I'm trying to figure out why a lot of my emails are being treated as spam. The setup is Exim4, Dovecot and SpamAssassin. Here is am example email that arrives at the inbox:

Return-path: <andy.newby@gmail.com>
Envelope-to: bob@start-eng.co.uk
Delivery-date: Thu, 01 Jun 2017 13:01:35 +0100
Received: from mail-wr0-f171.google.com ([])
    by admin.newbyhost.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128)
    (Exim 4.86_2)
    (envelope-from <andy.newby@gmail.com>)
    id 1dGOnH-0002Qk-88
    for bob@start-eng.co.uk; Thu, 01 Jun 2017 13:01:35 +0100
Received: by mail-wr0-f171.google.com with SMTP id v104so6526226wrb.0
        for <bob@start-eng.co.uk>; Thu, 01 Jun 2017 05:01:35 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=gmail.com; s=20161025;
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=1e100.net; s=20161025;
X-Gm-Message-State: AODbwcCRSTYCmq3V0QXqzVn1SnIoUcklbBtHZ7nwT7P8Y0R6IaI6isx7
X-Received: by with SMTP id 43mr1190589wrv.123.1496318488607;
 Thu, 01 Jun 2017 05:01:28 -0700 (PDT)
MIME-Version: 1.0
Received: by with HTTP; Thu, 1 Jun 2017 05:01:08 -0700 (PDT)
Reply-To: andy.newby@gmail.com
From: Andy Newby <andy.newby@gmail.com>
Date: Thu, 1 Jun 2017 13:01:08 +0100
Message-ID: <CALvgFsuZG24KsNqAShA5mgcwZYNEpaGyNdoMohe0RhYA8dx9gw@mail.gmail.com>
To: bob <bob@start-eng.co.uk>
Content-Type: multipart/alternative; boundary="001a1146b7bcfc00300550e4cbcd"
X-Spam-Score: 14
X-Spam-Bar: +
X-Spam-Report: Spam detection software, running on the system "admin.newbyhost.com",
 has NOT identified this incoming email as spam.  The original
 message has been attached to this so you can view it or label
 similar future email.  If you have any questions, see
 @@CONTACT_ADDRESS@@ for details.

 Content preview:  test Andy Newby *Email:* andy@ultranerds.co.uk *WWW: *http://www.ultranerds.co.uk
    *Mobile: * 07769 201 576 test [...] 

 Content analysis details:   (1.4 points, 5.0 required)

  pts rule name              description
 ---- ---------------------- --------------------------------------------------
  0.0 URIBL_BLOCKED          ADMINISTRATOR NOTICE: The query to URIBL was blocked.
                              for more information.
                             [URIs: docs.google.com]
 -0.2 RCVD_IN_MSPIKE_H2      RBL: Average reputation (+2)
                             [ listed in wl.mailspike.net]
 -0.0 RCVD_IN_DNSWL_NONE     RBL: Sender listed at http://www.dnswl.org/, no
                             [ listed in list.dnswl.org]
 -0.0 SPF_PASS               SPF: sender matches SPF record
  0.0 FREEMAIL_FROM          Sender email is commonly abused enduser mail provider
  0.0 HTML_MESSAGE           BODY: HTML included in message
  1.6 HTML_IMAGE_ONLY_12     BODY: HTML: images with 800-1200 bytes of words
  0.0 T_DKIM_INVALID         DKIM-Signature header exists but is not valid
  0.0 T_REMOTE_IMAGE         Message contains an external image
X-Spam-Status: Yes
X-ACL-Warn: SpamAssassin detected spam (from andy.newby@gmail.com to bob@start-eng.co.uk).
Subject: *** SPAM *** test

Content-Type: text/plain; charset="UTF-8"


Andy Newby
*Email:*    andy@ultranerds.co.uk
*WWW:    *http://www.ultranerds.co.uk
*Mobile: * 07769 201 576

Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">test<div><br clear=3D"all"><div><div class=3D"gmail_signat=
ure" data-smartmail=3D"gmail_signature"><div dir=3D"ltr"><div><div dir=3D"l=
tr"><div><div dir=3D"ltr"><div><div dir=3D"ltr">Andy Newby=C2=A0<div><font =
size=3D"1"><b>Email:</b>=C2=A0 =C2=A0=C2=A0<a href=3D"mailto:andy@ultranerd=
s.co.uk" target=3D"_blank">andy@ultranerds.co.uk</a>=C2=A0</font></div><div=
><b><span style=3D"font-size:x-small">WWW:</span><span style=3D"font-size:x=
-small">=C2=A0 =C2=A0=C2=A0</span></b><a href=3D"http://www.ultranerds.co.u=
k" style=3D"font-size:x-small" target=3D"_blank">http://www.ultranerds.co.u=
k</a><span style=3D"font-size:x-small"> =C2=A0</span></div><div><b style=3D=
"font-size:x-small">Mobile:=C2=A0</b><span style=3D"font-size:x-small">=C2=
=A007769 201 576</span><div><div><img src=3D"https://docs.google.com/uc?exp=
aUHTUNrb0JVVHY5Q0lwb0h0czY4QlRaYW5pOWp3PQ" style=3D"font-size:12.8px"><br><=


It has 2 totally conflicting scores, and I'm not sure why :/

X-Spam-Score: 14
X-Spam-Bar: +

...and then below that:

 Content analysis details:   (1.4 points, 5.0 required)

And due to the fact X-Spam-Status: is Yes (due to the 14 score, and my threshold is 10), it gets rewritten and moved into my spam box. I really don't get what is going on

In /etc/exim4/exim4.conf.template ,I have this rule set:


system_filter = /etc/exim4/system.filter
system_filter_user = Debian-exim

...and then this rule in /etc/exim4/system.filter:

if $h_X-Spam-Status: contains "Yes"
    headers add "Old-Subject: $h_subject"
    headers remove "Subject"
    headers add "Subject: *** SPAM *** $h_old-subject"
    headers remove "Old-Subject"

UPDATE: As requested, here is the output from /var/log/mail.log:

Jun  1 13:55:40 admin spamd[3850]: spamd: connection from localhost []:45126 to port 783, fd 6
Jun  1 13:55:40 admin spamd[3850]: spamd: setuid to debian-spamd succeeded
Jun  1 13:55:40 admin spamd[3850]: spamd: checking message <CALvgFst0Sw_pMpaByZYZ0iv8+uXhUZKwBt14u4Nuxq+dFTJFKg@mail.gmail.com> for debian-spamd:114
Jun  1 13:55:41 admin spamd[3850]: spamd: clean message (1.6/5.0) for debian-spamd:114 in 0.2 seconds, 3924 bytes.
Jun  1 13:55:41 admin spamd[3850]: spamd: result: . 1 - FREEMAIL_FROM,HTML_IMAGE_ONLY_12,HTML_MESSAGE,RCVD_IN_DNSWL_NONE,RCVD_IN_MSPIKE_H3,RCVD_IN_MSPIKE_WL,SPF_PASS,T_DKIM_INVALID,T_REMOTE_IMAGE,URIBL_BLOCKED scantime=0.2,size=3924,user=debian-spamd,uid=114,required_score=5.0,rhost=localhost,raddr=,rport=45126,mid=<CALvgFst0Sw_pMpaByZYZ0iv8+uXhUZKwBt14u4Nuxq+dFTJFKg@mail.gmail.com>,autolearn=no autolearn_force=no
Jun  1 13:55:41 admin spamd[3670]: prefork: child states: II

...and then /var/log/exim4/mainlog:

2017-06-01 13:55:40 1dGPdc-0004Pc-Uq DKIM: d=gmail.com s=20161025 c=relaxed/relaxed a=rsa-sha256 [verification succeeded]
2017-06-01 13:55:41 1dGPdc-0004Pc-Uq <= andy.newby@gmail.com H=mail-wm0-f45.google.com [] P=esmtps X=TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128 CV=no S=5747 id=CALvgFst0Sw_pMpaByZYZ0iv8+uXhUZKwBt14u4Nuxq+dFTJFKg@mail.gmail.com
2017-06-01 13:55:41 1dGPdc-0004Pc-Uq => info <info@start-eng.co.uk> R=localuser_spam T=local_spam_delivery
2017-06-01 13:55:41 1dGPdc-0004Pc-Uq Completed
  • There isn't enough information. Could you add lines from your mail logs regarding the same message? Jun 1, 2017 at 12:42
  • @EsaJokinen Thanks for the reply. I've added the output of 2 of the logs. Please let me know if there are others I should be looking at? Jun 1, 2017 at 12:57
  • The current log lines are consistent with the X-Spam-Report. I have a hunch there's another instance of SpamAssassin the mail goes through. Your logs are incomplete: these line only shows what happens inside the (working) spamd. I'd like to know the whole flow through the mail server from arriving to the final delivery to the mailbox. Jun 1, 2017 at 13:16
  • 1
    What is goign on with your DKIM stuff? DKIM-Signature header exists but is not valid - this may be the cause
    – ivanivan
    Jun 1, 2017 at 13:29
  • @EsaJokinen - I'm not sure how to work out what else is going on? I'm still a bit of a server newbie (no pun intended ;)) Jun 1, 2017 at 13:52

1 Answer 1

  1. On that SpamAssassin report you can see your IP it's listed on 2 RBLS (mailspike.net and dnswl.org). Check those sites to see how you can get removed.

  2. The Spam Score 10 on config file it's translated to spam level 1.0 which it's very very low, usually 5.0 it's when a message gets marked as spam. Change the /etc/exim4/exim4.conf.template spam score to 50 or more.

  3. Run your domain on https://intodns.com/ to see mail related problems which can get you listed on RBLS.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.