• kimdre

      Moolevel 2
    • Post #1

    I sometimes receive spam mails, that have a score higher than my minimum score to get flagged as spam but they don’t for some reason.
    E.g. A mail has a score of 8,83 but doesn’t get flagged, even though the spam/junk score setting of my mailbox is 6-15
    Is this normal behaviour?

    • EETNyx

        Moolevel 73
      • Post #2

      Can you send headers from e-mail what exactly rspam did?

      Have something to say?

      Join the community by quickly registering to participate in this discussion. We'd like to see you joining our great moo-community!

      • kimdre

          Moolevel 2
        • Post #3

        These are the headers of one of the spam mail I’m talking about

        Return-Path: <ovkiwfr@almalinux.gb.net>
Delivered-To: kontakt@<redacted>.de
Received: from mail.<redacted>.de ([fd4d:6169:6c63:6f77::d])
	by 571dfdc8d171 with LMTP
	id qJz/AeAYmWfHVgQAB8BEWQ
	(envelope-from <ovkiwfr@almalinux.gb.net>)
	for <kontakt@<redacted>.de>; Tue, 28 Jan 2025 18:50:24 +0100
X-Original-To: kontakt@<redacted>.de
Received: from xn--k1aif.078.xn--p1acf (xn--k1aif.078.xn--p1acf [212.32.242.60])
	by mail.<redacted>.de (Postcow) with ESMTP id 1EEB3BC07C
	for <kontakt@<redacted>.de>; Tue, 28 Jan 2025 18:50:22 +0100 (CET)
Authentication-Results: mail.<redacted>.de;
	dkim=none;
	spf=pass (mail.<redacted>.de: domain of ovkiwfr@almalinux.gb.net designates 212.32.242.60 as permitted sender) smtp.mailfrom=ovkiwfr@almalinux.gb.net
Received: from almalinux.gb.net (relabs.homes [46.20.35.125])
	by xn--k1aif.078.xn--p1acf (Postfix) with ESMTPA id E43E66CA5D;
	Tue, 28 Jan 2025 17:38:51 +0200 (EET)
Message-ID: <143764402400372176456715736687830768455750613311@almalinux.gb.net>
From: "Kein Verlangen nach Zigaretten" <ovkiwfr@almalinux.gb.net>
To: <terminabsage@lukasplath.de>
Subject: Nicozero - Ihre Freiheit von Nikotin!
Date: Tue, 28 Jan 2025 17:38:52 +0200
MIME-Version: 1.0
Content-Type: multipart/related;
	type="multipart/alternative";
	boundary="----=_NextPart_000_0006_01DB71A9.37177EE0"
X-Rspamd-Queue-Id: 1EEB3BC07C
X-Rspamd-Fuzzy: 4f3dd46fdbb3519060449b67721b44fe56b06ee3fbfe0c49195b13c7b6810b05ad7b3188f9353ce5aea08b4c46dfd0479ed119dfa6c694ba044fdf953eab52ee
X-Rspamd-Pre-Result: action=no action;
	module=multimap;
	Matched map: GLOBAL_RCPT_WL
X-Spamd-Result: default: False [8.83 / 15.00];
	MAILCOW_FUZZY_DENIED(6.94)[11:3e637642b2:1.00:txt,11:4f3dd46fdb:1.00:bin];
	HTML_SHORT_LINK_IMG_1(2.00)[];
	ONCE_RECEIVED(0.20)[];
	R_SPF_ALLOW(-0.20)[+mx];
	MIME_GOOD(-0.10)[multipart/related,multipart/alternative,text/plain];
	MX_GOOD(-0.01)[];
	ASN(0.00)[asn:60781, ipnet:212.32.224.0/19, country:NL];
	SUBJECT_ENDS_EXCLAIM(0.00)[];
	GLOBAL_RCPT_WL(0.00)[kontakt@<redacted>.de];
	RCPT_MAILCOW_DOMAIN(0.00)[<redacted>.de];
	R_DKIM_NA(0.00)[];
	MIME_TRACE(0.00)[0:+,1:+,2:+,3:~,4:~,5:+];
	FROM_EQ_ENVFROM(0.00)[];
	FROM_HAS_DN(0.00)[]

This is a multi-part message in MIME format.

------=_NextPart_000_0006_01DB71A9.37177EE0
Content-Type: multipart/alternative;
	boundary="----=_NextPart_000_0007_01DB71A9.37177EE0"

------=_NextPart_000_0007_01DB71A9.37177EE0
Content-Type: text/plain;
	charset="windows-1251"
Content-Transfer-Encoding: quoted-printable

=0D=0A=0D=0A=0D=0A=0D=0A=0D=0A=0D=0A  =0D=0A  =0D=0A    =0D=0A  =20=
    =0D=0A      Nicozero - mit dem =0D=0A      rauchen=0D=0A    =20=
 aufzuh&#246;ren ist =0D=0A      einfach!=0D=0A       =0D=0A  =0D=
=0A    =0D=0A       =0D=0A      Wie ich f&#252;r immer mit dem Ra=
uchen aufgeh&#246;rt =0D=0A      habe.=0D=0A       =0D=0A      Ic=
h habe 1000 Mal versucht mit dem Rauchen =0D=0A      aufzuh&#246;=
ren=0D=0A      und es scheint, dass es mir beim 1001=0D=0A      M=
al endlich gelungen ist!=0D=0A       =0D=0A  =0D=0A    =0D=0A   =20=
  Seit sechs Monaten finde ich =0D=0A      Raucher ziemlich eklig=
=0D=0A      und werde niemals einer von =0D=0A      ihnen werden.=
=0D=0A       =0D=0A      =0D=0A       =0D=0A      M&#246;chtet ih=
r es auch so? =0D=0A      &gt;&gt;&gt;=0D=0A
------=_NextPart_000_0007_01DB71A9.37177EE0
Content-Type: text/html;
	charset="windows-1251"
Content-Transfer-Encoding: quoted-printable

        And this is the rspamd score with a forged recepient address, that didn’t even got flagged as one.

        However another mailbox that also received a similiar spam mail marked it as spam with no issues:

          • esackbauer

            • Community Hero
            Moolevel 437
          • Post #4
          • Edited

          kimdre Matched map: GLOBAL_RCPT_WL

          Looks like someone did the global whitelist a little too generous.
          Pls check all your whitelistings.
          Do NOT put any mailbox addresses or mail domains from mailcows own domains on a recipient whitelist!

              • kimdre

                  Moolevel 2
                • Post #5

                esackbauer Thank you I guess I misunderstood the meaning of that filter. 🙂

                  No one is typing