Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I can not for the life of me figure out why emails from a "white-listed" sender are still getting very high scores from SpamAssassin and not being delivered.

The email headers are:

From orders.usa@theirsite.com Wed Apr 25 10:52:26 2012
X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on
    www.mysite.com
X-Spam-Level: 
X-Spam-Status: No, score=-**107.9** required=5.0 tests=AWL,BAYES_00,HTML_MESSAGE,
    KHOP_DYNAMIC,MIME_QP_LONG_LINE,**USER_IN_WHITELIST,USER_IN_WHITELIST_TO**
    autolearn=ham version=3.3.1
Received: from webaccess.theirsite.com (webaccess.theirsite.com [81.246.110.67])
    by www.mysite.com (8.14.4/8.12.8) with ESMTP id q3PHqPpR019683
    for <alison@mysite>; Wed, 25 Apr 2012 10:52:26 -0700
X-Envelope-To: <alison@mysite.com>
Received: by webaccess.theirsite.com (Postfix, from userid 1001)
    id DA5E64223F; Wed, 25 Apr 2012 19:52:21 +0200 (CEST)
Received: from beovpzardb1.theirsite.local (65.110-246-81.adsl-static.isp.belgacom.be [81.246.110.65])
    by webaccess.theirsite.com (Postfix) with ESMTP id B1C794218A
    for <alison@mysite.com>; Wed, 25 Apr 2012 19:52:21 +0200 (CEST)
Subject: RE: questions about garbage cans
From: =?utf-8?Q?Orders_USA?= <orders.usa@theirsite.com>
To: =?utf-8?Q?alison=40eefaco=2Ecom?= <alison@mysite.com>
Date: Wed, 25 Apr 2012 19:51:11 +0200
Mime-Version: 1.0
Content-Type: multipart/alternative; 
 boundary="=_fC3CzCFWmN93q8ZWTzGby0LlKwQH2gYGeZlQzD+NmoGVrVuE"
In-Reply-To: <005701cd22e7$e79eb4a0$b6dc1de0$@com>
References: <005701cd22e7$e79eb4a0$b6dc1de0$@com>
X-Priority: 3 (Normal)
X-Mailer: Zarafa 7.0.6-32752
Sender: =?utf-8?Q?S_Danner?= <s.danner@theirsite.com>
Message-Id: 
 <zarafa.4f98398f.1ba8.4a80d64c7fe5d835@beovpzardb1.theirsitea.local>
X-Copyrighted-Material: Please visit http://www.theirsite.com

Any help here is greatly appreciated :)

From /var/log/maillog

Apr 25 10:52:26 www sendmail[19683]: q3PHqPpR019683: from=<orders.usa@theirsite.com>, size=15656, class=0, nrcpts=1, msgid=<zarafa.4f98398f.1ba8.4a80d64c7fe5d835@beovpzardb1.theirsite.local>, proto=ESMTP, daemon=MTA, relay=webaccess.theirsite.com [81.246.110.67]
Apr 25 10:52:26 www spamd[8985]: spamd: connection from localhost [127.0.0.1] at port 56915
Apr 25 10:52:26 www spamd[8985]: spamd: setuid to mail succeeded
Apr 25 10:52:27 www spamd[8985]: spamd: processing message <zarafa.4f98398f.1ba8.4a80d64c7fe5d835@beovpzardb1.theirsite.local> for mail:8
Apr 25 10:52:27 www spamd[8985]: spamd: clean message (-107.9/5.0) for mail:8 in 0.7 seconds, 15956 bytes.
Apr 25 10:52:27 www spamd[8985]: spamd: result: . -107 - AWL,BAYES_00,HTML_MESSAGE,KHOP_DYNAMIC,MIME_QP_LONG_LINE,USER_IN_WHITELIST,USER_IN_WHITELIST_TO scantime=0.7,size=15956,user=mail,uid=8,required_score=5.0,rhost=localhost,raddr=127.0.0.1,rport=56915,mid=<zarafa.4f98398f.1ba8.4a80d64c7fe5d835@beovpzardb1.theirsite.local>,bayes=0.000000,autolearn=ham

What Sendmail is doing

Apr 25 10:52:26 www sendmail[19683]: q3PHqPpR019683: from=<orders.usa@theirsite.com>, size=15656, class=0, nrcpts=1, msgid=<zarafa.4f98398f.1ba8.4a80d64c7fe5d835@beovpzardb1.theirsite.local>, proto=ESMTP, daemon=MTA, relay=webaccess.theirsite.com [81.246.110.67]
Apr 25 10:52:27 www sendmail[19855]: q3PHqPpR019683: to="|/etc/mail/jprocess alison@mysite.com", ctladdr=<alison@mysite.com> (8/0), delay=00:00:01, xdelay=00:00:01, mailer=prog, pri=45901, dsn=2.0.0, stat=Sent
share|improve this question

migrated from stackoverflow.com Apr 25 '12 at 21:08

This question came from our site for professional and enthusiast programmers.

1  
This question is not programming realated and is off topic for Stack Overflow. –  Anders Abel Apr 25 '12 at 20:08
    
@Anders, Thanks for your reply. The question is, however, related to programming as SpamAssassin requires programming, or reprogramming to achieve what I need. –  Kevin Gleeson Apr 25 '12 at 20:44
    
Give the -107.9 score, did you check /var/log/maillog to see what the delivery failure is? –  cjc Apr 25 '12 at 21:19
    
@cjc, thanks for taking a look. Ironically, thats where I was headed when I read your post. The maillog is just as cryptic as the headers: –  Kevin Gleeson Apr 25 '12 at 21:43
    
@cjc - Edited original post to include references from maillog –  Kevin Gleeson Apr 25 '12 at 21:46

2 Answers 2

So the score is -107.9 (negative one hundred and seven point nine). That's very, very, very low, certainly less than the 5.0 threshold for spam. I assume the asterisks are added by you.

share|improve this answer
    
Thanks for your reply. Yes, I did add the ** (had hoped it would bold that text) And, I hadn't noticed the - in front of the score. So, the score is extremely low, but the emails are still not going through. Any ideas? –  Kevin Gleeson Apr 25 '12 at 20:17
    
I'm really sorry, no clue. –  cvoinescu Apr 25 '12 at 22:22

The process for figuring out why mail isn't getting delivered is to examine the complete lifecycle of the message as it works its way through the MTA, antispam, antivirus, etc., rather than focusing just on the antispam aspect. This involves looking at /var/log/maillog from the message's receipt to its final delivery.

The OP's mail log shows message q3PHqPpR019683 being received by Sendmail, which then passes it to spamd for SpamAssassin scoring. SpamAssassin assigns it a very negative score, which would be expected for a whitelisted sender. The message is then returned to Sendmail for further processing. Sendmail then successfully hands off the message (with "stat=Sent") to a shell script: to="|/etc/mail/jprocess alison@mysite.com". From the point of view of Sendmail (and SpamAssassin), the message was successfully accepted, scored, and handed over to the next phase in the process, so the issue isn't with SpamAssassin.

The OP's examination of the /etc/mail/jprocess script showed a possible issue with how it handles marked mail before passing the message to the MDA. Modifying that script allowed test messages to successfully be delivered.

Note that the jprocess script seems to be non-standard. The more "accepted" way of doing this is to use something like Amavis-ng or a Sendmail milter. The OP may want to investigate those options.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.