Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

When I run a spamassassin test from terminal i.e. :

# spamassassin -t -D < message.txt

The plugins produce hits and spamsassassin correctly marks the hits.

When mail comes through to the server, however, no hits are recorded and the plugins do not appear to be running. Specifically I am attempting to use Pyzor, Razor2, and iXhash plugins

The DCC plugin works correctly but not the others. I feel like this might be a cPanel configuration problem.

Any ideas as to what I should look to fix?

System is CentOs Exim cPanel / WHM

Below are examples, both using the same email file:

Test output in terminal:

 pts rule name              description
---- ---------------------- --------------------------------------------------
 0.0 URIBL_BLOCKED          ADMINISTRATOR NOTICE: The query to URIBL was blocked.
                            See
                            http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                             for more information.
                            [URIs: simplelikestudio.pw]
 3.5 BAYES_99               BODY: Bayes spam probability is 99 to 100%
                            [score: 0.9999]
 0.2 CK_HELO_GENERIC        Relay used name indicative of a Dynamic Pool or
                            Generic rPTR
 1.4 RCVD_IN_BRBL_LASTEXT   RBL: RCVD_IN_BRBL_LASTEXT
                            [199.38.244.39 listed in bb.barracudacentral.org]
 0.0 NO_DNS_FOR_FROM        DNS: Envelope sender has no MX or A DNS records
-0.0 SPF_HELO_PASS          SPF: HELO matches SPF record
 0.9 DKIM_ADSP_NXDOMAIN     No valid author signature and domain not in DNS
 1.7 URIBL_DBL_SPAM         Contains an URL listed in the DBL blocklist
                            [URIs: simplelikestudio.pw]
 0.0 HTML_MESSAGE           BODY: HTML included in message
 2.0 GENERIC_IXHASH         BODY: iXhash found @ generic.ixhash.net
 0.7 MIME_HTML_ONLY         BODY: Message only has text/html MIME parts
 1.1 HTML_IMAGE_ONLY_16     BODY: HTML: images with 1200-1600 bytes of words
 8.0 DCC_CHECK              Detected as bulk mail by DCC (dcc-servers.net)
 5.0 RAZOR2_CHECK           Listed in Razor2 (http://razor.sf.net/)
 1.9 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level
                            above 50%
                            [cf: 100]
 0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%
                            [cf: 100]
 0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily valid
 5.0 PYZOR_CHECK            Listed in Pyzor (http://pyzor.sf.net/)
 0.3 DIGEST_MULTIPLE        Message hits more than one network digest check
 0.0 HTML_SHORT_LINK_IMG_2  HTML is very short with a linked image

And in the actual email (you'll notice Razor, Pyzor, and iXhash all missing):

 pts rule name              description
 ---- ---------------------- --------------------------------------------------
  0.0 NO_DNS_FOR_FROM        DNS: Envelope sender has no MX or A DNS records
  0.0 URIBL_BLOCKED          ADMINISTRATOR NOTICE: The query to URIBL was blocked.
                             See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: simplelikestudio.pw]
  1.7 URIBL_DBL_SPAM         Contains an URL listed in the DBL blocklist
                             [URIs: simplelikestudio.pw]
  0.0 CK_HELO_GENERIC        Relay used name indicative of a Dynamic Pool or
                             Generic rPTR
  1.4 RCVD_IN_BRBL_LASTEXT   RBL: RCVD_IN_BRBL_LASTEXT
                             [199.38.244.39 listed in bb.barracudacentral.org]
 -0.0 SPF_HELO_PASS          SPF: HELO matches SPF record
  0.9 DKIM_ADSP_NXDOMAIN     No valid author signature and domain not in DNS
  0.0 HTML_MESSAGE           BODY: HTML included in message
  3.0 BAYES_95               BODY: Bayes spam probability is 95 to 99%
                             [score: 0.9648]
  2.0 GENERIC_IXHASH         BODY: iXhash found @ generic.ixhash.net
  0.7 MIME_HTML_ONLY         BODY: Message only has text/html MIME parts
  1.1 HTML_IMAGE_ONLY_16     BODY: HTML: images with 1200-1600 bytes of words
  8.0 DCC_CHECK              Detected as bulk mail by DCC (dcc-servers.net)
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily valid
  0.0 HTML_SHORT_LINK_IMG_2  HTML is very short with a linked imag
share|improve this question

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.