• Our team is looking to connect with folks who use email services provided by Plesk, or a premium service. If you'd like to be part of the discovery process and share your experiences, we invite you to complete this short screening survey. If your responses match the persona we are looking for, you'll receive a link to schedule a call at your convenience. We look forward to hearing from you!
  • We are looking for U.S.-based freelancer or agency working with SEO or WordPress for a quick 30-min interviews to gather feedback on XOVI, a successful German SEO tool we’re looking to launch in the U.S.
    If you qualify and participate, you’ll receive a $30 Amazon gift card as a thank-you. Please apply here. Thanks for helping shape a better SEO product for agencies!
  • The Horde webmail has been deprecated. Its complete removal is scheduled for April 2025. For details and recommended actions, see the Feature and Deprecation Plan.

Issue Same domain sender put into SPAM folder

E

easyware

Basic Pleskian
Server operating system version
CentOS Linux 7.9.2009 (Core)
Plesk version and microupdate number
Plesk Obsidian v18.0.45_build1800220722.09 os_CentOS 7
I have this issue I am trying to figure out from weeks now.
I have this customer's thedomain.com, I have info@thedomain.com and production@thedomain.com.
Every mail I send from info@thedomain.com to production@thedomain.com is instantly delivered into SPAM folder.

Here is the header of the message I receive in the SPAM folder (info@thedomain.com is in SpamAssassin white list)

Code: 
X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on
    theserver.host
X-Spam-Level:
X-Spam-Status: No, score=-100.5 required=7.0 tests=ALL_TRUSTED,SPF_PASS,
    SUBJ_ALL_CAPS,USER_IN_WELCOMELIST,USER_IN_WHITELIST autolearn=no
    autolearn_force=no version=3.4.0
X-Original-To: production@thedomain.com
Delivered-To: production@thedomain.com
Received: from webmail.thedomain.com (theserver.host [IPv6:::1])
    by theserve.host (Postfix) with ESMTPSA id 8D8583766D2
    for <production@thedomain.com>; Wed,  3 Aug 2022 18:47:45 +0200 (CEST)
Authentication-Results: theserver.host;
        spf=pass (sender IP is ::1) smtp.mailfrom=info@thedomain.com smtp.helo=webmail.thedomain.com
Received-SPF: pass (theserver.host: connection is authenticated)

I thought there could be a client with evil filters enabled so I changed the passwords and tried only with RoundCube client, no luck.
RoundCube has no filters.

Sending a message from any other active *@thedomain.com mail is OK, just from production@thedomain.com causes the issue.
Sending a message from production@thedomain.com to info@thedomain.com is OK.

I honestly do not know where to check.
 
From the looks of it, it's not spam SpamAssassin that's moving your messages to the Spam folder.
  • Are you using an email client like Outlook, Thunderbird or Apple mail? If so, perhaps the email clients filters the messages and moves to the spam folder?
  • Do you use any Roundcube plugins that (some how filter) messages?
Otherwise look trough the Sieve filter files at /var/qmail/mailnames/example.com/info/sieve and at /etc/dovecot/conf.d/ to see if they contain any code that may move you messages.
 
Last edited:
Kaspar said:
From the looks of it, it's not spam SpamAssassin that's moving your messages to the Spam folder.
  • Are you using an email client like Outlook, Thunderbird or Apple mail? If so, perhaps the email clients filters the messages and moves to the spam folder?
  • Do you use any Roundcube plugins that (some how filter) messages?
Otherwise look trough the Sieve filter files at /var/qmail/mailnames/example.com/info/sieve and at /etc/dovecot/conf.d/custom-sieve/ to see if they contain any code that may move you messages.
Click to expand...
Thank you for your insights, I have excluded any client related filter by changing the mailboxes password, after setting new passwords the issue remains.

In /var/qmail/mailnames/example.com/info/sieve I have an empty "roundcube.sieve" file and an empty "tmp" folder.
In /etc/dovecot/conf.d/ I do not have any folder called "custom-sieve", just "14-plesk-sni-mail.thedomain.com.conf" files but looking at them it seems to be they are encryption related.

I did not know that RoundCube could have plugins, I really don't think that any of my customers would be able to configure one, but to be sure, where do I check for active plugins?

Where else should I check?
 
Seems like a tough cookie to crack. No custom or additional Roundcube plugins installed either? One last thing I can think of would be to enable debug logging for Dovecot, maybe that will give you some clues on whats causes the messages to move to your spam folder.

If that doesn't help consider opening a ticket with Plesk support. They are awesome and I am sure they can figure out whats going on.
 
Kaspar said:
Seems like a tough cookie to crack. No custom or additional Roundcube plugins installed either? One last thing I can think of would be to enable debug logging for Dovecot, maybe that will give you some clues on whats causes the messages to move to your spam folder.

If that doesn't help consider opening a ticket with Plesk support. They are awesome and I am sure they can figure out whats going on.
Click to expand...

Thank you again for your help, I managed to isolate relevant lines in the debug.

Code: 
Aug  4 11:35:24 vps1 dovecot: service=lda, user=production@thedomain.com, ip=[]. Debug: sieve: multi-script: Start execute sequence
Aug  4 11:35:24 vps1 dovecot: service=lda, user=production@thedomain.com, ip=[]. Debug: sieve: Opening script 1 of 1 from `/var/qmail/mailnames/thedomain.com/production/.dovecot.sieve'
Aug  4 11:35:24 vps1 dovecot: service=lda, user=production@thedomain.com, ip=[]. Debug: sieve: Loading script /var/qmail/mailnames/thedomain.com/production/.dovecot.sieve
Aug  4 11:35:24 vps1 dovecot: service=lda, user=production@thedomain.com, ip=[]. Debug: sieve: Script binary /var/qmail/mailnames/thedomain.com/production/.dovecot.svbin successfully loaded
Aug  4 11:35:24 vps1 dovecot: service=lda, user=production@thedomain.com, ip=[]. Debug: sieve: binary /var/qmail/mailnames/thedomain.com/production/.dovecot.svbin: save: not saving binary, because it is already stored
Aug  4 11:35:24 vps1 dovecot: service=lda, user=production@thedomain.com, ip=[]. Debug: sieve: Executing script from `/var/qmail/mailnames/thedomain.com/production/.dovecot.svbin'
Aug  4 11:35:24 vps1 dovecot: service=lda, user=production@thedomain.com, ip=[]. Debug: sieve: multi-script: Run script `/var/qmail/mailnames/thedomain.com/production/.dovecot.svbin'
Aug  4 11:35:24 vps1 dovecot: service=lda, user=production@thedomain.com, ip=[]. Debug: sieve: Started running script `/var/qmail/mailnames/thedomain.com/production/.dovecot.svbin'
Aug  4 11:35:24 vps1 dovecot: service=lda, user=production@thedomain.com, ip=[]. Debug: sieve: Finished running script `/var/qmail/mailnames/thedomain.com/production/.dovecot.svbin' (status=ok, resource usage: no usage recorded)
Aug  4 11:35:24 vps1 dovecot: service=lda, user=production@thedomain.com, ip=[]. Debug: sieve: multi-script: Execute result
Aug  4 11:35:24 vps1 dovecot: service=lda, user=production@thedomain.com, ip=[]. Debug: sieve: msgid=<95f375d05f6477a2cfdb829d576d316f@thedomain.com>: Executing result (status=ok, commit=no)
Aug  4 11:35:24 vps1 dovecot: service=lda, user=production@thedomain.com, ip=[]. Debug: sieve: msgid=<95f375d05f6477a2cfdb829d576d316f@thedomain.com>: Starting execution of actions
Aug  4 11:35:24 vps1 dovecot: service=lda, user=production@thedomain.com, ip=[]. Debug: sieve: msgid=<95f375d05f6477a2cfdb829d576d316f@thedomain.com>: Executing actions
Aug  4 11:35:24 vps1 dovecot: service=lda, user=production@thedomain.com, ip=[]. Debug: sieve: msgid=<95f375d05f6477a2cfdb829d576d316f@thedomain.com>: Finished executing actions (status=ok, keep=implicit, executed=no)
Aug  4 11:35:24 vps1 dovecot: service=lda, user=production@thedomain.com, ip=[]. Debug: sieve: msgid=<95f375d05f6477a2cfdb829d576d316f@thedomain.com>: Finished executing result (no commit, status=ok, keep=yes)
Aug  4 11:35:24 vps1 dovecot: service=lda, user=production@thedomain.com, ip=[]. Debug: sieve: multi-script: Sequence active
Aug  4 11:35:24 vps1 dovecot: service=lda, user=production@thedomain.com, ip=[]. Debug: sieve: multi-script: Finishing sequence (status=ok)
Aug  4 11:35:24 vps1 dovecot: service=lda, user=production@thedomain.com, ip=[]. Debug: sieve: msgid=<95f375d05f6477a2cfdb829d576d316f@thedomain.com>: Executing result (status=ok, commit=yes)
Aug  4 11:35:24 vps1 dovecot: service=lda, user=production@thedomain.com, ip=[]. Debug: sieve: msgid=<95f375d05f6477a2cfdb829d576d316f@thedomain.com>: Starting execution of actions
Aug  4 11:35:24 vps1 dovecot: service=lda, user=production@thedomain.com, ip=[]. Debug: sieve: msgid=<95f375d05f6477a2cfdb829d576d316f@thedomain.com>: Executing actions
Aug  4 11:35:24 vps1 dovecot: service=lda, user=production@thedomain.com, ip=[]. Debug: sieve: msgid=<95f375d05f6477a2cfdb829d576d316f@thedomain.com>: Finished executing actions (status=ok, keep=implicit, executed=no)
Aug  4 11:35:24 vps1 dovecot: service=lda, user=production@thedomain.com, ip=[]. Debug: sieve: msgid=<95f375d05f6477a2cfdb829d576d316f@thedomain.com>: Execute implicit keep (status=ok)
Aug  4 11:35:24 vps1 dovecot: service=lda, user=production@thedomain.com, ip=[]. Debug: sieve: msgid=<95f375d05f6477a2cfdb829d576d316f@thedomain.com>: Start storing into mailbox INBOX
Aug  4 11:35:24 vps1 dovecot: service=lda, user=production@thedomain.com, ip=[]. Debug: sieve: msgid=<95f375d05f6477a2cfdb829d576d316f@thedomain.com>: Executing implicit keep action
Aug  4 11:35:24 vps1 dovecot: service=lda, user=production@thedomain.com, ip=[]. Debug: sieve: msgid=<95f375d05f6477a2cfdb829d576d316f@thedomain.com>: Execute storing into mailbox 'INBOX'
Aug  4 11:35:24 vps1 dovecot: service=lda, user=production@thedomain.com, ip=[]. Debug: Mailbox INBOX: Mailbox opened
Aug  4 11:35:24 vps1 dovecot: service=lda, user=production@thedomain.com, ip=[]. Debug: Quota root User quota: Recalculated relative rules with bytes=1073741818 count=0. Now grace=0
Aug  4 11:35:24 vps1 dovecot: service=lda, user=production@thedomain.com, ip=[]. Debug: sieve: msgid=<95f375d05f6477a2cfdb829d576d316f@thedomain.com>: Saving to mailbox 'INBOX' successful so far
Aug  4 11:35:24 vps1 dovecot: service=lda, user=production@thedomain.com, ip=[]. Debug: sieve: msgid=<95f375d05f6477a2cfdb829d576d316f@thedomain.com>: Finished executing implicit keep action (status=ok)
Aug  4 11:35:24 vps1 dovecot: service=lda, user=production@thedomain.com, ip=[]. Debug: sieve: msgid=<95f375d05f6477a2cfdb829d576d316f@thedomain.com>: Finalizing actions
Aug  4 11:35:24 vps1 dovecot: service=lda, user=production@thedomain.com, ip=[]. Debug: sieve: msgid=<95f375d05f6477a2cfdb829d576d316f@thedomain.com>: Finished finalizing actions (status=ok, keep=implicit, committed=no)
Aug  4 11:35:24 vps1 dovecot: service=lda, user=production@thedomain.com, ip=[]. Debug: sieve: msgid=<95f375d05f6477a2cfdb829d576d316f@thedomain.com>: Finalize implicit keep (status=ok)
Aug  4 11:35:24 vps1 dovecot: service=lda, user=production@thedomain.com, ip=[]. Debug: sieve: msgid=<95f375d05f6477a2cfdb829d576d316f@thedomain.com>: Finalize implicit keep action(status=ok, action_status=ok, commit_status=ok)
Aug  4 11:35:24 vps1 dovecot: service=lda, user=production@thedomain.com, ip=[]. Debug: sieve: msgid=<95f375d05f6477a2cfdb829d576d316f@thedomain.com>: Commit implicit keep action
Aug  4 11:35:24 vps1 dovecot: service=lda, user=production@thedomain.com, ip=[]. Debug: sieve: msgid=<95f375d05f6477a2cfdb829d576d316f@thedomain.com>: Commit storing into mailbox 'INBOX'
Aug  4 11:35:24 vps1 dovecot: service=lda, user=production@thedomain.com, ip=[]. sieve: msgid=<95f375d05f6477a2cfdb829d576d316f@thedomain.com>: stored mail into mailbox 'INBOX'
Aug  4 11:35:24 vps1 dovecot: service=lda, user=production@thedomain.com, ip=[]. Debug: sieve: msgid=<95f375d05f6477a2cfdb829d576d316f@thedomain.com>: Finish implicit keep action
Aug  4 11:35:24 vps1 dovecot: service=lda, user=production@thedomain.com, ip=[]. Debug: sieve: msgid=<95f375d05f6477a2cfdb829d576d316f@thedomain.com>: Finishing actions
Aug  4 11:35:24 vps1 dovecot: service=lda, user=production@thedomain.com, ip=[]. Debug: sieve: msgid=<95f375d05f6477a2cfdb829d576d316f@thedomain.com>: Finished executing result (final, status=ok, keep=yes)
Aug  4 11:35:24 vps1 dovecot: service=lda, user=production@thedomain.com, ip=[]. Debug: sieve: multi-script: Sequence finished (status=ok, keep=yes)
Aug  4 11:35:24 vps1 dovecot: service=lda, user=production@thedomain.com, ip=[]. Debug: sieve: multi-script: Destroy
Aug  4 11:35:24 vps1 dovecot: service=lda, user=production@thedomain.com, ip=[]. Debug: duplicate db: Cleanup

From here I can tell that the message is successfully stored into INBOX (am I right?)
After this I cannot see anything related to the production@ mailbox, should I see something like "Moving into mailbox SPAM"?
 
UPDATE: I found these lines too

Code: 
Aug  4 11:52:08 vps1 dovecot: service=imap, user=production@thedomain.com, ip=[185.30.177.70]. Debug: Mailbox INBOX: Mailbox opened
Aug  4 11:52:08 vps1 dovecot: service=imap, user=production@thedomain.com, ip=[185.30.177.70]. Debug: Mailbox INBOX: UID 23859: Opened mail because: prefetch
Aug  4 11:52:08 vps1 dovecot: service=imap, user=production@thedomain.com, ip=[185.30.177.70]. Debug: Mailbox INBOX.Spam: Mailbox opened
Aug  4 11:52:08 vps1 dovecot: service=imap, user=production@thedomain.com, ip=[185.30.177.70]. Debug: Mailbox INBOX: Mailbox opened
Aug  4 11:52:08 vps1 dovecot: service=imap, user=production@thedomain.com, ip=[185.30.177.70]. Debug: Mailbox INBOX: UID 23859: Expunge requested
Aug  4 11:52:08 vps1 dovecot: service=imap, user=production@thedomain.com, ip=[185.30.177.70]. Debug: Mailbox INBOX: UID 23859: Mail expunged
...
Aug  4 11:52:08 vps1 dovecot: service=imap, user=production@thedomain.com, ip=[185.30.177.70]. Debug: Mailbox INBOX.Spam: Couldn't open mailbox in list index: Maildir new_mtime changed 1659605725 != 1659606728
Aug  4 11:52:08 vps1 dovecot: service=imap, user=production@thedomain.com, ip=[185.30.177.70]. Debug: Mailbox INBOX.Spam: Mailbox opened
Aug  4 11:52:08 vps1 dovecot: service=imap, user=production@thedomain.com, ip=[185.30.177.70]. Debug: Mailbox INBOX.Spam: Mailbox opened
Aug  4 11:52:08 vps1 dovecot: service=imap, user=production@thedomain.com, ip=[185.30.177.70]. Debug: Mailbox INBOX: Mailbox opened
Aug  4 11:52:08 vps1 dovecot: service=imap, user=production@thedomain.com, ip=[185.30.177.70]. Debug: Mailbox INBOX: Mailbox opened
Aug  4 11:52:08 vps1 dovecot: service=imap, user=production@thedomain.com, ip=[185.30.177.70]. Debug: Mailbox INBOX: Mailbox opened
Aug  4 11:52:08 vps1 dovecot: service=imap, user=production@thedomain.com, ip=[185.30.177.70]. Debug: Mailbox INBOX: Mailbox opened
 
You must log in or register to reply here.

Similar threads

E
Question Is multiple HELO registration possible?
Replies
2
Views
533
emrekoc
E
EnriqueR
Question Incoming mail is stored in Junk folder
Replies
6
Views
825
EnriqueR
EnriqueR
mapodec
Resolved Emails sent from Plesk accounts are not delivering only to Google Workspace
Replies
2
Views
587
mapodec
mapodec
D
Issue Spoofed Emails Appearing as Sent from My Own Server Despite Correct SPF/DKIM/DMARC Configuration?
Replies
2
Views
2K
drdna
D
W
Issue Mail forwarded on the server in the target mailbox is delivered to the SPAM folder
Replies
0
Views
429
W4ru
W
Back
Top