• If you are still using CentOS 7.9, it's time to convert to Alma 8 with the free centos2alma tool by Plesk or Plesk Migrator. Please let us know your experiences or concerns in this thread:
    CentOS2Alma discussion

Issue Same domain sender put into SPAM folder

E

easyware

Basic Pleskian
Server operating system version
CentOS Linux 7.9.2009 (Core)
Plesk version and microupdate number
Plesk Obsidian v18.0.45_build1800220722.09 os_CentOS 7
I have this issue I am trying to figure out from weeks now.
I have this customer's thedomain.com, I have [email protected] and [email protected].
Every mail I send from [email protected] to [email protected] is instantly delivered into SPAM folder.

Here is the header of the message I receive in the SPAM folder ([email protected] is in SpamAssassin white list)

Code: 
X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on
    theserver.host
X-Spam-Level:
X-Spam-Status: No, score=-100.5 required=7.0 tests=ALL_TRUSTED,SPF_PASS,
    SUBJ_ALL_CAPS,USER_IN_WELCOMELIST,USER_IN_WHITELIST autolearn=no
    autolearn_force=no version=3.4.0
X-Original-To: [email protected]
Delivered-To: [email protected]
Received: from webmail.thedomain.com (theserver.host [IPv6:::1])
    by theserve.host (Postfix) with ESMTPSA id 8D8583766D2
    for <[email protected]>; Wed,  3 Aug 2022 18:47:45 +0200 (CEST)
Authentication-Results: theserver.host;
        spf=pass (sender IP is ::1) [email protected] smtp.helo=webmail.thedomain.com
Received-SPF: pass (theserver.host: connection is authenticated)

I thought there could be a client with evil filters enabled so I changed the passwords and tried only with RoundCube client, no luck.
RoundCube has no filters.

Sending a message from any other active *@thedomain.com mail is OK, just from [email protected] causes the issue.
Sending a message from [email protected] to [email protected] is OK.

I honestly do not know where to check.
 
From the looks of it, it's not spam SpamAssassin that's moving your messages to the Spam folder.
  • Are you using an email client like Outlook, Thunderbird or Apple mail? If so, perhaps the email clients filters the messages and moves to the spam folder?
  • Do you use any Roundcube plugins that (some how filter) messages?
Otherwise look trough the Sieve filter files at /var/qmail/mailnames/example.com/info/sieve and at /etc/dovecot/conf.d/ to see if they contain any code that may move you messages.
 
Last edited:
Kaspar said:
From the looks of it, it's not spam SpamAssassin that's moving your messages to the Spam folder.
  • Are you using an email client like Outlook, Thunderbird or Apple mail? If so, perhaps the email clients filters the messages and moves to the spam folder?
  • Do you use any Roundcube plugins that (some how filter) messages?
Otherwise look trough the Sieve filter files at /var/qmail/mailnames/example.com/info/sieve and at /etc/dovecot/conf.d/custom-sieve/ to see if they contain any code that may move you messages.
Click to expand...
Thank you for your insights, I have excluded any client related filter by changing the mailboxes password, after setting new passwords the issue remains.

In /var/qmail/mailnames/example.com/info/sieve I have an empty "roundcube.sieve" file and an empty "tmp" folder.
In /etc/dovecot/conf.d/ I do not have any folder called "custom-sieve", just "14-plesk-sni-mail.thedomain.com.conf" files but looking at them it seems to be they are encryption related.

I did not know that RoundCube could have plugins, I really don't think that any of my customers would be able to configure one, but to be sure, where do I check for active plugins?

Where else should I check?
 
Seems like a tough cookie to crack. No custom or additional Roundcube plugins installed either? One last thing I can think of would be to enable debug logging for Dovecot, maybe that will give you some clues on whats causes the messages to move to your spam folder.

If that doesn't help consider opening a ticket with Plesk support. They are awesome and I am sure they can figure out whats going on.
 
Kaspar said:
Seems like a tough cookie to crack. No custom or additional Roundcube plugins installed either? One last thing I can think of would be to enable debug logging for Dovecot, maybe that will give you some clues on whats causes the messages to move to your spam folder.

If that doesn't help consider opening a ticket with Plesk support. They are awesome and I am sure they can figure out whats going on.
Click to expand...

Thank you again for your help, I managed to isolate relevant lines in the debug.

Code: 
Aug  4 11:35:24 vps1 dovecot: service=lda, [email protected], ip=[]. Debug: sieve: multi-script: Start execute sequence
Aug  4 11:35:24 vps1 dovecot: service=lda, [email protected], ip=[]. Debug: sieve: Opening script 1 of 1 from `/var/qmail/mailnames/thedomain.com/production/.dovecot.sieve'
Aug  4 11:35:24 vps1 dovecot: service=lda, [email protected], ip=[]. Debug: sieve: Loading script /var/qmail/mailnames/thedomain.com/production/.dovecot.sieve
Aug  4 11:35:24 vps1 dovecot: service=lda, [email protected], ip=[]. Debug: sieve: Script binary /var/qmail/mailnames/thedomain.com/production/.dovecot.svbin successfully loaded
Aug  4 11:35:24 vps1 dovecot: service=lda, [email protected], ip=[]. Debug: sieve: binary /var/qmail/mailnames/thedomain.com/production/.dovecot.svbin: save: not saving binary, because it is already stored
Aug  4 11:35:24 vps1 dovecot: service=lda, [email protected], ip=[]. Debug: sieve: Executing script from `/var/qmail/mailnames/thedomain.com/production/.dovecot.svbin'
Aug  4 11:35:24 vps1 dovecot: service=lda, [email protected], ip=[]. Debug: sieve: multi-script: Run script `/var/qmail/mailnames/thedomain.com/production/.dovecot.svbin'
Aug  4 11:35:24 vps1 dovecot: service=lda, [email protected], ip=[]. Debug: sieve: Started running script `/var/qmail/mailnames/thedomain.com/production/.dovecot.svbin'
Aug  4 11:35:24 vps1 dovecot: service=lda, [email protected], ip=[]. Debug: sieve: Finished running script `/var/qmail/mailnames/thedomain.com/production/.dovecot.svbin' (status=ok, resource usage: no usage recorded)
Aug  4 11:35:24 vps1 dovecot: service=lda, [email protected], ip=[]. Debug: sieve: multi-script: Execute result
Aug  4 11:35:24 vps1 dovecot: service=lda, [email protected], ip=[]. Debug: sieve: msgid=<[email protected]>: Executing result (status=ok, commit=no)
Aug  4 11:35:24 vps1 dovecot: service=lda, [email protected], ip=[]. Debug: sieve: msgid=<[email protected]>: Starting execution of actions
Aug  4 11:35:24 vps1 dovecot: service=lda, [email protected], ip=[]. Debug: sieve: msgid=<[email protected]>: Executing actions
Aug  4 11:35:24 vps1 dovecot: service=lda, [email protected], ip=[]. Debug: sieve: msgid=<[email protected]>: Finished executing actions (status=ok, keep=implicit, executed=no)
Aug  4 11:35:24 vps1 dovecot: service=lda, [email protected], ip=[]. Debug: sieve: msgid=<[email protected]>: Finished executing result (no commit, status=ok, keep=yes)
Aug  4 11:35:24 vps1 dovecot: service=lda, [email protected], ip=[]. Debug: sieve: multi-script: Sequence active
Aug  4 11:35:24 vps1 dovecot: service=lda, [email protected], ip=[]. Debug: sieve: multi-script: Finishing sequence (status=ok)
Aug  4 11:35:24 vps1 dovecot: service=lda, [email protected], ip=[]. Debug: sieve: msgid=<[email protected]>: Executing result (status=ok, commit=yes)
Aug  4 11:35:24 vps1 dovecot: service=lda, [email protected], ip=[]. Debug: sieve: msgid=<[email protected]>: Starting execution of actions
Aug  4 11:35:24 vps1 dovecot: service=lda, [email protected], ip=[]. Debug: sieve: msgid=<[email protected]>: Executing actions
Aug  4 11:35:24 vps1 dovecot: service=lda, [email protected], ip=[]. Debug: sieve: msgid=<[email protected]>: Finished executing actions (status=ok, keep=implicit, executed=no)
Aug  4 11:35:24 vps1 dovecot: service=lda, [email protected], ip=[]. Debug: sieve: msgid=<[email protected]>: Execute implicit keep (status=ok)
Aug  4 11:35:24 vps1 dovecot: service=lda, [email protected], ip=[]. Debug: sieve: msgid=<[email protected]>: Start storing into mailbox INBOX
Aug  4 11:35:24 vps1 dovecot: service=lda, [email protected], ip=[]. Debug: sieve: msgid=<[email protected]>: Executing implicit keep action
Aug  4 11:35:24 vps1 dovecot: service=lda, [email protected], ip=[]. Debug: sieve: msgid=<[email protected]>: Execute storing into mailbox 'INBOX'
Aug  4 11:35:24 vps1 dovecot: service=lda, [email protected], ip=[]. Debug: Mailbox INBOX: Mailbox opened
Aug  4 11:35:24 vps1 dovecot: service=lda, [email protected], ip=[]. Debug: Quota root User quota: Recalculated relative rules with bytes=1073741818 count=0. Now grace=0
Aug  4 11:35:24 vps1 dovecot: service=lda, [email protected], ip=[]. Debug: sieve: msgid=<[email protected]>: Saving to mailbox 'INBOX' successful so far
Aug  4 11:35:24 vps1 dovecot: service=lda, [email protected], ip=[]. Debug: sieve: msgid=<[email protected]>: Finished executing implicit keep action (status=ok)
Aug  4 11:35:24 vps1 dovecot: service=lda, [email protected], ip=[]. Debug: sieve: msgid=<[email protected]>: Finalizing actions
Aug  4 11:35:24 vps1 dovecot: service=lda, [email protected], ip=[]. Debug: sieve: msgid=<[email protected]>: Finished finalizing actions (status=ok, keep=implicit, committed=no)
Aug  4 11:35:24 vps1 dovecot: service=lda, [email protected], ip=[]. Debug: sieve: msgid=<[email protected]>: Finalize implicit keep (status=ok)
Aug  4 11:35:24 vps1 dovecot: service=lda, [email protected], ip=[]. Debug: sieve: msgid=<[email protected]>: Finalize implicit keep action(status=ok, action_status=ok, commit_status=ok)
Aug  4 11:35:24 vps1 dovecot: service=lda, [email protected], ip=[]. Debug: sieve: msgid=<[email protected]>: Commit implicit keep action
Aug  4 11:35:24 vps1 dovecot: service=lda, [email protected], ip=[]. Debug: sieve: msgid=<[email protected]>: Commit storing into mailbox 'INBOX'
Aug  4 11:35:24 vps1 dovecot: service=lda, [email protected], ip=[]. sieve: msgid=<[email protected]>: stored mail into mailbox 'INBOX'
Aug  4 11:35:24 vps1 dovecot: service=lda, [email protected], ip=[]. Debug: sieve: msgid=<[email protected]>: Finish implicit keep action
Aug  4 11:35:24 vps1 dovecot: service=lda, [email protected], ip=[]. Debug: sieve: msgid=<[email protected]>: Finishing actions
Aug  4 11:35:24 vps1 dovecot: service=lda, [email protected], ip=[]. Debug: sieve: msgid=<[email protected]>: Finished executing result (final, status=ok, keep=yes)
Aug  4 11:35:24 vps1 dovecot: service=lda, [email protected], ip=[]. Debug: sieve: multi-script: Sequence finished (status=ok, keep=yes)
Aug  4 11:35:24 vps1 dovecot: service=lda, [email protected], ip=[]. Debug: sieve: multi-script: Destroy
Aug  4 11:35:24 vps1 dovecot: service=lda, [email protected], ip=[]. Debug: duplicate db: Cleanup

From here I can tell that the message is successfully stored into INBOX (am I right?)
After this I cannot see anything related to the production@ mailbox, should I see something like "Moving into mailbox SPAM"?
 
UPDATE: I found these lines too

Code: 
Aug  4 11:52:08 vps1 dovecot: service=imap, [email protected], ip=[185.30.177.70]. Debug: Mailbox INBOX: Mailbox opened
Aug  4 11:52:08 vps1 dovecot: service=imap, [email protected], ip=[185.30.177.70]. Debug: Mailbox INBOX: UID 23859: Opened mail because: prefetch
Aug  4 11:52:08 vps1 dovecot: service=imap, [email protected], ip=[185.30.177.70]. Debug: Mailbox INBOX.Spam: Mailbox opened
Aug  4 11:52:08 vps1 dovecot: service=imap, [email protected], ip=[185.30.177.70]. Debug: Mailbox INBOX: Mailbox opened
Aug  4 11:52:08 vps1 dovecot: service=imap, [email protected], ip=[185.30.177.70]. Debug: Mailbox INBOX: UID 23859: Expunge requested
Aug  4 11:52:08 vps1 dovecot: service=imap, [email protected], ip=[185.30.177.70]. Debug: Mailbox INBOX: UID 23859: Mail expunged
...
Aug  4 11:52:08 vps1 dovecot: service=imap, [email protected], ip=[185.30.177.70]. Debug: Mailbox INBOX.Spam: Couldn't open mailbox in list index: Maildir new_mtime changed 1659605725 != 1659606728
Aug  4 11:52:08 vps1 dovecot: service=imap, [email protected], ip=[185.30.177.70]. Debug: Mailbox INBOX.Spam: Mailbox opened
Aug  4 11:52:08 vps1 dovecot: service=imap, [email protected], ip=[185.30.177.70]. Debug: Mailbox INBOX.Spam: Mailbox opened
Aug  4 11:52:08 vps1 dovecot: service=imap, [email protected], ip=[185.30.177.70]. Debug: Mailbox INBOX: Mailbox opened
Aug  4 11:52:08 vps1 dovecot: service=imap, [email protected], ip=[185.30.177.70]. Debug: Mailbox INBOX: Mailbox opened
Aug  4 11:52:08 vps1 dovecot: service=imap, [email protected], ip=[185.30.177.70]. Debug: Mailbox INBOX: Mailbox opened
Aug  4 11:52:08 vps1 dovecot: service=imap, [email protected], ip=[185.30.177.70]. Debug: Mailbox INBOX: Mailbox opened
 
You must log in or register to reply here.

Similar threads

W
Question Backup task notification email from PMMCli-Daemon always in Junk folder
Replies
14
Views
2K
Wolfgang Reidlinger
W
A
Resolved Emails getting put in spam folder or blocked
Replies
6
Views
484
Andye
A
K
Issue Message is regarded as spam (but isn't spam) and then the spam report is regarded as spam
Replies
3
Views
876
Kaspar
K
L
Issue Spam-/Mailproblems
Replies
1
Views
418
Peter Debik
P
carlsson
Resolved Outgoing administrator mail not authorized [missing SPF record in sender domain]
Replies
11
Views
984
rkbonatto
rkbonatto
Back
Top