Resolved Amazing spamassassin score !

[DHR]

Server operating system version

AlmaLinux 8.8 (Sapphire Caracal)

Plesk version and microupdate number

Plesk Obsidian 18.0.56,

Plesk / Almalinux

Qmail / Dovecot / Spf / Dkim / Dmarc/ spamassassin



Hello,

For the past few days, I've had a problem with the scores of certain emails in my domain. No matter how much I search, I can't see a solution.

All emails go through well (via SMTP) but on 2 addresses the score is amazing while on the others the score is normal.



**** Crazy score and distributed

SpamAssassin 3.4.6 (2021-04-09) on mysite.com

No, score=-101.0 required=7.0 tests=ALL_TRUSTED,HTML_MESSAGE, SPF_PASS,URIBL_BLOCKED,USER_IN_WELCOMELIST,USER_IN_WHITELIST autolearn=ham autolearn_force=no version=3.4.6

(qmail 111503 invoked from network); 11 Oct 2023 11:08:34 +0200

mysite.com; dmarc=pass (p=QUARANTINE sp=NONE) smtp.from=mysite.com header.from=mysite.com; spf=pass (sender IP is 94.xxx.xx.xxx) smtp.mailfrom=[email protected] smtp.helo=[192.168.1.48]

pass (mysite.com: connection is authenticated)

from unknown (HELO ?192.168.1.48?) (94.xxx.xx.xxx) by mysite.com with ESMTPSA (TLS_AES_128_GCM_SHA256 encrypted, authenticated); 11 Oct 2023 11:08:34 +0200

1.0

multipart/alternative; boundary="------------5COSBP0ekJ7kbXOQEAsqC10B"



**** Good

SpamAssassin 3.4.6 (2021-04-09) on mysite.com

No, score=-1.0 required=7.0 tests=ALL_TRUSTED,HTML_MESSAGE, SPF_PASS autolearn=ham autolearn_force=no version=3.4.6

(qmail 11477 invoked from network); 11 Oct 2023 15:51:12 +0200

mysite.com; dmarc=pass (p=QUARANTINE sp=NONE) smtp.from=mysite.com header.from=mysite.com; spf=pass (sender IP is 94.xxx.xx.xxx) smtp.mailfrom=[email protected] smtp.helo=[192.168.1.48]

pass (mysite.com: connection is authenticated)

from unknown (HELO ?192.168.1.48?) (94.xxx.xx.xxx) by mysite.com with ESMTPSA (TLS_AES_128_GCM_SHA256 encrypted, authenticated); 11 Oct 2023 15:51:12 +0200

multipart/alternative; boundary="------------viryEeCppKFhfGUWhibL53Zx"

1.0



Thank you for your help !

 

[Kaspar]

No, score=-101.0 required=7.0 tests=ALL_TRUSTED,HTML_MESSAGE, SPF_PASS,URIBL_BLOCKED,USER_IN_WELCOMELIST,USER_IN_WHITELIST autolearn=ham autolearn_force=no version=3.4.6

The USER_IN_WHITELIST in the email header indicates that the email address (or domain) of the sender is white listed (also called welcome list). Because of that it gets a negative spam score.

More information on the SpamAssasin black and whitelist in Plesk can be found here: SpamAssassin Spam Filter

 

[DHR]

A big thank you for your reply ! I was so surprised by the number that I didn't see the minus sign!