Recently I enabled the “Delete spam if score is above” option for two virtual domains. (under Mail Options / Spam and Virus Delivery)
Unfortunately spam that has scores that are above the threshold still make it into the spam folder.
For example, I set the threshold to 99 in order to remove items flagged as USER_IN_BLOCKLIST, which is set at 100 pts. But messages with 106 or higher are still showing up.
Any thoughts? Do I need to restart something? Set something? Or does this not actually delete the emails?
I think, for the most part, that it is working since enabling the filter. Seemed fine for about a day. But this morning I had a spate of spam that hit some of the users, including me. Granted, many were coming from the same address (Jenny(at)GSD(dot)com, about 50 in my spam folder, alone) but there were others.
Then, about 2 hours after I posted, they seemed to have stopped. But that could be a coincidence. So, I will monitor and update.
Perhaps, but I don’t quite understand how the messages get deleted after Spamassasin scores them. I don’t think it’s SpamAssasin, itself. And the SpamAssasin output shows it’s own total.
Need to do more research, I suppose.
Regardless, as far as I know, there have not been any more spam messages that should have been blocked showing up in the past 20 or so hours.
it is not spamassassain that deletes the email, it justs adds the spam score. It is procmail i believe that actually deletes the email based on the score if this feature is enabled.
Okay. So procmail gives the email to Spamassasin. The message gets analyzed and scored, and then procmail somehow evaluates the Spamassasin header.
I know very little about procmail, and I it isn’t obvious to me what filter actually does the deleting.
However, I noticed something. I received an email in my spam folder that should have been filtered (score of 117.2 points). It was not in the /var/log/procmail.log while the other spam messages filtered (but put in the spam folder) were logged.
I almost wonder, are the email messages with high scores that got through not getting checked by procmail that second time after being sent to Spamassasin?
Edit: Well, I found that the filters are stored in separate files, one for each domain. The rule for filtering the spam is:
I was getting these same emails and my system wouldn’t block them at first. I think maybe I forgot to Apply Changes after configuring the deny address field. I think there is a Save button and a Apply Changes. Apparently ole Jenny likes to target Virtualmin users
I can see that they are, for the most part, being blocked—along with a lot of other items that are in the blocklist. It’s just that some do make it through.
Based on the SPAM_VALUE, some emails are going to the spam folder as usual, others to the Trash. I created a cronjob to delete the Trash folder periodically. Just adjust the value to your needs.
Based on this topic, I would like to suggest considering in Virtualmin the use of blacklist_from_rcvd in SpamAssassin configuration instead of (or in addition to) blacklist_from.
Currently, blacklist_from only checks the From: header in the email. While useful, this can be easily spoofed by spammers, allowing malicious emails to bypass the filter if the envelope (MAIL FROM) comes from a different source.
Using blacklist_from_rcvd provides additional security because it verifies both the envelope sender and the sending IP address. This significantly reduces the chance of spam bypassing the filter through header forgery and ensures more reliable blocking of unwanted senders.
Example:
# Less secure, checks only the From: header
blacklist_from spammer@example.com
# More secure, checks envelope and sending IP
blacklist_from_rcvd spammer@example.com
In my opinion, this approach maintains flexibility while improving protection against spoofed or forged emails.
Indeed hardening Postfix is crucial to not distribute spam. Using RBL lists in spamassassin (e.g. spamrats) is again a good solution.
However it must be done with caution so that important messages do not disappear. Postfix can be secured through tables so that certain addresses, including wildcard addresses, pass through. For example, you have an important partner and you do not have to delete his messages (you can move them with procmail to a specific folder if you want).
Webmin offers a solid administration/configuration base, but an advanced administrator should not limit himself to using the UI interface.