Forwarded to devs Spamassassin ignores mails to mailboxes that contain an ampersand, e.g. d&[email protected]

[Bitpalast]

Username:

TITLE

Spamassassin ignores mails to mailboxes that contain an ampersand, e.g. d&[email protected]

PRODUCT, VERSION, OPERATING SYSTEM, ARCHITECTURE

Alma 8.10
Plesk 18.0.65 #2

PROBLEM DESCRIPTION

A mailbox with an ampersand in its name (e.g. d&[email protected]) is ignored by Spamassassin.

STEPS TO REPRODUCE

1) Create a mailbox d&[email protected].
2) Turn on spam filtering.
3) Send a mail to that mailbox.
4) Check the log entries for the incoming mail.

ACTUAL RESULT

No treatment by Spamassassin:

Jan 13 08:23:59 <hostname> postfix/smtpd[3629549]: CA2F427C15DD: client=tmo-087-104.customers.somesender.tld[123.123.123.123], sasl_method=CRAM-MD5, sasl_username=[email protected]
Jan 13 08:23:59 <hostname> psa-pc-remote[4043873]: CA2F427C15DD: from=<[email protected]> to=<d&[email protected]>
Jan 13 08:24:00 <hostname> postfix/cleanup[3626832]: CA2F427C15DD: message-id=<[email protected]>
Jan 13 08:24:00 <hostname> psa-pc-remote[4043873]: CA2F427C15DD: py-limit-out: stderr: INFO:__main__:Setting 'X-PPP-Vhost' header to 'domain.tld'
Jan 13 08:24:00 <hostname> psa-pc-remote[4043873]: CA2F427C15DD: py-limit-out: stderr: PASS
Jan 13 08:24:00 <hostname> psa-pc-remote[4043873]: CA2F427C15DD: check-quota: stderr: SKIP
Jan 13 08:24:00 <hostname> psa-pc-remote[4043873]: CA2F427C15DD: spf: stderr: PASS
Jan 13 08:24:00 <hostname> postfix/qmgr[1127742]: CA2F427C15DD: from=<[email protected]>, size=647, nrcpt=1 (queue active)
Jan 13 08:24:00 <hostname> postfix-local[3629558]: CA2F427C15DD: from=<[email protected]>, to=<d&[email protected]>, dirname=/var/qmail/mailnames
Jan 13 08:24:00 <hostname> dk_check[3629559]: CA2F427C15DD: DKIM Feed: No signature
Jan 13 08:24:00 <hostname> postfix-local[3629558]: CA2F427C15DD: dk_check: stderr: PASS
Jan 13 08:24:00 <hostname> postfix-local[3629558]: CA2F427C15DD: dmarc: stderr: PASS
Jan 13 08:24:00 <hostname> postfix-local[3629558]: CA2F427C15DD: spam: stderr: PASS
Jan 13 08:24:00 <hostname> postfix-local[3629558]: CA2F427C15DD: send message: id=S3629558 from=<[email protected]> to=<d&[email protected]>
Jan 13 08:24:00 <hostname> postfix/pipe[3627257]: CA2F427C15DD: to=<d&[email protected]>, relay=plesk_virtual, delay=1.2, delays=0.51/0/0/0.68, dsn=2.0.0, status=sent (delivered via plesk_virtual service)
Jan 13 08:24:00 <hostname> postfix/qmgr[1127742]: CA2F427C15DD: removed

EXPECTED RESULT

Treated by Spamassassin:

Jan 13 08:23:59 <hostname> postfix/smtpd[3629549]: CA2F427C15DD: client=tmo-087-104.customers.somesender.tld[123.123.123.123], sasl_method=CRAM-MD5, sasl_username=[email protected]
Jan 13 08:23:59 <hostname> psa-pc-remote[4043873]: CA2F427C15DD: from=<[email protected]> to=<d&[email protected]>
Jan 13 08:24:00 <hostname> postfix/cleanup[3626832]: CA2F427C15DD: message-id=<[email protected]>
Jan 13 08:24:00 <hostname> psa-pc-remote[4043873]: CA2F427C15DD: py-limit-out: stderr: INFO:__main__:Setting 'X-PPP-Vhost' header to 'domain.tld'
Jan 13 08:24:00 <hostname> psa-pc-remote[4043873]: CA2F427C15DD: py-limit-out: stderr: PASS
Jan 13 08:24:00 <hostname> psa-pc-remote[4043873]: CA2F427C15DD: check-quota: stderr: SKIP
Jan 13 08:24:00 <hostname> psa-pc-remote[4043873]: CA2F427C15DD: spf: stderr: PASS
Jan 13 08:24:00 <hostname> postfix/qmgr[1127742]: CA2F427C15DD: from=<[email protected]>, size=647, nrcpt=1 (queue active)
Jan 13 08:24:00 <hostname> postfix-local[3629558]: CA2F427C15DD: from=<[email protected]>, to=<d&[email protected]>, dirname=/var/qmail/mailnames
Jan 13 08:24:00 <hostname> dk_check[3629559]: CA2F427C15DD: DKIM Feed: No signature
Jan 13 08:24:00 <hostname> postfix-local[3629558]: CA2F427C15DD: dk_check: stderr: PASS
Jan 13 08:24:00 <hostname> postfix-local[3629558]: CA2F427C15DD: dmarc: stderr: PASS
Jan 13 08:24:00 <hostname> spamd[3640296]: spamd: processing message <[email protected]> for d&[email protected]:30
Jan 13 08:24:00 <hostname> spamd[3640296]: spamd: clean message (-3.8/7.0) for d&[email protected]:30 in 0.4 seconds, 70920 bytes.
Jan 13 08:24:00 <hostname> spamd[3640296]: spamd: result: . -3 - BAYES_00,DKIMWL_WL_MED,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HTML_IMAGE_RATIO_02,HTML_MESSAGE,RCVD_IN_DNSWL_BLOCKED,RCVD_IN_MSPIKE_H2,RCVD_IN_VALIDITY_CERTIFIED_BLOCKED,RCVD_IN_VALIDITY_RPBL_BLOCKED,SPF_HELO_PASS,SPF_PASS,URIBL_BLOCKED scantime=0.4,size=70920,user=xxxxxxxxxx,uid=30,required_score=7.0,rhost=127.0.0.1,raddr=127.0.0.1,rport=48800,mid=<[email protected]>,bayes=0.000000,autolearn=ham autolearn_force=no
Jan 13 08:24:00 <hostname> postfix-local[3629558]: CA2F427C15DD: spam: stderr: PASS
Jan 13 08:24:00 <hostname> postfix-local[3629558]: CA2F427C15DD: send message: id=S3629558 from=<[email protected]> to=<d&[email protected]>
Jan 13 08:24:00 <hostname> postfix/pipe[3627257]: CA2F427C15DD: to=<d&[email protected]>, relay=plesk_virtual, delay=1.2, delays=0.51/0/0/0.68, dsn=2.0.0, status=sent (delivered via plesk_virtual service)
Jan 13 08:24:00 <hostname> postfix/qmgr[1127742]: CA2F427C15DD: removed

ANY ADDITIONAL INFORMATION

I first suspected that the mailbox might be stored in a transcribed name, but in /var/qmail/mailnames/recipientdomain.tld it can be found as
drwx------. 5 popuser popuser 4096 Apr 29 2022 'd&s'
Maybe Spamassassin cannot handle the name?

YOUR EXPECTATIONS FROM PLESK SERVICE TEAM

Help with sorting out

 

[Sebahat.hadzhi]

Thank you for the report. I forwarded it to our team for further review. I will keep you posted.

 

[Sebahat.hadzhi]

Our engineers were unable to reproduce the issue on a test environment. Could you please double-check if spam filtering is enabled for the mail account in question?

 

[Bitpalast]

Thank you for checking. This got me thinking, and I found that indeed, mails are processed by SpamAssassin, I just didn't see it, because on that one server this occurs on, we are using Courier instead of Dovecot. Log entries look slightly different. In the mass of entries I was not aware that the routing between SpamAssassin and Courier looks slightly different, too.

 

[Bitpalast]

@Sebahat.hadzhi Please review Issue - SpamAssassin blacklists have no effect on incoming mail
Maybe the engineers ran into the same deception that they thought everything is o.k.?
I have the problem that black list entries are ignored for user, while the prefs are stored and are correctly stored, and the file name mentioned in the log that Spamassassin reads for the settings is correct, too, yet it seems to apply settings from the general server settings when calculating the score and making a decision whether a mail is spam or not. Hence it seems to ignore the "local" settings of the mailbox, although it logs that it reads these settings. Will this need a ticket? I don't have a support subscription on the affected machine, would need to switch subscriptions from another to that one and would like to save that effort.

 

[Sebahat.hadzhi]

Thank you for the additional details. Let me forward that information to our team first. If ticket is needed I will let you know.

 

[Kaspar]

I am able to replicate this issue, using both Dovecot and Courier. Whenever there is an mailbox with an ampersand in it's local part (d&[email protected]) the local SpamAssassin configuration (those in the user_prefs file) are ignored. While for other mailboxes without an ampersand everything works as expected.

Another thing I noticed is that any email address with an ampersand doesn't get properly rendered/escaped in Plesk. But the 3rd line engineers probably noticed this already.

 

[Sebahat.hadzhi]

Thank you both for the report. Our engineers performed additional tests, but they were unable to reproduce the issue. The local spam filter tag was changed to a custom value in order to confirm which filter is applied and it appears that the local filter was applied:

Jan 22 12:40:38 10-69-45-128 spamd[31808]: spamd: identified spam (101.3/7.0) for admin&[email protected]:30 in 0.1 seconds, 2435 bytes.

If possible, could one of you open a ticket so they review the case directly on the server.

 

[Kaspar]

I've submitted a ticket for further investigation

 

[Bitpalast]

Plesk engineers have confirmed the issue, but it only surfaces on Alma 8. It's now registered as a bug PPPM-14793.