SpamAssassin disabled, but going to Junk

Hi. A customer have SpamAssassin disabled, and they use Google Alerts to get notifications. However, emails are going to Junk mails folder. I don't understand why. Could you help me?

Envelope-to: user@domain.com
Delivery-date: Mon, 07 Aug 2017 09:54:32 -0300
MIME-Version: 1.0
Date: Mon, 07 Aug 2017 05:46:43 -0700
Message-ID: 
Subject: Alerta de Google: strings
From: Google Alerts 
To: user@domain.com
Content-Type: multipart/alternative; boundary="f403045eec2e2ba80f0556293d6a"

--f403045eec2e2ba80f0556293d6a
Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes
Content-Transfer-Encoding: base64

PT09IE5vdGljaWFzIC0gMSByZXN1bHRhZG8gbnVldm8gcGFyYSBbQWxiYSArIHBpbnR1cmFzXSA9
PT0NCg0KRXhwb3NpY2nDs24gZW4gY2FwaXRhbCBtZXhpY2FuYSByZWNvZ2UgMTAzIHJlcHJvZHVj


# exigrep "1dehYG-0004xE-AN" /var/log/exim_rejectlog
# exigrep "1dehYG-0004xE-AN" /var/log/exim_mainlog  
2017-08-07 09:54:32 [19287] cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1dehYG-0004xE-AN
2017-08-07 09:54:32 [19048] 1dehYG-0004xE-AN DKIM: d=google.com s=20161025 c=relaxed/relaxed a=rsa-sha256 b=2048 [verification succeeded]
2017-08-07 09:54:32 [19048] 1dehYG-0004xE-AN malware acl condition: clamd /var/clamd : unable to connect to UNIX socket (/var/clamd): No such file or directory
2017-08-07 09:54:32 [19048] 1dehYG-0004xE-AN H=mail-vk0-f69.google.com [209.85.213.69]:34398 I=[my.ip.address.123]:25 Warning: Message has been scanned: no virus or other harmful content was found
2017-08-07 09:54:32 [19048] 1dehYG-0004xE-AN <= 3M2GIWRQKAOgQYYQVOKVObdc-XYbOZViQYYQVO.MYW@alerts.bounces.google.com H=mail-vk0-f69.google.com [209.85.213.69]:34398 I=[my.ip.address.123]:25 P=esmtps X=TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128 CV=no SNI="domain.com" S=11950 M8S=0 id=f403045eec2e2ba8350556293d6d@google.com T="Alerta de Google: strings" from <3M2GIWRQKAOgQYYQVOKVObdc-XYbOZViQYYQVO.MYW@alerts.bounces.google.com> for user@domain.com.com
2017-08-07 09:54:32 [19287] 1dehYG-0004xE-AN => user  F=<3M2GIWRQKAOgQYYQVOKVObdc-XYbOZViQYYQVO.MYW@alerts.bounces.google.com> P=<3M2GIWRQKAOgQYYQVOKVObdc-XYbOZViQYYQVO.MYW@alerts.bounces.google.com> R=virtual_user T=dovecot_virtual_delivery S=12303 C="250 2.0.0  +EiUJQhjiFlpSAAAvCj03Q Saved" QT=0s DT=0s
2017-08-07 09:54:32 [19287] 1dehYG-0004xE-AN Completed QT=0s

cPanelMichael

August 08, 2017 14:59

Hello, Do you see the test message in the Junk folder across all webmail clients (e.g. Horde, Roundcube, SquirrelMail), or is it limited to a specific client? Thank you.

siriusb

August 09, 2017 10:54

Hi Michael. I just use RoundCube, so I just enabled. I can confirm that emails are in Junk. Last night, I did a migration of all accounts to bigger server. At least, 8 new emails from Google Alerts going to Junk. This server doesnt have any config, just default and cluster dns enabled.


-rw-r----- 1 user user  12K Aug  9 05:07 1502255253.M702235P8919.myserver.mydomain.com.ar,S=11980,W=12159:2,
-rw-r----- 1 user user  12K Aug  9 05:37 1502257023.M134953P12945.myserver.mydomain.com.ar,S=11472,W=11645:2,
-rw-r----- 1 user user  12K Aug  9 06:06 1502258783.M567775P16820.myserver.mydomain.com.ar,S=11488,W=11661:2,
-rw-r----- 1 user user  15K Aug  9 06:27 1502260025.M623402P19405.myserver.mydomain.com.ar,S=15254,W=15477:2,
-rw-r----- 1 user user  12K Aug  9 06:33 1502260435.M547521P20109.myserver.mydomain.com.ar,S=11551,W=11725:2,
-rw-r----- 1 user user  14K Aug  9 07:35 1502264131.M566627P29685.myserver.mydomain.com.ar,S=13968,W=14173:2,
-rw-r----- 1 user user  12K Aug  9 08:07 1502266077.M845463P2105.myserver.mydomain.com.ar,S=11689,W=11864:2,
-rw-r----- 1 user user  15K Aug  9 08:16 1502266578.M983981P3473.myserver.mydomain.com.ar,S=15010,W=15229:2,


[root@myserver cur]# exigrep 1dfMA6-0000tt-LW /var/log/exim_*
2017-08-09 08:16:18 cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1dfMA6-0000tt-LW

2017-08-09 08:16:18 1dfMA6-0000tt-LW <= 3qMSKWRQKAC8RZZRWPLWPced-YZcPaWjRZZRWP.NZX@alerts.bounces.google.com H=mail-pg0-f70.google.com [74.125.83.70]:38502 P=esmtps X=TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128 CV=no S=14539 id=001a1147b9cc492ee105564daf68@google.com T="Alerta de Google: string" for customeraccount@customerdomain.com
2017-08-09 08:16:18 1dfMA6-0000tt-LW => customeraccount  R=virtual_user T=dovecot_virtual_delivery C="250 2.0.0  yDiXOtLEilmRDQAAmLI4lg Saved"
2017-08-09 08:16:18 1dfMA6-0000tt-LW Completed

I opened a ticket with my cpanel reseller, and is scaled, I guess, to cPanel.

August 09, 2017 11:14

I just realized to check at least, Google Alert ip address from last email, have a little problem with RBL. They are in 16! MultiRBL.valli.org - Results of the query 74.125.83.70 I will add to excempt list, but this is not a solution, just a temporal patch, because I ll allow all spam from Gmail :/

August 09, 2017 14:11

Could you post the ticket number here? Thanks!

August 10, 2017 13:23

Sorry. I did a migration of server for emergency on datacenter and I was dealing with related problems. I ll comment later with ticket number. I must tell that after migration to a new server, problem still there :/

SpamAssassin disabled, but going to Junk

Comments

Didn't find what you were looking for?