Topic: Spam not being rejected or deleted SME 7.5.1

[charlien]

My SA correctly marks spam but nothing I do will automatically delete it or move it to a spam folder. I did some searching and came up without a solution. Anyone have any ideas?

[janet]

charlien

My SA correctly marks spam but nothing I do will automatically delete it or move it to a spam folder.

What are the settings you have in servermanager Email panel for spamassassin ?
It is usually better to setup a custom configuration as per Sonoracomm howto (see below).
Do you have a folder with the exact name of junkmail in your IMAP mail folder structure ?
If you have set it up correctly, then spam tagged email above a certain score should be moved to the junkmail folder automatically and deleted after a specific period ie 90 days.
You can change the retention period with a db command.

There are additional spamassassin add on's, read the FAQ Email section for these eg Bayesian filtering and Sonoracomm howto re using a LearnAsSpam folder.

If you want to reject messages you need to enable RBL's, also see the FAQ Email section.

Another useful add on is the wbl panel for custom configuration of white and black lists.
yum install --enablerepo=smecontribs smeserver-wbl

I would advise implementing these one at a time, in order to gauge the effect of each.
Start with RBL's as these are likely to have the biggest impact on spam.
See links at top of forums.

[Stefano]

I would also ask to OP:
- are you server in server only or server and gateway?
- is there anything interesting in /var/log/qpsmtpd/current?

[CharlieBrady]

I would advise implementing these one at a time, in order to gauge the effect of each.

Mary, it should "just work". If it doesn't, OP should be reporting the problem to the bug tracker.

[Stefano]

Mary, it should "just work". If it doesn't, OP should be reporting the problem to the bug tracker.

Charlie, I would agree with you.. but in this case I think the issue is with a misconfiguration on OP side.. if rbls are disabled and OP is using only SA to fight spam, then most of spam will pass..

I woudd wait for OP feedback..

[CharlieBrady]

if rbls are disabled and OP is using only SA to fight spam, then most of spam will pass..

OP says that SA is correctly marking messages as spam.

[Stefano]

of course.. but SA without training won't delete spam
also, we don't know SA settings

[CharlieBrady]

of course.. but SA without training won't delete spam

SA in SME doesn't delete spam. All  it does is rate spam, and OP says it is doing that. Training can help, but it is not necessary. And OP says that "SA correctly marks spam".

SME should be using SA's rating to either reject the mail during SMTP transaction, or to sort it into the junkmail folder, from which it will eventually be deleted, after being held there for a configurable time. All this should be documented in the fine manual. If it is not, then a bug should be opened asking for the documentation to be clarified.

[janet]

CharlieBrady & charlien

If OP charlien would answer my questions then we would all know very quickly what is going on.

Yes I agree that all this could be handled in the bug tracker, but given the fact that it "should just work", then it did seem to be a case of user error, which could be adequately handled here in the forums.

I take your point though that this could end up being a documentation bug.

[charlien]

Here is how I had it configured:
Spam Filtering = Enabled
Sensitivity = Custom
Tagging Level = 5
Rejection level = 7
Sort to Junkmail = Disabled (I would just a soon delete it automatically)

This is the setting I've had for years on prior SME servers. It worked on 7.5. It seemed to break on 7.5.1 so I suppose I should be in the bug tracker, and I will do that next. It has been a long time since I did an upgrade and forgot about setting up WBL. After doing that my spam when down considerably but it still not being deleted, even when the header shows a score of over 12.

[janet]

charlien

Sort to Junkmail = Disabled (I would just a soon delete it automatically)

So there will be no tagged messages moved to the junkmail folder or any other spam folder for that matter, unless of course you have enabled some other form of mailrule filtering.
As far as deleting messages is concerned, then the system should reject messages with scores above 7, and you will never even see or receive those, so therefore nothing to be deleted.
The only other deleting I'm aware of is the deletion of spam from the junkmail folder after 90 days or whatever other time you may have set.

It seemed to break on 7.5.1 so I suppose I should be in the bug tracker

Yes, it sounds like something is not right with your system if you are still receiving messages with scores over 12.
Do you have some other SA features or add on's enabled ?

Do you actually have RBL's enabled (they are different to WBL) ?

[charlien]

here is the output of "config show qpsmtpd". It appears the RBLs are configured.
qpsmtpd=service
    Bcc=disabled
    BccMode=cc
    BccUser=maillog
    DNSBL=enabled
    LogLevel=6
    MaxScannerSize=25000000
    RBLList=bl.spamcop.net:combined.njabl.org:dnsbl.ahbl.org:dnsbl-1.uceprotect.net:dnsbl-2.uceprotect.net:list.dsbl.org:multihop.dsbl.org:psbl.surriel.com:zen.spamhaus.org
    RHSBL=enabled
    RequireResolvableFromHost=no
    SBLList=bogusmx.rfc-ignorant.org:multi.surbl.org:black.uribl.com:rhsbl.sorbs.net:bulk.rhs.mailpolice.com:fraud.rhs.mailpolice.com:porn.rhs.mailpolice.com:adult.rhs.mailpolice.com:ex.dnsbl.org
    TlsBeforeAuth=1
    access=public
    qplogsumm=disabled
    status=enabled

[Stefano]

ok, bug time IMHO

[MSmith]

So which bug should we be following?  OP might also try disabling RHSBL & DNSBL, then going into Server Manager and disabling all email and antivirus services, rebooting, then re-enabling everything.

[CharlieBrady]

So which bug should we be following?  OP might also try disabling RHSBL & DNSBL, then going into Server Manager and disabling all email and antivirus services, rebooting, then re-enabling everything.

No, that might be a bad idea. If there is a bug, that might destroy evidence of what the problem is.