Customer A sends Customer B Mails, tagged as spam (same machine)

[Ben]

Hi folks,

did not knew how to get a better topic for my problem. My server, managed with ISPConfigs sometimes tags mails as spam when customer A sends an email to customer B while both are homed on the same machine.
The SA Infos about why it tagged are the follwing:

pts rule name description

---- ---------------------- --------------------------------------------------

2.3 CTYPE_001C_A CTYPE_001C_A

0.5 FH_MSGID_01C67 Special MSGID

0.0 HTML_MESSAGE BODY: HTML included in message

1.6 RCVD_IN_SORBS_DUL RBL: SORBS: sent directly from dynamic IP address

[84.58.47.146 listed in dnsbl.sorbs.net]

0.5 RCVD_IN_PBL RBL: Received via a relay in Spamhaus PBL

[84.58.47.146 listed in zen.spamhaus.org]

0.1 RDNS_DYNAMIC Delivered to trusted network by host with

dynamic-looking rDNS

0.3 DYN_RDNS_SHORT_HELO_HTML Sent by dynamic rDNS, short HELO, and HTML

Regarding the sender IP, sure its the clients dialup IP from the machine it sended the E-Mail via Outlook...

[falko]

Originally Posted by Ben

Regarding the sender IP, sure its the clients dialup IP from the machine it sended the E-Mail via Outlook...

So that's not your server's IP address? Does your server have a static IP address?

I've had the same problem about three weeks ago when I send someone a mail, but it bounced because my IP address (not the one of my mail server) was blacklisted. But I'm not sure why this happened...

[minskog]

this happen to me and i can't find solution

The problem is spamassasin, because if you put these black lists in postfix main.cf take de servers ip, but spamassasin takes client ip, i dont know why ....

[Ben]

No the IP is I guess the client ones. But not the one of my server. The server itself has a static IP.

[falko]

Originally Posted by minskog

this happen to me and i can't find solution

The problem is spamassasin, because if you put these black lists in postfix main.cf take de servers ip, but spamassasin takes client ip, i dont know why ....

Yes, seems to be a SpamAssassin problem: http://lists.roaringpenguin.com/pipe...er/017476.html
(I think it's really stupid to block client IP addresses... )

According to http://spamassassin.taint.org/doc/Ma...ssin_Conf.html , you could put

skip_rbl_checks 1

into your SpamAssassin configuration to fix this problem.

[Ben]

Yes, SA also checks RBLs in case of authenticated users and not only the "anonymmously" delivered emails.
I discussed this also with some others and there was the idea of "submission", that means to have one port, where only authenticated users may deliver emails but these are then not checked for spam.
I will try this and update here if and how it works.

EDIT: Well in an ISPConfig Szenario it won't work, cause SA gets called via procmail. So procmail has to determine if the mail that's shipped through SA comes from an authenticated user or not. Does anybody got an idea here?

[falko]

Originally Posted by Ben

EDIT: Well in an ISPConfig Szenario it won't work, cause SA gets called via procmail. So procmail has to determine if the mail that's shipped through SA comes from an authenticated user or not. Does anybody got an idea here?

You added

skip_rbl_checks 1

to SpamAssassin's configuration, and emails were still flagged as spam?

[Ben]

@falko: But this implies that spamassasin does do not an RBL Check generally.
Sure it solves the problem + more.

To wipe out the more it would be ok if it would be possible to change the user's procmail.rc to only run SA in case of the mail came from an mailaccount not homed on the same system.

[minskog]

Originally Posted by falko

Yes, seems to be a SpamAssassin problem: http://lists.roaringpenguin.com/pipe...er/017476.html
(I think it's really stupid to block client IP addresses... )

According to http://spamassassin.taint.org/doc/Ma...ssin_Conf.html , you could put

skip_rbl_checks 1

into your SpamAssassin configuration to fix this problem.

Yes, but i format this server, install fresh ispconfig and now spamassasin works ok. With the same server ip and sending from same clients Could be any procmail configuration directive?

[Ben]

@Falko: Temporaryly (till I find a better solution), I added the line to
"/home/admispconfig/ispconfig/tools/spamassassin/etc/mail/spamassassin/local.cf"
was this the right config file for SA? And if so, how do I prevent this file to be overwritten
after upgrading ISPConfig?