Skip to main content

Why are messages moved to the spam/junk folder (receiving locally, not sent to an external server)?

Jason Brown
  • Updated

Question

I noticed that specific emails from particular senders are in the spam/junk folder. What is the cause of this?

 

Answer

There are a few potential causes for messages being in the spam/junk folder.

 

1. SpamAssassin™

 

Apache SpamAssassin's integration with Exim is the most common reason for mail to be in the spam/junk folder. This requires that the user-configurable "Spam Box" setting be enabled in the WHM Tweak Settings and in the cPanel > Spam Filters interface, as well as having the SpamAssassin service running. Messages that are caught by SpamAssassin are easy to notice. These are the things to look for:

 

  • The subject is changed. By default, SpamAssassin is configured to prefix the email's subject with ***SPAM*** if the message scanned is over the threshold for spam
  • The email headers will have "X-Spam-Status: Yes, score=#.# (Please see How to Find Email Headers)
  • The exim log "/var/log/exim_mainlog" will contain the message, "SpamAssassin as user detected message as spam (5.5)" with a varying number dependent on the sum of the scores in the email headers

If a message is triggering Apache SpamAssassin that you believe should not be, this can be solved in two ways.

  • The sender resolves the issues that Apache SpamAssassin finds with the message in the email headers

Or

  • Set custom "Calculated Spam Score Settings" that decrease the score the messages receive. This can be done in cPanel > Spam Filters > Show Additional Configurations > Configure Calculated Spam Score Settings.

 

2. User Configured Filters

 

The email user might have a filter that is being triggered placing the message in Spam. It's best to review the Email Filters as the user and paste the email headers in the Filter Test available in the Webmail > Email Filters interface

 

3. Email Clients

 

If SpamAssassin nor user or system configured filters are moving the messages, the most likely culprit is an email client or Antivirus software installed on a computer that is downloading the messages.

 

An easy way to confirm is to change the email account's password in Webmail and then have the sender send the email again.

 

If the message is still in the inbox and did not move, you know that the client is responsible. You can then update the password on the client side and work towards modifying or disabling the computer's filter that is causing the issue.

 

Alternatively, if you are averse to changing the receiving mail account's password, you can temporarily enable the Dovecot mail-log plugin to confirm that the client is making the change.

Related articles