I use a sieve filter to move spam email to user's Junk folder:
# cat spam_to_junk.sieve
require "fileinto";
if exists "X-Spam-Status" {
if header :contains "X-Spam-Status" "YES" {
fileinto "Junk";
stop;
} else {
}
}
if header :contains "subject" ["SPAM?"] {
fileinto "Junk";
stop;
}
Most time this filter works fine but occasionally it move non-spam in to
Junk folder. Here is an example, this email is from dovecot mailling
list and it end up in my Junk folder. Mailllog and header here. Would
someone help me to figure out what went wrong here?
Thanks.
Gao
=======Header=========
Dovecot Mailing List <[email protected]>
References: <[email protected]>
<[email protected]>
From: sender name <[email protected]>
Message-ID: <[email protected]>
Date: Thu, 14 Dec 2017 11:54:19 +0100
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101
Thunderbird/52.5.0
MIME-Version: 1.0
In-Reply-To: <[email protected]>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 8bit
Content-Language: en-US
X-SA-Exim-Connect-IP: 217.119.239.130
X-SA-Exim-Mail-From: [email protected]
X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on sogo.guto.nl
X-Spam-Level:
X-Spam-Status: No, score=-2.9 required=5.0 tests=ALL_TRUSTED,BAYES_00
autolearn=ham version=3.3.2, No
Subject: Re: New Dovecot service: SMTP Submission (RFC6409)
X-SA-Exim-Version: 4.2.1 (built Mon, 26 Dec 2011 16:24:06 +0000)
X-SA-Exim-Scanned: Yes (on sogo.guto.nl)
X-BeenThere: [email protected]
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Dovecot Mailing List <dovecot.dovecot.org>
List-Unsubscribe: <https://dovecot.org/mailman/options/dovecot>,
<mailto:[email protected]?subject=unsubscribe>
List-Archive: <https://dovecot.org/pipermail/dovecot/>
List-Post: <mailto:[email protected]>
List-Help: <mailto:[email protected]?subject=help>
List-Subscribe: <https://dovecot.org/mailman/listinfo/dovecot>,
<mailto:[email protected]?subject=subscribe>
Errors-To: [email protected]
Sender: "dovecot" <[email protected]>
X-mydomain-MailScanner-Information: Please contact the administrator for
more information
X-mydomain-MailScanner-ID: D6773400AB09.ADBA7
X-mydomain-MailScanner: Found to be clean
X-mydomain-MailScanner-SpamCheck: not spam, SpamAssassin (not cached,
score=-4.598, required 5, autolearn=not spam, BAYES_00 -1.90,
DCC_CHECK 1.10, HEADER_FROM_DIFFERENT_DOMAINS 0.00,
KAM_LAZY_DOMAIN_SECURITY 1.00, KAM_SHORT 0.00,
RCVD_IN_DNSWL_MED -2.30, RCVD_IN_HOSTKARMA_W -2.50)
X-mydomain-MailScanner-From: [email protected]
=====End of header=======
=======Maillog=========
Dec 14 02:54:51 mail postfix/postscreen[19236]: CONNECT from
[94.237.32.243]:40818 to [10.11.22.68]:25
Dec 14 02:54:52 mail postfix/postscreen[19236]: PASS OLD
[94.237.32.243]:40818
Dec 14 02:54:52 mail postfix/smtpd[19244]: connect from
wursti.dovecot.fi[94.237.32.243]
Dec 14 02:54:52 mail policyd-spf[19248]: None; identity=helo;
client-ip=94.237.32.243; helo=mail.dovecot.fi;
[email protected]; [email protected]
Dec 14 02:54:52 mail policyd-spf[19248]: None; identity=mailfrom;
client-ip=94.237.32.243; helo=mail.dovecot.fi;
[email protected]; [email protected]
Dec 14 02:54:52 mail postfix/smtpd[19244]: D6773400AB09:
client=wursti.dovecot.fi[94.237.32.243]
Dec 14 02:54:53 mail postfix/cleanup[19249]: D6773400AB09: hold: header
Received: from mail.dovecot.fi (wursti.dovecot.fi [94.237.32.243])??by
mail.mydomain.com (Postfix) with ESMTP id D6773400AB09??for
<[email protected]>; Thu, 14 Dec 2017 02:54:52 -0800 (PST) from
wursti.dovecot.fi[94.237.32.243]; from=<[email protected]>
to=<[email protected]> proto=ESMTP helo=<mail.dovecot.fi>
Dec 14 02:54:53 mail postfix/cleanup[19249]: D6773400AB09:
message-id=<[email protected]>
Dec 14 02:54:53 mail opendkim[1706]: D6773400AB09: wursti.dovecot.fi
[94.237.32.243] not internal
Dec 14 02:54:53 mail opendkim[1706]: D6773400AB09: not authenticated
Dec 14 02:54:53 mail opendkim[1706]: D6773400AB09: no signature data
Dec 14 02:54:53 mail postfix/smtpd[19244]: disconnect from
wursti.dovecot.fi[94.237.32.243] ehlo=1 mail=1 rcpt=1 data=1 quit=1
commands=5
Dec 14 02:54:53 mail MailScanner[18700]: New Batch: Scanning 1 messages,
7572 bytes
Dec 14 02:54:53 mail MailScanner[18700]: Virus and Content Scanning:
Starting
Dec 14 02:54:53 mail MailScanner[18700]: Spam Checks: Starting
Dec 14 02:54:53 mail MailScanner[18700]: MailWatch: Blacklist refresh
time reached
Dec 14 02:54:53 mail MailScanner[18700]: MailWatch: Starting up
MailWatch SQL Blacklist
Dec 14 02:54:53 mail MailScanner[18700]: MailWatch: Read 0 blacklist entries
Dec 14 02:54:56 mail MailScanner[18700]: Requeue: D6773400AB09.ADBA7 to
24EDE400AABD
Dec 14 02:54:56 mail MailScanner[18700]: Uninfected: Delivered 1 messages
Dec 14 02:54:56 mail postfix/qmgr[1756]: 24EDE400AABD:
from=<[email protected]>, size=6784, nrcpt=1 (queue active)
Dec 14 02:54:56 mail MailScanner[18700]: Deleted 1 messages from
processing-database
Dec 14 02:54:56 mail MailScanner[18700]: MailWatch: Logging message
D6773400AB09.ADBA7 to SQL
Dec 14 02:54:56 mail MailScanner[18962]: MailWatch: D6773400AB09.ADBA7:
Logged to MailWatch SQL
Dec 14 02:54:56 mail dovecot: lmtp(19259): Connect from local
Dec 14 02:54:56 mail dovecot: lmtp([email protected]):
AHqjGYBYMlo7SwAAlqGq+A: sieve:
msgid=<[email protected]>: stored mail
into mailbox 'Junk'
Dec 14 02:54:56 mail dovecot: lmtp(19259): Disconnect from local:
Successful quit
Dec 14 02:54:56 mail postfix/lmtp[19258]: 24EDE400AABD:
to=<[email protected]>, relay=mail.mydomain.com[private/dovecot-lmtp],
delay=3.9, delays=3.8/0.01/0.01/0.06, dsn=2.0.0, status=sent (250 2.0.0
<[email protected]> AHqjGYBYMlo7SwAAlqGq+A Saved)
Dec 14 02:54:56 mail postfix/qmgr[1756]: 24EDE400AABD: removed
Dec 14 02:54:56 mail dovecot: indexer-worker([email protected]): Indexed 1
messages in Junk (UIDs 11..11)
======End of Maillog======
