<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<br>
<br>
<tt>Thanks Dominic,<br>
<br>
My spamassassin and amavis are vanilla except for 50-user which
looks like<br>
<br>
:~$ cat /etc/amavis/conf.d/50-user <br>
use strict;<br>
<br>
#<br>
# Place your configuration directives here. They will override
those in<br>
# earlier files.<br>
#<br>
# See /usr/share/doc/amavisd-new/ for documentation and examples
of<br>
# the directives you can use in this file<br>
#<br>
$max_servers = 4;<br>
@local_domains_acl = ( ".$mydomain" );<br>
$ENV{PATH} = $path = '/usr/<a class="moz-txt-link-freetext" href="sbin:/sbin:/usr/bin:/bin">sbin:/sbin:/usr/bin:/bin</a>';<br>
$enable_dkim_verification = 1;<br>
@whitelist_sender_acl = @local_domains_acl;<br>
<br>
$final_virus_destiny = D_DISCARD; # (defaults to D_BOUNCE)<br>
$final_banned_destiny = D_DISCARD; # (defaults to D_BOUNCE)<br>
$final_spam_destiny = D_DISCARD; # (defaults to D_REJECT)<br>
$final_bad_header_destiny = D_PASS; # (defaults to D_PASS),
D_BOUNCE suggested<br>
<br>
$virus_admin = "virusalert\@$mydomain";<br>
$spam_admin = "postmaster\@$mydomain";<br>
<br>
#------------ Do not modify anything below this line -------------<br>
1; # ensure a defined return<br>
</tt><br>
<br>
So im a bit surprised it can end up quarantined with a lower score
than required, any help on where else to look or how to understand
this is appreciated.<br>
<br>
Phil<br>
<br>
<div class="moz-cite-prefix">On 26/12/24 21:20, Dominic Raferd
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:7eaf4b34-73c7-4d85-8e1b-8fbef02a63e6@timedicer.co.uk">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<p>Perhaps the report you are seeing which reads 'Spam detection
software, running on the system "acmewebsites", has NOT
identified this incoming email as spam' was generated by
Spamassassin (or another spam detection software), not by
Amavis. Amavis takes the total score given by the other spam
detection software (usually Spamassassin) and can then adjust it
according to more rules of its own before making a final
decision. Amavis's rules might even bypass all previous scoring
and impose an automatic discard. They are described in files in
/etc/amavis/conf.d, especially 50-user.<br>
</p>
<div class="moz-cite-prefix">On 25/12/2024 20:45, <a
class="moz-txt-link-abbreviated moz-txt-link-freetext"
href="mailto:phil@philfixit.com.au" moz-do-not-send="true">phil@philfixit.com.au</a>
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:6f10d327-b8c2-4626-af40-01392bab7473@philfixit.com.au">
<meta http-equiv="content-type"
content="text/html; charset=UTF-8">
<br>
Hi <br>
Amavis quarantined a mail with less than the required score, how
can this happen ?<br>
<br>
<div class="moz-text-plain" wrap="true"
style="font-family: -moz-fixed; font-size: 12px;"
lang="x-western">
<pre wrap="" class="moz-quote-pre">Content type: Spam
Internal reference code for the message is 2587633-16/VL5SambH1hmN
First upstream SMTP client IP address: [223.165.120.19]
o4877.e.sub.davidjones.com.au
According to a 'Received:' trace, the message apparently originated at:
[223.165.120.19], o4877.e.sub.davidjones.com.au
o4877.e.sub.davidjones.com.au [223.165.120.19] using TLSv1.3 with cipher
TLS_AES_128_GCM_SHA256 (128/128 bits)\t key-exchange X25519 server-signature
RSA-PSS (2048 bits) server-digest SHA256 No client certificate requested
Return-Path:
<a class="moz-txt-link-rfc2396E"
href="mailto:bounces+36848281-5faf-yvette=durabuild.com.au@e.sub.davidjones.com.au"
moz-do-not-send="true"><bounces+36848281-5faf-</a><a
class="moz-txt-link-rfc2396E"
href="mailto:yvette@durabuild.com.au" moz-do-not-send="true">user@example.com</a><a
class="moz-txt-link-rfc2396E"
href="mailto:bounces+36848281-5faf-yvette=durabuild.com.au@e.sub.davidjones.com.au"
moz-do-not-send="true">@e.sub.davidjones.com.au></a>
From: David Jones <a class="moz-txt-link-rfc2396E"
href="mailto:optin@sub.davidjones.com.au"
moz-do-not-send="true"><optin@sub.davidjones.com.au></a> (<a
class="moz-txt-link-freetext" href="dkim:AUTHOR"
moz-do-not-send="true">dkim:AUTHOR</a>)
Message-ID: <2N1MR1WITtqvIJTfsy-_8A@geopod-ismtpd-14>
Subject: SALE Starts Online Now
The message has been quarantined as: V/spam-VL5SambH1hmN.gz
The message WAS NOT relayed to:
<a class="moz-txt-link-rfc2396E"
href="mailto:yvettec@acmewebsites.com.au"
moz-do-not-send="true"><yvettec@acmewebsites.com.au></a>:
250 2.7.0 Ok, discarded, id=2587633-16 - spam
Spam scanner report:
Spam detection software, running on the system "acmewebsites",
has NOT identified this incoming email as spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: Up to 50% off fashion & homewares. Shop huge deals instore
from Boxing Day. DJ Logo ( <a class="moz-txt-link-freetext"
href="https://l.sub.davidjones.com.au/ls/click?upn=u001.yE9Px-2Fc9-2BssSkJm7SUbZKwWz1TzBmN2yMMQonjv5y5Sy3o8ejnKeLgRbsNJBfI3-2FuJhArKYq-2Fx4WoKz6Tpg2iA-3D-3D4AqR_Vb-2Fy6RPbw82R4IcJOIL0uTxe7md9wlR-2"
moz-do-not-send="true">https://l.sub.davidjones.com.au/ls/click?upn=u001.yE9Px-2Fc9-2BssSkJm7SUbZKwWz1TzBmN2yMMQonjv5y5Sy3o8ejnKeLgRbsNJBfI3-2FuJhArKYq-2Fx4WoKz6Tpg2iA-3D-3D4AqR_Vb-2Fy6RPbw82R4IcJOIL0uTxe7md9wlR-2</a>
[...]
Content analysis details: (2.9 points, 6.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record
-0.0 SPF_PASS SPF: sender matches SPF record
0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The
query to Validity was blocked. See
<a class="moz-txt-link-freetext"
href="https://knowledge.validity.com/hc/en-us/articles/20961730681243"
moz-do-not-send="true">https://knowledge.validity.com/hc/en-us/articles/20961730681243</a>
for more information.
[223.165.120.19 listed in bl.score.senderscore.com]
0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The
query to Validity was blocked. See
<a class="moz-txt-link-freetext"
href="https://knowledge.validity.com/hc/en-us/articles/20961730681243"
moz-do-not-send="true">https://knowledge.validity.com/hc/en-us/articles/20961730681243</a>
for more information.
[223.165.120.19 listed in sa-accredit.habeas.com]
0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or
identical to background
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_IMAGE_RATIO_04 BODY: HTML has a low ratio of text to image
area
0.5 KAM_REALLYHUGEIMGSRC RAW: Spam with image tags with ridiculously
huge http urls
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily
valid
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from
author's domain
2.5 KAM_ZWNS Use of zero width space characters indicates a goal to
elude scanners
0.0 UNPARSEABLE_RELAY Informational: message has unparseable relay
lines
</pre>
</div>
<br>
<fieldset class="moz-mime-attachment-header"><legend
class="moz-mime-attachment-header-name">header.hdr</legend></fieldset>
<pre wrap="" class="moz-quote-pre">Return-Path: <a
class="moz-txt-link-rfc2396E"
href="mailto:bounces+36848281-5faf-yvette=durabuild.com.au@e.sub.davidjones.com.au"
moz-do-not-send="true"><bounces+36848281-5faf-</a><a
class="moz-txt-link-rfc2396E"
href="mailto:yvette@durabuild.com.au" moz-do-not-send="true">user@example.com</a><a
class="moz-txt-link-rfc2396E"
href="mailto:bounces+36848281-5faf-yvette=durabuild.com.au@e.sub.davidjones.com.au"
moz-do-not-send="true">@e.sub.davidjones.com.au></a>
Received-SPF: Pass (mailfrom) identity=mailfrom; client-ip=223.165.120.19; helo=o4877.e.sub.davidjones.com.au; <a
class="moz-txt-link-abbreviated"
href="mailto:envelope-from=bounces+36848281-5faf-yvette=durabuild.com.au@e.sub.davidjones.com.au"
moz-do-not-send="true">envelope-from=bounces+36848281-5faf-</a><a
class="moz-txt-link-rfc2396E"
href="mailto:yvette@durabuild.com.au" moz-do-not-send="true">user@example.com</a><a
class="moz-txt-link-abbreviated"
href="mailto:envelope-from=bounces+36848281-5faf-yvette=durabuild.com.au@e.sub.davidjones.com.au"
moz-do-not-send="true">@e.sub.davidjones.com.au</a>; receiver=<UNKNOWN>
Authentication-Results: OpenDMARC; dmarc=pass (p=reject dis=none) header.from=sub.davidjones.com.au
Authentication-Results: mail.acmewebsites.com.au;
dkim=pass (2048-bit key; unprotected) header.d=sub.davidjones.com.au <a
class="moz-txt-link-abbreviated moz-txt-link-freetext"
href="mailto:header.i=@sub.davidjones.com.au"
moz-do-not-send="true">header.i=@sub.davidjones.com.au</a> header.a=rsa-sha256 header.s=s1 header.b=2iSucZ/D;
dkim-atps=neutral
Received: from o4877.e.sub.davidjones.com.au (o4877.e.sub.davidjones.com.au [223.165.120.19])
(using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)
key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256)
(No client certificate requested)
by mail.acmewebsites.com.au (Postfix) with ESMTPS id 061861BC0324
for <a class="moz-txt-link-rfc2396E"
href="mailto:yvette@durabuild.com.au" moz-do-not-send="true"><user@example.com></a>; Tue, 24 Dec 2024 16:03:43 +1100 (AEDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sub.davidjones.com.au;
h=<a class="moz-txt-link-freetext"
href="content-type:from:mime-version:subject:list-unsubscribe"
moz-do-not-send="true">content-type:from:mime-version:subject:list-unsubscribe</a>:
<a class="moz-txt-link-freetext"
href="list-unsubscribe-post:to:cc:content-type:from:subject:to"
moz-do-not-send="true">list-unsubscribe-post:to:cc:content-type:from:subject:to</a>;
s=s1; bh=FpiPtj+LEylzHcOnWOpCbhWh4SFSg0Ap+ZjZNH1mRk8=;
b=2iSucZ/Ds1PkRGs2DbDh/oau39+ean3oqBCf9jZx4+yyNyEsK78Vn42TQlGruE3m3/Dl
yp5gy6qDwraiVYAz6p26tYpLEesF24i+HNlKZpNgfjHMOHAEDcGfgRkTGyWSo/Drl50y67
zvz5hW9tIt37Gfhjn2EG5bNs6a+/LQY5r8cJotyEKH8j6FG/Xcmt4nfq6P0GSTSTXA6b1Y
mekyeNMee53XbbGi1PNFISXcBJm4D5ms1Cx7r0QOzt04vIXQjy6TnQHQCJ02OuwOxrh2xN
3j738YcBDCamGQ+EOwTspGJ9/ij1+I0sHmAb05JUqHqwyrzGoa9Ya1jRtk48+WDQ==
Received: by recvd-6b669b7d6c-cqdht with SMTP id recvd-6b669b7d6c-cqdht-1-676A40AA-D
2024-12-24 05:03:38.360565077 +0000 UTC m=+3397206.668822129
Received: from MzY4NDgyODE (unknown)
by geopod-ismtpd-14 (SG) with HTTP
id 2N1MR1WITtqvIJTfsy-_8A
Tue, 24 Dec 2024 05:03:38.314 +0000 (UTC)
Content-Type: multipart/alternative; boundary=84ca9c06bdc7443c845bccdca4f5ac9b2b47b1acc5177ac909def4ae7871
Date: Tue, 24 Dec 2024 05:03:38 +0000 (UTC)
From: David Jones <a class="moz-txt-link-rfc2396E"
href="mailto:optin@sub.davidjones.com.au" moz-do-not-send="true"><optin@sub.davidjones.com.au></a>
Mime-Version: 1.0
Message-ID: <2N1MR1WITtqvIJTfsy-_8A@geopod-ismtpd-14>
Subject: SALE Starts Online Now</pre>
</blockquote>
</blockquote>
<br>
</body>
</html>