Resolved Whitelist email address ends up in spam folder

[Heppi75]

I have an entry on my plesk whitelist spam configuration like *@mywhitelistdomain.com. Here are headers from a current mail that ends up in the spam folder, but shouldn't not be there. What is going wrong?

X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on myhost
X-Spam-Level:
X-Spam-Status: No, score=-99.1 required=4.5 tests=BAYES_50,DKIMWL_WL_MED,
DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,
HTML_MESSAGE,RCVD_IN_DNSWL_NONE,SPF_HELO_NONE,SPF_PASS,
T_SCC_BODY_TEXT_LINE,USER_IN_WELCOMELIST,USER_IN_WHITELIST
autolearn=no autolearn_force=no version=3.4.4
From: XY <[email protected]>

mywhitelistdomain.com => placeholder for the real domain name ...

So the score is set correct to -99.1 because of the whitelisting I think? Why is this still in the junk folder?

 

[Kaspar]

Just so I understand the issue better, which Junk or Spam folder it you're talking about? The spam folder in an email client (like apple mail or Outlook)? Or the spam folder in webmail?

 

[Heppi75]

Of course the folder in webmail (on the server).

 

[Heppi75]

Here is an additional detail I found in the logs. Mails from the whitelisted domain in my example are processed by dovecot sieve and are moved to spam:

sieve: msgid=<msgid.outlook.com>: fileinto action: stored mail into mailbox 'INBOX.Spam'

But I don't have a sieve rule, which could be responsible for this? Could I debug which rule fired for this behaviour?

 

[Talistech]

Do you have the whitelisted entry written with an asterisk prefix? Plesk Email Security states:

One email address per line. Do NOT use ? or * as wildcard characters. Use "@domain.tld" for filtering the whole domain, for a complete TLD use "@.tld" (without quotation marks)!

 

[Kaspar]

Do you have the whitelisted entry written with an asterisk prefix? Plesk Email Security states:

The whitelisting is successful as the USER_IN_WHITELIST rule name is added to the header (and the spam score is negative).

Strange that the email message is still moved to the spam folder.

Here is an additional detail I found in the logs. Mails from the whitelisted domain in my example are processed by dovecot sieve and are moved to spam:

sieve: msgid=<msgid.outlook.com>: fileinto action: stored mail into mailbox 'INBOX.Spam'

But I don't have a sieve rule, which could be responsible for this? Could I debug which rule fired for this behaviour?

Check if there are any Sieve rules present containing the fileinto methode in any of the .sieve files in the
/var/qmail/mailnames/<domain>/<mailbox>/sieve/ and /etc/dovecot/conf.d/ directories.

Run grep fileinto /var/qmail/mailnames/example.com/info/sieve/* command for example to find any files that contain the fileinto methode.

 

[Heppi75]

It was a sieve problem. I traced the logs of the sieve rules with "sieve_trace_level". That shows in detail what is going on ... - Thank you all for you help.