Unable to stop Rspamd tagging mails as spam

sfgreenwood

I get a lot of mails from Bandcamp but in the last few days Mailcow has started tagging them with $junk and $filtered. I have whitelisted their From address (noreply@bandcamp.com) and tried to train Rspamd by untagging them and dropping them in a folder, but new mails are still getting tagged. Their spam score isn’t meeting the criteria for being marked and they’re being logged as ‘No action’ in the Rspamd log. I use Thunderbird as as a client and thought it might be that at first but I switched to Sogo and it still happened. Is there anything else in the stack that might cause it?

ETNyx

Someone before your server mark this mail? Try to post full header of this message.

sfgreenwood

There isn’t an upstream server from my server. This is the source of the last mail received with my email and server information removed.

From: Bandcamp <noreply@bandcamp.com>
Subject: New message from Field Lines Cartographer
MIME-Version: 1.0
Content-Type: multipart/alternative;
 boundary="it_was_only_a_kiss"
Message-ID: <38W6q0YdS9OHP9ZZ4yRqbg@geopod-ismtpd-11>
Reply-To: noreply@bandcamp.com
Date: Mon, 09 Jun 2025 11:15:39 +0000 (UTC)
To: xxx xxx <xxx>

This is a multi-part message in MIME format.
--it_was_only_a_kiss
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 8bit

ETNyx

Thanks, this message was also tagged as junk | filtered? I do not see any of those in headers, this should point us to filtering after message was received. Most-likely there are two suspects. 1) Dovecot sieving on your MC 2) Some kind of client filtering, every time I’m solving mystery as this it’s always Tim Cook’s fault,.. Something in Apple OS is too aggressive and mess whit mails,…

sfgreenwood

Yes, it was . This is one from today, taken from the Junk folder in SoGo (screenshot showing the tags attached). There are no Apple products in the chain. I immediately assumed Thunderbird and turned off all the adaptive junk settings, but I will have a look at the Dovecot logs and any sieve settings

Return-Path: <bounces+715912-dc9d-mail=xxx@email.bandcamp.com>
Delivered-To: mail@xxx
Received: from xxx ([172.22.1.253])
	by 8275aec1f001 with LMTP
	id CDX1E0kCSGgbBggAP3GbRw
	(envelope-from <bounces+715912-dc9d-mail=xxx@email.bandcamp.com>)
	for <mail@xxx>; Tue, 10 Jun 2025 11:00:41 +0100
X-Original-To: mail@xxx
Received: from o3.email.bandcamp.com (o3.email.bandcamp.com [198.21.0.215])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature ECDSA (secp384r1) server-digest SHA384)
	(No client certificate requested)
	by xxx (Postcow) with ESMTPS id A1B722949B67
	for <mail@xxx>; Tue, 10 Jun 2025 11:00:39 +0100 (BST)
Authentication-Results: xxx;
	dkim=pass header.d=email.bandcamp.com header.s=smtpapi header.b=b2ZRnAQS;
	dmarc=pass (policy=none) header.from=bandcamp.com;
	spf=pass (xxx: domain of "bounces+715912-dc9d-mail=xxx@email.bandcamp.com" designates 198.21.0.215 as permitted sender) smtp.mailfrom="bounces+715912-dc9d-mail=xxx@email.bandcamp.com"
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed;
	d=xxx; s=dkim; t=1749549640;
	h=from:from:reply-to:reply-to:subject:subject:date:date:
	 message-id:message-id:to:to:cc:mime-version:mime-version:
	 content-type:content-type:dkim-signature;
	bh=3XyPvSPFYr4bdjJx1PEYjpoqqNzZfsW8o30Jdmvteos=;
	b=yicqfYNp9Gu15AUGlpuZh/uBv/YzGaS2xkysnWnjwBNNrvtGhH8PQ+1jiE3gwvGh04Txj5
	XzUJzqDRDjpq8y1pgLxSCT7YWZPHBJAr6+Cv7HFjvccp5Kg2wjSGmVuKcEjhkKlx0NWgWC
	AYVCJky2lpErFdl1VhZemXW11ohDqmJxyQH6WJ5cdw+SNkwyJfXFfFfJm7HwBusZH90xNZ
	oBmS0KvLQ26kBlbnugOIz3mFCwo4YS3uuX0oUOYoK9d9ewnaEQ2td3GfSkTTjEoSK8C650
	JrB6ObjgzSXJq2ImBRgQW6dj8iZlPpHR3bKY10QrnuvxG7v+bCfgNFiCoMx7Ew==
ARC-Authentication-Results: i=1;
	xxx;
	dkim=pass header.d=email.bandcamp.com header.s=smtpapi header.b=b2ZRnAQS;
	dmarc=pass (policy=none) header.from=bandcamp.com;
	spf=pass (xxx: domain of "bounces+715912-dc9d-mail=xxx@email.bandcamp.com" designates 198.21.0.215 as permitted sender) smtp.mailfrom="bounces+715912-dc9d-mail=xxx@email.bandcamp.com"
ARC-Seal: i=1; s=dkim; d=xxx; t=1749549640; a=rsa-sha256;
	cv=none;
	b=qY8dljvb8+pr+cdQq99N8v6PR1FJmDjUTBMJPan9UycplDTY+fINEp3/H5RSGBSY9f3VI3
	XXE5ok5sGsytWVYbeF1L1/Sab3yBL1YqvgT3Hm1nJXhfx/L2oNjr4IKJoA/gZcuUZ/Z0pC
	u6YB8gCFU9tN67vxlpkyv6cbcPLsflJrTjPHat6CreavmnwhIS+LSUVnW5a35etwBDu6tp
	gTkX6/OI6wEUVMYOvSaMMO0QzzxX1kqrSpJc4d0NEvjyh9jaOsN9fBiAHzjYGzOir+cxJd
	w84aREWh6RhlUfd9ItmQtsb0y9JyGRl1WIYp+oTG1ew4OcA8FDa+C3hDcbuMzA==
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=email.bandcamp.com;
	h=from:subject:mime-version:content-type:reply-to:to:cc:content-type:
	from:subject:to;
	s=smtpapi; bh=3XyPvSPFYr4bdjJx1PEYjpoqqNzZfsW8o30Jdmvteos=;
	b=b2ZRnAQSbVbVAn6CYBCFEy1RD/KhUcVS2z9qLOHJXr44pIhbGUkw+m5Y6tDCb4BFlrs2
	uydXky64OeZZnapd0up90kVCN8a10L2Oo59WAdFaclo0lL8wFJZlVxRr0rEC7JQAY17SqA
	mZ06ZquMYVm4VaC41UnbgqaxcdJvpkCN4=
Received: by recvd-d89877956-npqxf with SMTP id recvd-d89877956-npqxf-1-68480246-1B
	2025-06-10 10:00:38.082377685 +0000 UTC m=+495048.811329990
Received: from bandcamp.com (unknown)
	by geopod-ismtpd-1 (SG) with ESMTP
	id 6p0UFiV2S_udw384Sd1cXA
	for <mail@xxx>;
	Tue, 10 Jun 2025 10:00:37.992 +0000 (UTC)
From: Bandcamp <noreply@bandcamp.com>
Subject: New release from Sonic Cathedral
MIME-Version: 1.0
Content-Type: multipart/alternative;
 boundary="it_was_only_a_kiss"
Message-ID: <6p0UFiV2S_udw384Sd1cXA@geopod-ismtpd-1>
Reply-To: noreply@bandcamp.com
Date: Tue, 10 Jun 2025 10:00:38 +0000 (UTC)
X-SG-EID: 
 =?us-ascii?Q?u001=2EiuBrN0M2FfE2lDfIsVN10bp9ex8mb9IfUODGxjSvzVNUQ7XaUvb27pRj2?=
 =?us-ascii?Q?BkhJgzZE+IYzyB90BBVSvZIld7jZ+=2FLjFbRE696?=
 =?us-ascii?Q?MxabSFeSVqMstR52yw5dSuxV84jCATvJlZ+bJS0?=
 =?us-ascii?Q?lRyrYlVwUkurlL9dmZ0HQF=2Ffzx1xuny+eXBvBrP?=
 =?us-ascii?Q?GM4WaUf=2Fzz50Vbaeoy6O2fA5ww57ocF8NXVuRGk?=
 =?us-ascii?Q?zUwkhCBfH+dFT2OJ9+mh0Jb4JAphMnzri0cH=2Fvr?= =?us-ascii?Q?HYal?=
To: Simon Greenwood <mail@xxx>
X-Entity-ID: u001.E8iZEwEvi86tM7+ITyUOvQ==
X-Last-TLS-Session-Version: TLSv1.3
X-Rspamd-Queue-Id: A1B722949B67
X-Spamd-Result: default: False [-1004.08 / 15.00];
	MAILCOW_WHITE(-999.00)[];
	BAYES_HAM(-3.47)[94.39%];
	IP_REPUTATION_HAM(-1.40)[asn: 11377(-0.40), country: US(-0.00), ip: 198.21.0.215(-1.00)];
	URI_COUNT_ODD(1.00)[3];
	RBL_SENDERSCORE_REPUT_9(-1.00)[198.21.0.215:from];
	MID_RHS_NOT_FQDN(0.50)[];
	DMARC_POLICY_ALLOW(-0.50)[bandcamp.com,none];
	FORGED_SENDER(0.30)[noreply@bandcamp.com,bounces@email.bandcamp.com];
	R_DKIM_ALLOW(-0.20)[email.bandcamp.com:s=smtpapi];
	R_SPF_ALLOW(-0.20)[+ip4:198.21.0.0/21:c];
	MIME_GOOD(-0.10)[multipart/alternative,text/plain];
	MX_GOOD(-0.01)[];
	RCPT_MAILCOW_DOMAIN(0.00)[xxx];
	TO_MATCH_ENVRCPT_ALL(0.00)[];
	BCC(0.00)[];
	MIME_TRACE(0.00)[0:+,1:+,2:~];
	ARC_NA(0.00)[];
	RCPT_COUNT_ONE(0.00)[1];
	FROM_HAS_DN(0.00)[];
	TAGGED_FROM(0.00)[715912-dc9d-mail=xxx];
	TO_DN_ALL(0.00)[];
	RCVD_COUNT_TWO(0.00)[2];
	PREVIOUSLY_DELIVERED(0.00)[mail@xxx];
	REPLYTO_ADDR_EQ_FROM(0.00)[];
	FROM_NEQ_ENVFROM(0.00)[noreply@bandcamp.com,bounces@email.bandcamp.com];
	RCVD_TLS_LAST(0.00)[];
	RWL_MAILSPIKE_POSSIBLE(0.00)[198.21.0.215:from];
	MISSING_XM_UA(0.00)[];
	ARC_SIGNED(0.00)[xxx:s=dkim:i=1];
	ASN(0.00)[asn:11377, ipnet:198.21.0.0/21, country:US];
	REPLYTO_DOM_NEQ_TO_DOM(0.00)[];
	DKIM_TRACE(0.00)[email.bandcamp.com:+];
	HAS_REPLYTO(0.00)[noreply@bandcamp.com]

esackbauer

Maybe there is a rule defined in SOGo (your account) or a global sieve rule that marks it as spam (maybe based on keywords)?
I would rule out that it is rspamd.

sfgreenwood

I can’t see anything in Sogo or in the mailcow global or account sieve settings.
Looking at Sogo, mails started being tagged with the _$junk and _$filtered tags on May 23rd but I only noticed they were being moved earlier this week. I usually check mail with Thunderbird on my desktop and FairEmail on my phone, which I use with a unified inbox, and will often tag items from other accounts as spam, so I’m wondering if I tagged one or a few Bandcamp mails as spam and something has decided they’re now all spam, but I still can’t work out what.

sfgreenwood

Last night I switched off adaptive spam logging in Thunderbird and that stopped mails to Bandcamp being marked as junk. However, they started being automatically tagged as Important, which I also don’t want :/ . So it’s a Thunderbird issue, which I’ve seen before and is also incredibly frustrating to fix while it happens.

UPDATE: I tested my mail account with my Nextcloud install as well, and there seems to be a bug in the Nextcloud mail client that automatically tags mail with the 0 tag, which Thunderbird interprets as Important by default.

So you’re right, it isn’t Rspamd or indeed Mailcow. Digging into this, both Thunderbird and FairEmail insist that it’s going to be a server issue.

Thanks for the help! Is there any way to change the title of the thread as it’s definitely misleading?