Skip to main content

cPanel 138 / CloudLinux 8 – KAM_DMARC_QUARANTINE false positives on local Exim delivery

bloatedstoat

We are investigating an issue with cPanel & WHM 138 on CloudLinux 8, using ConfigServer MailScanner (MSFE) (yes we know, it's being removed shortly) with the KAM SpamAssassin ruleset enabled.

Issue

Messages sent internally between accounts hosted on the same server trigger KAM_DMARC_QUARANTINE, despite our DKIM, SPF and DMARC configuration being enabled and functioning correctly for outbound external email.

Examples:

  • userA@localmachine → userB@localmachine: no DKIM signature; KAM_DMARC_QUARANTINE fires.
  • userA@localmachine → remoteuser@remotedomain: DKIM signature is attached and authentication passes.

Observed SpamAssassin report

SpamAssassin (not cached, score=2.111, required 5,
 ALL_TRUSTED -1.00,
 BAYES_05 -0.50,
 HTML_MESSAGE 0.00,
 KAM_DMARC_QUARANTINE 1.50,
 KAM_DMARC_STATUS 0.01,
 KAM_MARKSPAM 2.10)

X-MailScanner-From: user@local
X-Spam-Status: No

The message is not classified as spam in this example, but the KAM rule adds an unwanted score.

Configuration findings

The installed /etc/mail/spamassassin/KAM.cf contains:

header KAM_DMARC_QUARANTINE eval:check_dmarc_quarantine()

The rule description states:

DKIM has Failed or SPF has failed on the message
and the domain has a DMARC quarantine policy

The same ruleset also defines KAM_DMARC_STATUS as a DKIM validity/alignment test.

We have confirmed that setting the rule's score to zero prevents the score from being applied. However, we do not want to disable the rule globally, as we need to retain DMARC-related scoring for external messages.

Here come the questions:

  1. Whether cPanel's Exim configuration or local-delivery routing explains why messages delivered between accounts on the same server bypass DKIM signing.
  2. Whether there is a supported configuration to DKIM-sign locally delivered messages, or otherwise ensure that internal messages are evaluated correctly by the SpamAssassin DMARC integration.
  3. Whether cPanel recommends a supported way to exclude trusted internal delivery from KAM_DMARC_QUARANTINE without disabling the rule for external mail.
  4. Whether this behaviour is expected with cPanel 138 and the current Exim/MailScanner integration.

We would prefer a supported solution that preserves the existing DKIM, SPF and DMARC protections for external email and avoids editing vendor-managed KAM rules directly.

Advice, solutions, comments appreciated. Thank you.

Comments

1 comment

Date Votes
  • cPRex Jurassic Moderator

    Hey there!  You always post the most interesting things!  I've got a 4 part answer to this one.

    1. Why local mail isn’t DKIM-signed

    cPanel’s Exim only DKIM-signs in the remote_smtp transport. Mail between accounts on the same server goes through the local delivery transports (local_delivery, virtual user, etc.) and never touches remote_smtp. So no signature is added. Nothing is misconfigured.

    SPF is also not meaningfully evaluated for these messages. The sender is the server itself or an authenticated user, so SPF is skipped or there is no Received-SPF header.

    2. Why KAM_DMARC_QUARANTINE fires

    check_dmarc_quarantine() comes from SpamAssassin’s DMARC plugin. It sees:

    • No DKIM signature, so DKIM is none/fail.
    • No usable SPF result, since the hop is trusted and SPF is skipped.
    • The From domain publishes p=quarantine.

    So it concludes “DMARC would quarantine this.” The plugin has no concept of “this never left the server.” ALL_TRUSTED (-1.0) in the same report confirms the message is internal.

    3. DKIM-signing local mail

    There is no supported cPanel option for this. I suppose there is always a way to modify things to make this work, but I don't have any recommended options here.

    4. Supported way to exempt internal mail without touching KAM.cf

    Offset the score with a meta rule in a file that KAM updates (sa-update) won’t overwrite. Use /etc/mail/spamassassin/local.cf, or MailScanner’s /etc/MailScanner/spam.assassin.prefs.conf if that’s the file your MSFE install reads:

     
    meta     LOCAL_INTERNAL_DMARC_OFFSET  KAM_DMARC_QUARANTINE && ALL_TRUSTED
describe LOCAL_INTERNAL_DMARC_OFFSET  Cancel KAM DMARC quarantine score on internal mail
score    LOCAL_INTERNAL_DMARC_OFFSET  -1.5

    Match the offset to the current KAM_DMARC_QUARANTINE score. The rule stays active for external mail, and ALL_TRUSTED only fires when every hop is in your trusted_networks/internal_networks. Check that the server’s own IPs are listed there. Then run spamassassin --lint and restart MailScanner.

    For the simplest approach, use sa-update-proof local score overrides. For something per-direction, you can also use a MailScanner ruleset (From:/To: matching local domains) to raise the required score or skip scanning for local-to-local mail. I’d skip that, because a compromised internal account is a real spam source.

    cPanel doesn’t ship or support KAM.cf (it’s from the McGrail channel).  And, as you said earlier, MSFE is also being removed. After migrating to cPanel’s native Exim/SpamAssassin setup, the same local.cf override approach applies.

    0

Please sign in to leave a comment.

Didn't find what you were looking for?

New post