Emails not scanned by spamassassin

[chris0147]

Hi all,

I need your help. I have spamassassin enabled on my server and when I sent the spam emails for a test, the spamassassin did not scanned for incoming emails.

However, I went on WHM and I found:

Scan outgoing messages for malware [?]
Off

Apache SpamAssassin™ Options
Scan outgoing messages for spam and reject based on the Apache SpamAssassin™ internal spam_score setting [?]
Off

Scan outgoing messages for spam and reject based on defined Apache SpamAssassin™ score (Minimum: 0.1; Maximum: 99.9) [?]
Off


How I can get the incoming emails to be scanning by spamassassin?

Do I have to select on both options for Scan outgoing messages to get them to be enabled so my incoming emails will get scan by spamassin?

If so, how I can remove the ***SPAM**** when my emails get scanning by spamassassin to move them to junk folder??

Thanks in advance.

 

[cPRex]

Hey there! The options you mentioned will be used to scan outbound email that is sent from the server. If you were sending your spam test from an email account on the server, it would not have been scanned.

You would want to use an external address to test the spam system, but there is no reason you couldn't also enable those options as well.

We have a guide at https://blog.cpanel.com/spam-filtering-on-cpanel-everything-you-need-to-know-about-spamassassin/ that gives many more details about spam filtering, and about 1/3 of the way down in that article it talks about moving the messages to a spam box.

Let me know if that helps!

 

[chris0147]

I got it working by enabled the spamassassin in the WHM > Home »Service Configuration »Service Manager > SpamAssassin tick to enabled.

When I send the test spam emails, I'm getting this:

X-Spam-Subject:   Hey
X-Spam-Status: Yes, score=904.8
X-Spam-Score: 9048
X-Spam-Bar: +++++++++++++++++++++++++++++++++++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "server.mydomain.com",
has identified this incoming email as possible spam.  The original
message has been attached to this so you can view it or label
similar future email.  If you have any questions, see
root\@localhost for details.
Content preview:  XJS*C4JDBQADN1.NSBN3*2IDNEN*GTUBE-STANDARD-ANTI-UBE-TEST-EMAIL*C.34X
    XJS*C4JDBQADN1.NSBN3*2IDNEN*GTUBE-STANDARD-ANTI-UBE-TEST-EMAIL*C.34X
Content analysis details:   (904.8 points, 5.0 required)
  pts rule name              description
---- ---------------------- --------------------------------------------------
1000 GTUBE                  BODY: Generic Test for Unsolicited Bulk Email
  0.0 URIBL_BLOCKED          ADMINISTRATOR NOTICE: The query to URIBL was
                             blocked.  See
                             DnsBlocklists - SPAMASSASSIN - Apache Software Foundation
                              for more information.
                             [URIs: my-email-signature.link]
-0.0 SPF_PASS               SPF: sender matches SPF record
  0.0 FREEMAIL_FROM          Sender email is commonly abused enduser mail
                             provider
                             [email[at]xxxxxxx.com]
-0.0 SUBJECT_IN_WELCOMELIST Subject: contains string in the user's
                             welcome-list
  0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends
                             in digit
                             [email[at]xxxxxxx.com]
  1.2 HTML_IMAGE_RATIO_02    BODY: HTML has a low ratio of text to image
                             area
  0.3 HTML_IMAGE_ONLY_04     BODY: HTML: images with 0-400 bytes of words
  0.0 HTML_MESSAGE           BODY: HTML included in message
-0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
-0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
-0.1 DKIM_VALID_EF          Message has a valid DKIM or DK signature from
                             envelope-from domain
  2.0 PYZOR_CHECK            Listed in Pyzor
                             (Welcome to Pyzor’s documentation! — Pyzor 1.0 documentation)
  0.0 TVD_SPACE_RATIO        No description available.
-100 SUBJECT_IN_WHITELIST   DEPRECATED: See SUBJECT_IN_WELCOMELIST
  1.2 T_REMOTE_IMAGE         Message contains an external image
X-Spam-Flag: YES

How I can configure them to stop them display in the header when my emails get moving to junk folder??

 

[cPRex]

You can customize the X-Spam-Subject/Subject header prefix at WHM>>Service Configuration>>Exim Configuration Manager to change that header.

 

[chris0147]

Thanks for the quick response. Where I can find it in the WHM > Exim Configuration Manager to customize it??

You didnt say where I need to modify it and change it??

 

[cPRex]

All these options are available in the main page of the interface. Scroll down to the Filters section and you'll see this option:

Apache SpamAssassin™: X-Spam-Subject/Subject header prefix for spam emails [?]

 

[chris0147]

Thanks, I will check it out.

If I get the options disabled, would the spamassassin be able to move the emails to spam folder without rewrite on the header when I disabled on these options??

 

[cPRex]

Yes, it will still be able to mark the message as spam and move it.

 

[chris0147]

I have selected on the option of the checkbox as I have changed from ***SPAM*** to empty:

Apache SpamAssassin™: X-Spam-Subject/Subject header prefix for spam emails [?]


It is still showing X-Spam in the header. I have also checked on the option:

Apache SpamAssassin™: Global Subject Rewrite [?]


It is already off.

Any idea how to stop the spamassassin rewrite the X-Spam in the header?

 

[chris0147]

I dont think you understand what I am asking for, I have asked you before HOW to disable the options to stop the spamassassin to rewrite the X-Spam in the header. You said X-Spam-Subject, it will only rewrite for the subject. You got it wrong. I am talking about the headers not the subject!

 

[cPRex]

Thanks for the clarification - can you let me know exactly what you're trying to achieve by changing the header? I don't think there is a way to do that and still have all of the spam system work properly, so if you can let me know the ultimate goal I might be able to propose a better solution.

 

[chris0147]

What I am trying to achieve is when I receive the spam emails in my inbox, I want to move them to junk folder automatically without rewrite on the original header.

Is that possible to do that?

 

[cPRex]

Thanks for the clarification. As you've found, that header is what cPanel/SpamAssassin use to move the message to the Junk folder. I don't have an alternative method available on my end, but you could always explore the world of Exim customizations if you wanted to see if that is an option directly on the Exim side of things.

 

[chris0147]

You're welcome. Same here, I can't have an alternative to modify the headers of the email. Once it have changed, there is nothing I can do. But I've got a solution, I'm using PHP script to read my email message and if the email is found to be spam, the PHP script will then move the email to spam folder without modify the header. If people on here need my help, I'm more than happy to share them the PHP code I've got.