Skip to main content

SpamAssassin Subject header prefix

WorkEric
A few months ago WHM/cPanel stopped prefixing ****SPAM**** in the subject for some accounts but not all. I have exhaustively searched within WHM, the documentation, and support forums (even thought there are many posts on the topic) and have not been able to find an answer. I am very familiar with the GUI Exim settings and other options offered but it still doesn't work. However in /var/log/maillog is can see it flagging messages. Any suggestions very welcome! Thanks.

Comments

24 comments

Date Votes
  • cPanelLauren
    Hello, For the accounts that you don't see the ***SPAM** prefix what is set in their SpamAssassin settings for Required Score and AutoDelete?
    0
  • WorkEric
    All accounts are using the system-wide default threshold (5).
    0
  • WorkEric
    When I send the test spam email, this does get the subject changed and the email is moved to the spam folder.
    0
  • cPanelLauren
    Ah ok, that's a bit different. Outbound spam scanning is not enabled by default. This would need to be enabled in WHM>>Service Configuration>>Exim Configuration Manager.
    Scan outgoing messages for spam and reject based on defined Apache SpamAssassin" score (Minimum: 0.1; Maximum: 99.9)
    Do not forward mail to external recipients based on the defined Apache SpamAssassin" score (Minimum: 0.1; Maximum: 99.9)
    0
  • WorkEric
    I have them both on but neither actually do anything. So it's not marking email as spam and it's still forwarding spam. For everything except
    0
  • cPanelLauren
    Can you please open a ticket using the link in my signature? Once open please reply with the Ticket ID here so that we can update this thread with the resolution once the ticket is resolved. Thanks!
    0
  • WorkEric
    Support Ticket ID is: 93469331 I didn't provide root access to cpanel support yet as this server is in production and being used by clients. However I can provide anything needed.
    0
  • WorkEric
    For the first time in many months it has caught a single instance of spam. Just happened over the weekend. However it's not catching anything else. This leads me to believe there is something wrong with the spam filters. Currently researching for clues.
    0
  • cPanelLauren
    Hello, As a note anytime you open a ticket, in order to actually investigate your issue we do need access to the server. I see in this instance that the ticket is awaiting your response.
    0
  • WorkEric
    It's a production server with active clients. I can't have changes made during work hours. We can schedule a brief window for a tech to look or even better I can provide any config or logs requested.
    0
  • cPanelLauren
    We are staffed 24/7 so I'd recommend you set up with the analyst a time to look into the issue to have it best checked into.
    0
  • WorkEric
    Chatting with them now. Thanks! If I have anything interesting I'll put it here.
    0
  • WorkEric
    Client cPanel accounts are failing anti spam MX record checks for reverse DNS. The PTR IP is the WHM server. Since the WHM server is sending the email, what MX record would a cPanel account use to pass a PTR check?
    0
  • cPanelLauren
    They should be able to use their MX records (i.e., domain.com) with the shared IP of the server which has a PTR record that correctly resolves back to the hostname of the server. I'd need more information in order to provide assistance on this.
    0
  • WorkEric
    Current WHM DNS settings: NAME - TYPE - TTL - RDATA @ - A - 43200 - 123.456.789.123 whm - A - 43200 - 123.456.789.123 whm - MX - 3600 - whm.my-hosting-example.net Current cPanel DNS settings: NAME - TYPE - TTL - RDATA mail. - A - 43200 - 123.456.789.123 webmail. - A - 43200 - 123.456.789.123 - MX - 3600 - mail. Issue: In this case the email for the cPanel user will fail the PTR email spam check some vendors use. whm.my-hosting-example.net has the correct PTR. mail. does not. Question: For a shared mail server where DNS is not handled by WHM, shouldn't the cPanel DNS record be the following? NAME - TYPE - TTL - RDATA - MX - 3600 - whm.my-hosting-example.net
    0
  • cPanelLauren
    Does whm.my-hosting-example.net have the same IP as the domain?
    0
  • WorkEric
    Yes
    0
  • cPanelLauren
    What spam checks are you using - if it's just SpamAssassin doing this what are these being flagged with (which matches from SpamAssassin are being met)? This is the same configuration I use on all of my servers/domains as well as the best practice.
    0
  • WorkEric
    0
  • WorkEric
    Because the reverse DNS for the IP is whm.my-hosting-example.net and not . So the receiving email server will flag the customer's email as spam.
    0
  • cPanelLauren
    That is incorrect though, the ptr should always resolve to the hostname of the server, unless the IP of the domain differs from the IP of the A record for the hostname or the SMTP banner differs but the SMTP Banner by default on cPanel servers uses the hostname. This is literally how PTR records work. There has to be something missing here. I've never seen a properly configured server be flagged by sorbs as spam. Where are you getting the information from sorbs on this? I'd be curious to see the exact output from them. Their definition of spam is noted here:
    0
  • WorkEric
    I had an incorrect MX setting for the WHM server which caused "reverse DNS does not match SMTP banner". Fixed this and the PTR issue seems to be resolved as well.
    0
  • cPanelLauren
    Good to know! I was really wracking my brain trying to figure out how in the world they were flagging you. I'm glad you were able to get this resolved.
    0
  • WorkEric
    Thanks for your help!
    0

Please sign in to leave a comment.

Didn't find what you were looking for?

New post