Issue I get spam report mail instead of moving to the spam folder

[FuXXz]

Server operating system version

Debian 10.13

Plesk version and microupdate number

18.0.57

Hello everyone,

Whenever spam is detected, my Plesk sends me an email “Spam detection software, running on the system "xy.de", has identified this incoming email as possible spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details.” with the spam email as an attachment.
But, as it says in the settings, it should send the emails to the spam folder.
How do I get this corrected?
Greetings

 

[Kaspar]

Search trough the SpamAssassin configuration files (I believe located in /etc/mail/spamassassin) to see if

report_safe

option is configured.

grep -R 'report_safe' .

If it is, you can set is to 0 to turn off reporting.

 

[FuXXz]

Thank you for reply.
/etc/spamassassin/local.cf

# Save spam messages as a message/rfc822 MIME attachment instead of
# modifying the original message (0: off, 2: use text/plain instead)
#
# report_safe 1

So no, it is not configured

 

[Kaspar]

Strange, the report_safe options is usually what's causing emails like "Spam detection software, running on the system "xy.de" to be send.

The only other thing I can think off is that there might some additional configuration in the /var/qmail/mailnames/example.com/johndoe/.spamassassin/user_prefs file.

 

[FuXXz]

no configs in this file, only :

#ATTENTION!
#
#DO NOT MODIFY THIS FILE BECAUSE IT WAS GENERATED AUTOMATICALLY,
#SO ALL YOUR CHANGES WILL BE LOST THE NEXT TIME THE FILE IS GENERATED.
required_score 5.0
rewrite_header subject

 

[FuXXz]

I have read through all the files in the user folders and perhaps found a hint?
In the /var/qmail/mailnames/example.com/johndoe/.dovecot.sieve.log
fileinto action: failed to store into mailbox 'INBOX.Spam': Mailbox doesn't exist: INBOX.Spam.

So I think it has something to do with the dovecot configuration. The default dovecot conf
# Default private namespace setup compatible with Courier-IMAP.

namespace inbox {
separator = .
prefix = INBOX.
inbox = yes

and my conf

namespace inbox {
separator = .
prefix =
inbox = yes

this is because i want to get rid of the INBOX prefix, for Microsoft Outlook configuration purposes
So my folder structure from a fresh added e-mail account is like this


Am I correct in assuming this is the problem?
Do I now have to change the configuration? Which of course could cause problems with existing email accounts.
Or can I just tell Plesk/Spamassasin that the spam folder is .spam and not INBOX.spam?

 

[Kaspar]

Am I correct in assuming this is the problem?

I think it does explain why email messages aren't moved to the spam folder. I am not sure if the “Spam detection software, running on the system "xy.de" emails your are receiving are related. But perhaps it is.

Any way, have a look a this post to see how you can best modify the dovecot configuration to keep namespace compatibility. It's best to add this configuration to new file, for example 99-cust-namespace.conf (in the conf.d directory), instead of changing the dovecot.conf (which might get overwritten by a update).

 

[FuXXz]

There is no spam detection software. There is only Plesk with its Spamassassin. I tested Warden Spam from the extensions a few months ago, but have long since uninstalled it.

Regardless of this, I should first fix the folder problem, then I'll look further.
My changed configuration is already in an extra file
/etc/dovecot/conf.d/99-customization.conf

But if I adjust the configuration now, I will have to manually move a few thousand emails to the right folders, otherwise the e-mail client will not display them. Or am I wrong?
at the moment the /var/qmail/mailnames/example.com/johndoe/Maildir shows this:
.draft
.sent
.spam
.trahs
.customFolder1 (created in outlook or thunderbird)
.customFolder2
.customFolder3
.customFolder4
and so on

Custom folders that should be displayed directly under the inbox and were created in Outlook therefore have the following format
.INBOX.CustomFolder1
.INBOX.CustomFolder2

 

[FuXXz]

Is it possible to change the dovecot configuration / folder for only one mailbox? I could test something like this before I set it up on the server

 

[Kaspar]

It's been a while since I've been tinkering with the Dovecot configuration. So I am not really sure to be honest. Perhaps if you Google around you'll find similar questions (and hopefully some answers too).

I *think* changing the namespace configuration to the example in my other post won't affect existing mailboxes because of the compatibility setting. But I am not entirely sure. So proceed with caution.

 

[FuXXz]

Ok, thank you very much for help, i will report shortly

 

[FuXXz]

I wanted to test something and have a question about the spelling of your link

namespace inbox {
separator = /
prefix =
inbox = yes
}
namespace compat {
separator = .
prefix = INBOX.
inbox = no
hidden = yes
list = no
alias_for =
}

Original dovecot config

namespace inbox {
separator = .
prefix = INBOX.
inbox = yes

mailbox Sent {
auto = subscribe # autocreate and autosubscribe the Sent mailbox
special_use = \Sent
}
mailbox Spam {
auto = create # autocreate Spam, but don't autosubscribe
special_use = \Junk
}
mailbox Drafts {
auto = create
special_use = \Drafts
}
mailbox Trash {
auto = create
special_use = \Trash
}
}

Where do I put the definition for sent, spam, draft etc. in your example?
The bracket { of Inbox encloses the entire configuration

Is this correct?:

namespace inbox {
separator = /
prefix =
inbox = yes

mailbox Sent {
auto = subscribe # autocreate and autosubscribe the Sent mailbox
special_use = \Sent
}
mailbox Spam {
auto = create # autocreate Spam, but don't autosubscribe
special_use = \Junk
}
mailbox Drafts {
auto = create
special_use = \Drafts
}
mailbox Trash {
auto = create
special_use = \Trash
}
}

namespace compat {
separator = .
prefix = INBOX.
inbox = no
hidden = yes
list = no
alias_for =
}

 

[Kaspar]

@FuXXz sorry, I somehow missed you last post. I saw in another topic that you got things working again. However for anyone else who has the same issue and is viewing the topic in the future I still wanted to answer your question.

It's not necessary to re-define the configuration for other folders like sent, spam, draft, ect too. The default configuration for those folders is fine. (But you can if you want to of course). The only necessity is to create a file named 99-cust-namespace.conf (in the conf.d directory) and add the compatibility namespace configuration to it. That's all that's needed to get rid of the INBOX prefix.

namespace inbox {
  separator = /
  prefix =
  inbox = yes
}

namespace compat {
  separator = .
  prefix = INBOX.
  inbox = no
  hidden = yes
  list = no
  alias_for =
}

 

[PieKnu]

Hey there!

Has anyone found a solution to disable these reports, or perhaps have them sent as attachments instead of plain text in the body?

I've noticed that recently, emails marked as spam not only end up in the spam folder but also come with a report directly attached in the body, along with a large table containing all calculation scores/values.

Spam detection software, running on the system "xxxxxxxxx",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
the administrator of that system for details.

Content preview:
Content analysis details: (5.4 points, 4.0 required)

The SpamAssassin config file clearly states not to be modified and also outcomments "# report_safe 1", so this shouldn't be the problem.

 

[Change Maker]

Been looking at this topic as I'm getting these reports as well and wondered what I needed to do.
I may be that I just need to add the report as per: Issue - I get spam report mail instead of moving to the spam folder

Content analysis details: (10.1 points, 5.2 required)

Here's what I've got? I've found file in the /etc/spamassassin/local.cf and I don't see "report_safe".
If that's what it is, then should I copy something into that File. If so, can you clarify what the edit should be?
Thanks

pts rule name description
---- ---------------------- --------------------------------------------------
0.0 URIBL_DBL_BLOCKED_OPENDNS ADMINISTRATOR NOTICE: The query to
dbl.spamhaus.org was blocked due to usage
of an open resolver. See
https://www.spamhaus.org/returnc/pub/
[URIs: gardensworld.online]
0.0 RCVD_IN_ZEN_BLOCKED_OPENDNS RBL: ADMINISTRATOR NOTICE: The query
to zen.spamhaus.org was blocked due to
usage of an open resolver. See
https://www.spamhaus.org/returnc/pub/
[46.175.150.67 listed in zen.spamhaus.org]
0.0 URIBL_ZEN_BLOCKED_OPENDNS ADMINISTRATOR NOTICE: The query to
zen.spamhaus.org was blocked due to usage
of an open resolver. See
https://www.spamhaus.org/returnc/pub/
[URIs: gardensworld.online]
2.0 PDS_OTHER_BAD_TLD Untrustworthy TLDs
[URI: gardensworld.online (online)]
-0.0 SPF_PASS SPF: sender matches SPF record
0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily
valid
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from
author's domain
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was
blocked. See
http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
for more information.
[URIs: gardensworld.online]
1.5 FROM_FMBLA_NEWDOM From domain was registered in last 7 days
0.5 FROM_SUSPICIOUS_NTLD From abused NTLD
1.5 FROM_SUSPICIOUS_NTLD_FP From abused NTLD
2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
2.0 PDS_TONAME_EQ_TOLOCAL_FREEM_FORGE Forged replyto and
__PDS_TONAME_EQ_TOLOCAL
0.3 FROM_NTLD_REPLY_FREEMAIL From abused NTLD and Reply-To is
FREEMAIL

 

[Change Maker]

Can I bump my question?