Server isn't spam assassin scanning some emails

floppyfringe

• December 04, 2014 14:00

A number of spam messages are getting through, it seems all of them have the following in the headers: X-Spam-Status: No, score= X-Spam-Score: X-Spam-Bar: X-Ham-Report: X-Spam-Flag: NO We are starting to wonder if our SA on the cPanel servers was down. But now we are thinking SA is not checking emails because SA thinks that it has been checked and found not to be spam already. Is anyone else finding this? Quite a lot of spam is getting through, and we're starting to think the spammer has added the headers to claim the email is spam free and prevent further checking. We've even tried turning spam assassin off for a few days and still the above headers are present (checked exim logs and queue is empty). Someone has to be adding these blank headers. Does anyone know if SA only scans once? Is there a way of forcing our server to scan (or "re-scan") emails? Thanks

• 

  madmanmachines

  • December 04, 2014 21:07

  Hi, I see many users not enable SpamAssassin entirely. Please check WHM > Home "Service Configuration "Service Manager and ensure that "spamd" or "Spam Assassin" is enabled. Additionally some users forget to do the opposite, so ensure it is enabled in the desired cPanel account under "Spam Assassin". If no icon is present in cPanel for Spam Assassin, please check the corresponding feature list for the account at WHM > Home "Packages "Feature Manager. As well, you may wish that all accounts use Spam Assassin, which you may set at WHM > Home "Service Configuration "Exim Configuration Manager > SpamAssassin Options by selecting " Apache SpamAssassin": Forced Global ON". If you have already ensured the above, I would check to see that the spam daemon is actually running. You can check with the following command from SSH:
  ps aux|grep spamd|grep -v spam
  Or you could go ahead and jump the gun and issue a restart of the daemon:
  /scripts/restartsrv_spamd
  Let us know what you find. Thanks,

  0
• 

  floppyfringe

  • December 04, 2014 22:42

  We did globally disable SA and only left a few domains who got the strange "Not Spam No Score" headers. X-Spam-Status: No, score= X-Spam-Score: X-Spam-Bar: X-Ham-Report: X-Spam-Flag: NO It is globally re-enabled now, but we still see the above, and it seems to prevent our servers from scanning email :( Is there anything within EXIM that searches to see if the email has already been checked and the above is enough to prevent the server from doing another SA scan? I wasn't that keen on posting this here in case it is a way that spammers are fooling cPanel from not doing SA scans.

  0
• 

  madmanmachines

  • December 04, 2014 22:59

  Hi,

  ] It is globally re-enabled now, but we still see the above, and it seems to prevent our servers from scanning email :( ... I wasn't that keen on posting this here in case it is a way that spammers are fooling cPanel from not doing SA scans.

  
  Did you run the suggested commands to ensure that the spam daemon is running? You may need to submit a ticket to cPanel directly so they can take a look, which would also keep your data confidential. Thanks,

  0
• 

  cPanelMichael

  • December 05, 2014 13:39

  Hello :) Feel free to open a support ticket using the link in my signature so we can take a closer look. You can post the ticket number here so we can update this thread with the outcome. Thank you.

  0

Please sign in to leave a comment.