That will something in spamassassin settings … I guess the messages are being flagged by spamassassin as spam ?
look at webmin➡servers➡spamassassin mail filter➡spam classification and
webmin➡servers➡spamassassin mail filter➡message modification
don’t forget these are not ‘virtualmin setup files’ but in fact the configuration files for the service that virtualmin is managing on your behalf so you have looked at the mail log files to check that spamassassin is actually working and applying the necessary headers & scores to the messages ?
spamd is running,
Jul 29 14:53:21 server spamd[22407]: spamd: server started on IO::Socket::IP [127.0.0.1]:783 (running version 3.4.2)
Jul 29 14:53:21 server spamd[22407]: spamd: server pid: 22407
Jul 29 14:53:21 server spamd[22407]: spamd: server successfully spawned child process, pid 22421
but i don’t see in ANY email message the X-Spam header, why ?
i run virtualmin ‘re-check configuration’ and all is good
“SpamAssassin and Procmail are installed and configured for use”
note, i dont want .spam folder, just ‘deliver as normal’ as my email client is outlook with POP3, hence need to use the default main folder.
I am receiving all email, but i never see the X-Spam header…
are you getting spamd messages in the mail log ?
they look like this
Jul 29 05:03:11 server spamd[633088]: spamd: result: . 0 - DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,NO_RELAYS,PP_MIME_FAKE_ASCII_TEXT,T_SCC_BODY_TEXT_LINE scantime=4.2,size=1485,user=bill.gates@microsoft.com,uid=1020,required_score=5.0,rhost=127.0.0.1,raddr=127.0.0.1,rpo
rt=39992,mid=20230729040305.414241DF452@server.microsoft.com,autolearn=ham autolearn_force=no
note this is a fake user 
no messages like you show, only the spamd running (as above)
i can disable, then enable, and then i see spamd messages in the mail log, but no email messages being scanned !
Jul 29 16:03:12 server spamd[22407]: spamd: server killed by SIGTERM, shutting down
Jul 29 16:04:32 server spamd[12107]: logger: removing stderr method
Jul 29 16:04:33 server spamd[12109]: zoom: able to use 400/400 ‘body_0’ compiled rules (100%)
Jul 29 16:04:33 server spamd[12109]: spamd: server started on IO::Socket::IP [127.0.0.1]:783 (running version 3.4.2)
Jul 29 16:04:33 server spamd[12109]: spamd: server pid: 12109
Jul 29 16:04:33 server spamd[12109]: spamd: server successfully spawned child process, pid 12119
Jul 29 16:04:33 server spamd[12109]: spamd: server successfully spawned child process, pid 12120
Jul 29 16:04:33 server spamd[12109]: prefork: child states: SI
Jul 29 16:04:33 server spamd[12109]: prefork: child states: II
Browse the mail logs in webmin and type spamd in search box to narrow down the noise.
Should tell you more of what spamd is doing.
If it looks to be working? Than log into usermin account to view full message source for the x-spam headers.
Outlook defaults to truncate headers, so that could be why you are not seeing them in Outlook.
no spamd action in the mail log
test messages gets delivered ok, but no spamd:
Jul 29 16:18:47 server postfix/smtpd[14762]: 6A400B15B0: client=mail-yb1-f182.google.com[209.85.219.182]
Jul 29 16:18:47 server postfix/cleanup[14766]: 6A400B15B0: message-id=004e01d9c238$58a29f30$09e7dd90$@gmail.com
Jul 29 16:18:47 server postfix/qmgr[6806]: 6A400B15B0: from=xyz@gmail.com, size=6721, nrcpt=1 (queue active)
Jul 29 16:18:47 server postfix/local[14767]: 6A400B15B0: to=qwerty-abc.com@localhost.localdomain, orig_to=qwerty@abc.com, relay=local, delay=0.14, delays=0.13/0/0/0.01, dsn=2.0.0, status=sent (delivered to command: /usr/bin/procmail -a “$EXTENSION” DEFAULT=$HOME/Maildir/ MAILDIR=$HOME/Maildir)
Jul 29 16:18:47 server postfix/qmgr[6806]: 6A400B15B0: removed
What is the status of spamassassin?
systemctl status spamassassin
Try rebooting postfix to see if it resolves any issues by stopping it and starting it within Webmin.
its running, before and after a reboot, still running:
[server ~]# systemctl status spamassassin
● spamassassin.service - Perl-based spam filter using text analysis
Loaded: loaded (/lib/systemd/system/spamassassin.service; enabled; vendor preset: enabled)
Active: active (running) since Sat 2023-07-29 16:35:28 UTC; 9min ago
Process: 328 ExecStart=/usr/sbin/spamd -d --pidfile=/var/run/spamd.pid $OPTIONS (code=exited, status=0/SUCCESS)
Main PID: 601 (spamd)
Tasks: 3 (limit: 4915)
CGroup: /system.slice/spamassassin.service
├─601 /usr/bin/perl -T -w /usr/sbin/spamd -d --pidfile=/var/run/spamd.pid --create-prefs --max-children 5 --helper-home-dir
├─809 spamd child
└─810 spamd child
Jul 29 16:35:25 server.abc.com systemd[1]: Starting Perl-based spam filter using text analysis…
Jul 29 16:35:26 server.abc.com spamd[328]: logger: removing stderr method
Jul 29 16:35:27 server.abc.com spamd[601]: zoom: able to use 400/400 ‘body_0’ compiled rules (100%)
Jul 29 16:35:28 server.abc.com spamd[601]: spamd: server started on IO::Socket::IP [127.0.0.1]:783 (running version 3.4.2)
Jul 29 16:35:28 server.abc.com spamd[601]: spamd: server pid: 601
Jul 29 16:35:28 server.abc.com spamd[601]: spamd: server successfully spawned child process, pid 809
Jul 29 16:35:28 server.abc.com systemd[1]: Started Perl-based spam filter using text analysis.
Jul 29 16:35:28 server.abc.com spamd[601]: spamd: server successfully spawned child process, pid 810
Jul 29 16:35:28 server.abc.com spamd[601]: prefork: child states: IS
Jul 29 16:35:28 server.abc.com spamd[601]: prefork: child states: II
also start and stop postfix does not resolve.
Is “Spam Filtering Enabled” for that domain?
It maybe running but it’s not working have you altered anything in the postfix or spamassassin config files
yes, enabled, no not added to config files, apart from, deliver to normal vs the .Junk or .Spam file
…and email is begin delivered, so its not that, just no X-Spam header and no log of it either
…clearly spamassassin is NOT reading messages
From the looks of your recent post it hasn’t been working. This is only a suggestion, but perhaps your CFS installation is conflicting with Spamassassin? It’s the only application I see you are using that has nothing to do with Virtualmin. So if anyone who knows about CFS can chime in.
maybe return that config file back to original, restart everything and see if it helps
changed back (added #), reboot, no difference.
sharing some files in case someone can see something:
/etc/procmailrc
LOGFILE=/var/log/procmail.log
TRAP=/etc/webmin/virtual-server/procmail-logger.pl
:0wi
VIRTUALMIN=|/etc/webmin/virtual-server/lookup-domain.pl --exitcode 73 $LOGNAME
EXITCODE=$?
:0
- ?/usr/bin/test “$EXITCODE” = “73”
/dev/null
EXITCODE=0
:0 - ?/usr/bin/test “$VIRTUALMIN” != “”
{
INCLUDERC=/etc/webmin/virtual-server/procmail/$VIRTUALMIN
}
ORGMAIL=$HOME/Maildir/
DEFAULT=$HOME/Maildir/
DROPPRIVS=yes
:0
$DEFAULT
file that in turn runs a Procmail include file under /etc/webmin/virtual-server/procmail
then there are some ‘numbered’ files, 1 for each domain:
DROPPRIVS=yes
:0cw
| /etc/webmin/virtual-server/clam-wrapper.pl /usr/bin/clamdscan
VIRUSMODE=1
:0e
/dev/null
VIRUSMODE=0
:0fw
| /usr/bin/spamc
postfix main.cf
See /usr/share/postfix/main.cf.dist for a commented, more complete version
Debian specific: Specifying a file name will cause the first
line of that file to be used as the name. The Debian default
is /etc/mailname.
#myorigin = /etc/mailname
smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)
biff = no
appending .domain is the MUA’s job.
append_dot_mydomain = no
Uncomment the next line to generate “delayed mail” warnings
#delay_warning_time = 4h
readme_directory = no
See Postfix Backwards-Compatibility Safety Net – default to 2 on
fresh installs.
compatibility_level = 2
TLS parameters
smtpd_tls_cert_file = /etc/postfix/postfix.cert.pem
smtpd_tls_key_file = /etc/postfix/postfix.key.pem
smtpd_use_tls=yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for
information on enabling SSL in the smtp client.
smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination
myhostname = server.abc.com
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
myorigin = /etc/mailname
mydestination = $myhostname, localhost.localdomain, server.abc.com, localhost.abc.com, localhost
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
mailbox_command = /usr/bin/procmail -a “$EXTENSION” DEFAULT=$HOME/Maildir/ MAILDIR=$HOME/Maildir
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
inet_protocols = all
virtual_alias_maps = hash:/etc/postfix/virtual
sender_bcc_maps = hash:/etc/postfix/bcc
sender_dependent_default_transport_maps = hash:/etc/postfix/dependent
home_mailbox = Maildir/
smtpd_sasl_auth_enable = yes
smtpd_tls_security_level = may
broken_sasl_auth_clients = yes
smtpd_recipient_restrictions = check_sender_access hash:/etc/postfix/sender_access
smtp_tls_security_level = dane
allow_percent_hack = no
milter_default_action = accept
message_size_limit = 40000000
smtpd_tls_CAfile = /etc/postfix/postfix.ca.pem
smtp_dns_support_level = dnssec
smtp_host_lookup = dns
smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
smtpd_milters = inet:localhost:8891
non_smtpd_milters = inet:localhost:8891
spamassassin/local.cf:
Some shortcircuiting, if the plugin is enabled
ifplugin Mail::SpamAssassin::Plugin::Shortcircuit
endif # Mail::SpamAssassin::Plugin::Shortcircuit
rewrite_header subject SPAM
use_bayes 1
dns_available yes
required_score 3
Did you edit this section by removing the “#” if so? put it back and restart spamassassin.
i removed the # just to post here, its in the file
The only thing I can think of is to check your CSF logs and see if CSF is blocking any spamd processes.
