconfigure
When I send mail it says the following in qmail-queue.log:
Tue, 14 Feb 2006 11:02:47 PST
+++ starting debugging for process 31550 (ppid=31544) by uid=2020
Tue, 14 Feb 2006 11:02:47 PST
w_c: elapsed time from start 0.001764 secs
Tue, 14 Feb 2006 11:02:47 PST
return-path='
shane@webqualityhost.net', recips='
shane.nelson@webqualityhost.net'
Tue, 14 Feb 2006 11:02:47 PST
from='Shane Nelson <
shane@webqualityhost.net>', subj='test', via SMTP from 64.114.68.136
Tue, 14 Feb 2006 11:02:47 PST
SA: yup, this smells like SPAM - hits=17.5/5.0/5.0 - tagging message...
Tue, 14 Feb 2006 11:02:47 PST
SA: finished scan in 0.103257 secs - hits=17.5/5.0
Tue, 14 Feb 2006 11:02:47 PST
p_s: finished scan in 0.018367 secs
Tue, 14 Feb 2006 11:02:47 PST
ini_sc: finished scan of "/var/spool/qmailscan/tmp/webqualityhost.net113994376772231550"...
Tue, 14 Feb 2006 11:02:47 PST
------ Process 31550 finished. Total of 0.158788 secs
How do I stop it from scaning outgoing mail?
Posted: Wed Feb 15, 2006 7:21 am
by breun
Maybe you just need to find out *why* spamassassin is giving your mail so much spam points. Maybe your domain has been blacklisted? Check your maillog to see which spamassassin tests were triggered. You can lookup the meaning of the abbreviations on
http://spamassassin.apache.org/tests.html.
spam points from AWL test?
Posted: Wed Feb 15, 2006 8:08 pm
by shane
Alright, I searched around until I figured out how to enable verbose headers...
X-Spam-Status: Yes, hits=13.4 required=5.0
X-Spam-Level: +++++++++++++
X-Spam-Report: SA TESTS
13 AWL AWL: Auto-whitelist adjustment
Received: from unknown (HELO ?192.168.1.120?) (64.114.68.136)
by webqualityhost.net with SMTP; 15 Feb 2006 15:58:47 -0800
Meanwhile the maillog says:
Feb 15 16:02:36 webqualityhost spamd[19282]: identified spam (13.0/5.0) for qmailq:2520 in 1.2 seconds, 494 bytes.
Feb 15 16:02:36 webqualityhost qmail: 1140048156.820116 new msg 1245279
Feb 15 16:02:36 webqualityhost qmail: 1140048156.820231 info msg 1245279: bytes 1019 from <
shane@webqualityhost.net> qp 19290 uid 2520
Feb 15 16:02:36 webqualityhost qmail-scanner[19276]: Clear:RC:0(64.114.68.136):SA:1(13.0/5.0): 1.194532 494
shane@webqualityhost.net snelson100@yahoo.com test <
43F3C11C.3070705@webqualityhost.net> 1140048155.19278-0.webqualityhost.net:5 orig-webqualityhost.net114004815572219276:494
Does this mean I am getting 13 spam points from the AWL test?: 13 AWL AWL: Auto-whitelist adjustment
Is it a problem that thunderbird is identifiying itself as the 192.168.1.120 instead of the public IP?
Posted: Wed Feb 15, 2006 10:56 pm
by breun
Posted: Thu Feb 16, 2006 1:24 am
by shane
Thanks for helping...
So, when I tested spamassassin by sending this message:
XJS*C4JDBQADN1.NSBN3*2IDNEN*GTUBE-STANDARD-ANTI-UBE-TEST-EMAIL*C.34X
It gave me a spamscore of 1000 which has since been used to send my AWL level into the spam range.
Thanks again for helping to sort this out.
Posted: Thu Feb 16, 2006 1:48 am
by shane
Uhm... I'm running:
But it is still labeling my messages as spam due to AWL. I can't get the command to work, and I can't find a way to get spamassassin to show me the AWL... any ideas?
Posted: Thu Feb 16, 2006 8:26 am
by breun
I'm sorry, I don't really have any experience with AWL. I just googled that one for you. You might want to ask some spamassassin mailinglist or something.
Re: outgoing mail taged as spam
Posted: Mon Apr 20, 2009 6:16 am
by netweblogic
this is way too late, but if anyone (like me) comes across this problem, I found a simpler solution would be to add something like.
in your /etc/mail/spamassassin/local.cf file.
It's a quick solution, but the downside is you open yourself to spam with from headers using your domain. Better to make it more specific, so :
Code: Select all
whitelist_from user@yourdomain.com
Re: outgoing mail taged as spam
Posted: Mon Apr 20, 2009 10:52 am
by faris
Excellent. I'm glad that's sorted.
I quite regularly send a gtube test message and it doesn't seem to cause AWL problems for me for some reason. I wonder why? But AWL is a strange beast
How did you get extended headers in your email anyway? I thought it wasn't possible with qmail-scanner, without messing things up? Obviously I was wrong.
Faris.
Re: outgoing mail taged as spam
Posted: Mon Apr 20, 2009 11:03 am
by scott
To get the extended headers going, youve got to set it up in verbose mode. You do take a performance hit when you do that though
Re: outgoing mail taged as spam
Posted: Mon Apr 20, 2009 12:08 pm
by faris
verbose in the spamassassin config, or in the qmail-scanner.ini?
I remember fiddling around with the spamassassin config a while ago and getting nowhere.
Or was that when I was trying to get it to add full headers even when the message was "clean". I can't remember
Faris.
Re: outgoing mail taged as spam
Posted: Mon Apr 20, 2009 2:25 pm
by scott
I dont recall, I never use it for performance reasons. The qmail-scanner website does talk about it though
Re: outgoing mail taged as spam
Posted: Mon Apr 27, 2009 8:01 pm
by Troy McClure
I have a similar problem with some of my domains. I have gotten my users to enable smtp authentication on their clients and all is ok, until I have them use port 587 as the smtp port (for some reason this has to be done for Outlook 2007). Once they use this port for a while, outgoing messages start getting marked as spam if they are from a dynamic ip address. Does anyone have any idea why this would be happening? I see the reasons they are scoring high in the logs, but when I submit from port 25, it doesn't get scored at all. Is there a reason that port 587 doesn't recognize that the user is authenticate through smtp and allow the mail to go through?
Re: outgoing mail taged as spam
Posted: Mon Apr 27, 2009 11:11 pm
by Troy McClure
After looking into this a little further, it seems that when my users use port 25, they are really just using poplock and so the messages aren't getting scanned. So the port really doesn't matter here I guess since the if I disable poplock then my outgoing messages are scanned. How do I prevent users with dynamic ip addresses from getting marked as spam going out? All of my users that use dynamic ip addresses are having this problem. Here is a test result from one of the messages.
Code: Select all
AWL,BAYES_80,DOS_OE_TO_MX,DYN_RDNS_SHORT_HELO_HTML,HTML_MESSAGE,RCVD_IN_PBL,RCVD_IN_SORBS_DUL,RDNS_DYNAMIC
This keeps happening with all my dynamic ip users. It just takes time. I looked up some of these and found that DOS_OE_TO_MX should be prevented from smtp authentication, but that is how this message was sent. Why would this be happening if they are authenticating?
Re: outgoing mail taged as spam
Posted: Tue Apr 28, 2009 2:23 am
by breun
It seems like you're using DNSBL's that contain IP addresses of dial-up users (
RCVD_IN_PBL,
RCVD_IN_SORBS_DUL,
RDNS_DYNAMIC), so that's why they are being punished by SpamAssassin.
+++ starting debugging for process 31550 (ppid=31544) by uid=2020