1

Админю два своих сервера Centos 6.10 c VestaCP на борту. Оперативы стоит 1GB + SWAP на 4ГБ.

Подключил Spamassassin и на первом всё работает нормально, все письма проходят проверку, а на втором половина явного спама проходит проверку, а половина – нет (тупо нет заголовков Spamassassin), но когда запускаю проверку на такое письмо через ssh spamassassin -D < test-message.txt оно показывает что score 14 из 3 required – т.е. явный спам.

Вопрос следующий – почему spamassassin не считывает все письма?

Конфиг spamassassin (local.cf):

required_hits 3
report_safe 0
ok_locales en ru

rewrite_header Subject [SPAM]
add_header spam Flag _YESNOCAPS_
add_header all Status _YESNO_, score=_SCORE_ required=_REQD_ tests=_TESTS_ autolearn=_AUTOLEARN_ version=_VERSION_
add_header all Level _STARS(*)_
add_header all Checker-Version SpamAssassin _VERSION_ (_SUBVERSION_) on _HOSTNAME_


use_learner 0
use_auto_whitelist 0
use_bayes 1
use_bayes_rules 1
bayes_auto_learn 0
bayes_auto_expire 0

Конфиг Exim

######################################################################
#                                                                    #
#          Exim configuration file for Vesta Control Panel           #
#                                                                    #
######################################################################

SPAMASSASSIN = yes SPAM_SCORE = 10
#CLAMD =  yes

disable_ipv6=true domainlist local_domains = dsearch;/etc/exim/domains/ domainlist relay_to_domains = dsearch;/etc/exim/domains/ hostlist relay_from_hosts = 127.0.0.1 hostlist whitelist = net-iplsearch;/etc/exim/white-blocks.conf hostlist spammers = net-iplsearch;/etc/exim/spam-blocks.conf no_local_from_check untrusted_set_sender = * acl_smtp_connect = acl_check_spammers acl_smtp_mail = acl_check_mail acl_smtp_rcpt = acl_check_rcpt acl_smtp_data = acl_check_data acl_smtp_mime = acl_check_mime

.ifdef SPAMASSASSIN spamd_address = 127.0.0.1 783 .endif

.ifdef CLAMD av_scanner = clamd: /var/run/clamav/clamd.sock .endif

tls_advertise_hosts = * tls_certificate = /usr/local/vesta/ssl/certificate.crt tls_privatekey = /usr/local/vesta/ssl/certificate.key

daemon_smtp_ports = 25 : 465 : 587 : 2525 tls_on_connect_ports = 465 never_users = root host_lookup = * rfc1413_hosts = * rfc1413_query_timeout = 5s ignore_bounce_errors_after = 2d timeout_frozen_after = 7d

DKIM_DOMAIN = ${lc:${domain:$h_from:}} DKIM_FILE = /etc/exim/domains/${lc:${domain:$h_from:}}/dkim.pem DKIM_PRIVATE_KEY = ${if exists{DKIM_FILE}{DKIM_FILE}{0}}



######################################################################
#                       ACL CONFIGURATION                            #
#         Specifies access control lists for incoming SMTP mail      #
###################################################################### begin acl

acl_check_spammers:   accept  hosts         = +whitelist

  drop    message       = Your host in blacklist on this server.
          log_message   = Host in blacklist
          hosts         = +spammers

  accept


acl_check_mail:   deny    condition     = ${if eq{$sender_helo_name}{}}
          message       = HELO required before MAIL

  drop    message       = Helo name contains a ip address (HELO was $sender_helo_name) and not is valid
          condition     = ${if match{$sender_helo_name}{\N((\d{1,3}[.-]\d{1,3}[.-]\d{1,3}[.-]\d{1,3})|([0-9a-f]{8})|([0-9A-F]{8}))\N}{yes}{no}}
          condition     = ${if match {${lookup dnsdb{>: defer_never,ptr=$sender_host_address}}\}{$sender_helo_name}{no}{yes}}
          delay         = 45s

  drop    condition     = ${if isip{$sender_helo_name}}
          message       = Access denied - Invalid HELO name (See RFC2821 4.1.3)

  drop    condition     = ${if eq{[$interface_address]}{$sender_helo_name}}
          message       = $interface_address is _my_ address

  accept


acl_check_rcpt:   accept  hosts         = :

  deny    message       = Restricted characters in address
          domains       = +local_domains
          local_parts   = ^[.] : ^.*[@%!/|]

  deny    message       = Restricted characters in address
          domains       = !+local_domains
          local_parts   = ^[./|] : ^.*[@%!] : ^.*/\\.\\./

  require verify        = sender

  accept  hosts         = +relay_from_hosts
          control       = submission

  accept  authenticated = *
          control       = submission/domain=

  deny    message       = Rejected because $sender_host_address is in a black list at $dnslist_domain\n$dnslist_text
          hosts         = !+whitelist
          dnslists      = ${readfile {/etc/exim/dnsbl.conf}{:}}

  require message       = relay not permitted
          domains       = +local_domains : +relay_to_domains

  deny    message       = smtp auth requried
         sender_domains = +local_domains
         !authenticated = *

  require verify        = recipient

.ifdef CLAMD   warn    set acl_m0    = no

  warn    condition     = ${if exists {/etc/exim/domains/$domain/antivirus}{yes}{no}}
          set acl_m0    = yes .endif

.ifdef SPAMASSASSIN   warn    set acl_m1    = no

  warn    condition     = ${if exists {/etc/exim/domains/$domain/antispam}{yes}{no}}
          set acl_m1    = yes .endif

  accept


acl_check_data: .ifdef CLAMD   deny   message        = Message contains a virus ($malware_name) and has been rejected
         malware        = *
         condition      = ${if eq{$acl_m0}{yes}{yes}{no}} .endif

.ifdef SPAMASSASSIN   warn   !authenticated = *
         hosts          = !+relay_from_hosts
         condition      = ${if < {$message_size}{100K}}
         condition      = ${if eq{$acl_m1}{yes}{yes}{no}}
         spam           = nobody:true/defer_ok
         add_header     = X-Spam-Score: $spam_score_int
         add_header     = X-Spam-Bar: $spam_bar
         add_header     = X-Spam-Report: $spam_report
         set acl_m2     = $spam_score_int

  warn   condition      = ${if !eq{$acl_m2}{} {yes}{no}}
         condition      = ${if >{$acl_m2}{SPAM_SCORE} {yes}{no}}
         add_header     = X-Spam-Status: Yes
         message        = SpamAssassin detected spam (from $sender_address to $recipients). .endif

  accept


acl_check_mime:   deny   message        = Blacklisted file extension detected
         condition      = ${if match {${lc:$mime_filename}}{\N(\.ade|\.adp|\.bat|\.chm|\.cmd|\.com|\.cpl|\.exe|\.hta|\.ins|\.isp|\.jse|\.lib|\.lnk|\.mde|\.msc|\.msp|\.mst|\.pif|\.scr|\.sct|\.shb|\.sys|\.vb|\.vbe|\.vbs|\.vxd|\.wsc|\.wsf|\.wsh)$\N}{1}{0}}

  accept



######################################################################
#                   AUTHENTICATION CONFIGURATION                     #
###################################################################### begin authenticators

dovecot_plain:   driver = dovecot   public_name = PLAIN   server_socket = /var/run/dovecot/auth-client   server_set_id = $auth1

dovecot_login:   driver = dovecot   public_name = LOGIN   server_socket = /var/run/dovecot/auth-client   server_set_id = $auth1



######################################################################
#                      ROUTERS CONFIGURATION                         #
#               Specifies how addresses are handled                  #
###################################################################### begin routers

#smarthost:
#  driver = manualroute
#  domains = ! +local_domains
#  transport = remote_smtp
#  route_list = * smartrelay.vestacp.com
#  no_more
#  no_verify

dnslookup:   driver = dnslookup   domains = !+local_domains   transport = remote_smtp   no_more

userforward:   driver = redirect   check_local_user   file = $home/.forward   allow_filter   no_verify   no_expn   check_ancestor   file_transport = address_file   pipe_transport = address_pipe   reply_transport = address_reply

procmail:   driver = accept   check_local_user   require_files = ${local_part}:+${home}/.procmailrc:/usr/bin/procmail   transport = procmail   no_verify

autoreplay:   driver = accept   require_files = /etc/exim/domains/$domain/autoreply.${local_part}.msg   condition = ${if exists{/etc/exim/domains/$domain/autoreply.${local_part}.msg}{yes}{no}} retry_use_local_part   transport = userautoreply   unseen

aliases:   driver = redirect   headers_add = X-redirected: yes   data
= ${extract{1}{:}{${lookup{$local_part@$domain}lsearch{/etc/exim/domains/$domain/aliases}}}} require_files = /etc/exim/domains/$domain/aliases   redirect_router = dnslookup   pipe_transport = address_pipe   unseen

localuser_fwd_only:   driver = accept   transport = devnull   condition = ${if exists{/etc/exim/domains/$domain/fwd_only}{${lookup{$local_part}lsearch{/etc/exim/domains/$domain/fwd_only}{true}{false}}}}

localuser_spam:   driver = accept   transport = local_spam_delivery   condition = ${if eq {${if match{$h_X-Spam-Status:}{\N^Yes\N}{yes}{no}}} {${lookup{$local_part}lsearch{/etc/exim/domains/$domain/passwd}{yes}{no_such_user}}}}

localuser:   driver = accept   transport = local_delivery   condition
= ${lookup{$local_part}lsearch{/etc/exim/domains/$domain/passwd}{true}{false}}

catchall:   driver = redirect   headers_add = X-redirected: yes   require_files = /etc/exim/domains/$domain/aliases   data = ${extract{1}{:}{${lookup{*@$domain}lsearch{/etc/exim/domains/$domain/aliases}}}} file_transport = local_delivery   redirect_router = dnslookup

terminate_alias:   driver = accept   transport = devnull   condition = ${lookup{$local_part@$domain}lsearch{/etc/exim/domains/$domain/aliases}{true}{false}}



######################################################################
#                      TRANSPORTS CONFIGURATION                      #
###################################################################### begin transports

remote_smtp:   driver = smtp   #helo_data = $sender_address_domain   dkim_domain = DKIM_DOMAIN   dkim_selector = mail   dkim_private_key = DKIM_PRIVATE_KEY   dkim_canon = relaxed   dkim_strict = 0

procmail:   driver = pipe   command = "/usr/bin/procmail -d $local_part"   return_path_add   delivery_date_add   envelope_to_add   user = $local_part   initgroups   return_output

local_delivery:   driver = appendfile   maildir_format   maildir_use_size_file   user = ${extract{2}{:}{${lookup{$local_part}lsearch{/etc/exim/domains/$domain/passwd}}}} group = mail   create_directory   directory_mode = 770   mode = 660   use_lockfile = no   delivery_date_add   envelope_to_add   return_path_add   directory = "${extract{5}{:}{${lookup{$local_part}lsearch{/etc/exim/domains/$domain/passwd}}}}/mail/$domain/$local_part" quota = ${extract{6}{:}{${lookup{$local_part}lsearch{/etc/exim/domains/$domain/passwd}}}}M quota_warn_threshold = 75%

local_spam_delivery:   driver = appendfile   maildir_format   maildir_use_size_file   user = ${extract{2}{:}{${lookup{$local_part}lsearch{/etc/exim/domains/$domain/passwd}}}} group = mail   create_directory   directory_mode = 770   mode = 660   use_lockfile = no   delivery_date_add   envelope_to_add   return_path_add   directory = "${extract{5}{:}{${lookup{$local_part}lsearch{/etc/exim/domains/$domain/passwd}}}}/mail/$domain/$local_part/.Spam" quota = ${extract{6}{:}{${lookup{$local_part}lsearch{/etc/exim/domains/$domain/passwd}}}}M quota_directory = "${extract{5}{:}{${lookup{$local_part}lsearch{/etc/exim/domains/$domain/passwd}}}}/mail/$domain/$local_part" quota_warn_threshold = 75%

address_pipe:   driver = pipe   return_output

address_file:   driver = appendfile   delivery_date_add   envelope_to_add   return_path_add

address_reply:   driver = autoreply

userautoreply:   driver = autoreply   file = /etc/exim/domains/$domain/autoreply.${local_part}.msg   from = "${local_part}@${domain}"   headers = Content-Type: text/plain; charset=utf-8;\nContent-Transfer-Encoding: 8bit   subject = "${if def:h_Subject: {Autoreply: \"${rfc2047:$h_Subject:}\"} {Autoreply Message}}"   to = "${sender_address}"

devnull:   driver = appendfile   file = /dev/null


######################################################################
#                      RETRY CONFIGURATION                           #
###################################################################### begin retry

# Address or Domain    Error       Retries
# -----------------    -----       -------
*                      *           F,2h,15m; G,16h,1h,1.5; F,4d,6h



######################################################################
#                      REWRITE CONFIGURATION                         #
###################################################################### begin rewrite



######################################################################

Заголовки письма которое считало:

Return-path: <[email protected]>
Envelope-to: [email protected]
Delivery-date: Wed, 13 Mar 2019 09:46:41 +0200
Received: from mail44.em3.n.mlgn2ca.com ([80.233.244.44])
    by server.myserver.com with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256)
    (Exim 4.91)
    (envelope-from <[email protected]>)
    id 1h3yas-0003GM-KA
    for [email protected]; Wed, 13 Mar 2019 09:46:41 +0200
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=s3o18; d=mlgn2ca.com;
    h=Date:To:From:Reply-to:Subject:Message-ID:List-Unsubscribe:Sender:List-id:MIME-Version:Content-Type; [email protected];
    bh=y6ODlLrCRV9qpTdyxqFIUGwKFrtvZg+NIE1VEGLcY4U=;
    b=l3kILPFNpLzMT61iAQKXgEYQzPhTKIdHYBMd1CnbVDfaOAB6pkaDczoj5YgdxHDTMLYnb1RIcxIZ
    OTuwxvFcxWXdsHH2Fj7TsMCGYmgDnNSksixYrKgOEin9CtYhqRBQehgKgceIXIpAQzkacWH/kclW
    7mAqHvM7H3GMqaImVAdoH9mk+reN+FIvHntFKv6FeGEoeyfzl2l+Yw0Qc4WB6UpiNEMjsJRsvriM
    sN7dnfboOqWih2VpZVg+DDpi4gOgTrX0o1GFZBRRNNE4rHd9HdDBI+KIun7XzQiIVLejWQoFt2it
    1fmOwq8AGK62orhn2kxCGTf2vfCeCVcLGNQYxg==
Received: by mail44.em3.n.mlgn2ca.com id hh2qlc28kv88 for <[email protected]>; Wed, 13 Mar 2019 09:45:56 +0200 (envelope-from <[email protected]>)
Date: Wed, 13 Mar 2019 09:45:42 +0200
To: [email protected]
From: =?utf-8?B?0JLRi9GB0YLQsNCy0LrQsCBDUFM=?= <[email protected]>
Reply-to: =?utf-8?B?0JLRi9GB0YLQsNCy0LrQsCBDUFM=?= <[email protected]>
Subject: =?utf-8?B?0J/RgNC+0LPRgNCw0LzQvNCwINCy0YvRgdGC0LDQstC60LggQ1BTIDIwMTk=?=
Message-ID: <[email protected]>
X-Priority: 3
X-Mailer: Mailigen Mailer - **CID530f49b6f2749e77**
X-Campaign: mailigen1a742220b1040be5bcb716e1e17a3b92.530f49b6
X-campaignid: mailigen1a742220b1040be5bcb716e1e17a3b92.530f49b6
X-Report-Abuse: Please report abuse for this campaign here: http://list.mlgn2ca.com/abuse/?u=1a742220b1040be5bcb716e1e17a3b92&id=530f49b6&e=f2749e77
List-Unsubscribe: <mailto:[email protected]?subject=unsubscribe;1a742220b1040be5bcb716e1e17a3b92-530f49b6-f2749e77>, <http://list.mlgn2ca.com/unsubscribe?u=1a742220b1040be5bcb716e1e17a3b92&id=8539a322&e=f2749e77&c=530f49b6>
Sender: "=?utf-8?B?0JLRi9GB0YLQsNCy0LrQsCBDUFM=?=" <[email protected]>
Precedence: bulk
Feedback-ID: 1a742220b1040be5bcb716e1e17a3b92:530f49b6:f2749e77:mailigen
X-Feedback-ID: 1a742220b1040be5bcb716e1e17a3b92:530f49b6:f2749e77:mailigen
X-Postmaster-MsgType: 530f49b6
List-id: 530f49b6
MIME-Version: 1.0
Content-Type: multipart/alternative;
    boundary="b1_e1109ce545fb7e40f309b1d7c9d2ef82"
X-Spam-Score: 118
X-Spam-Bar: +++++++++++
X-Spam-Report: Spam detection software, running on the system "server.myserver.com", has
    identified this incoming email as possible spam. The original message
    has been attached to this so you can view it (if it isn't spam) or label
    similar future email. If you have any questions, see
    the administrator of that system for details.
    Content preview: Мы выходим на финишную прямую подготовки
    нашей выставки CPS-2019 (Http://cps-expo.ru) (Http://cps-expo.ru),
    которая состоится ровно через две недели,
    27-29 марта на территории Киностудии "АМЕДИА".
    Программа на сайте обновлена практически
    полностью, подробности на подходе. Главное,
    не забудьте зарегистрироваться на сайте
    (http://cps-expo.ru) выставки уже сейчас. (http://discountfoto.ru/)
    [...] 
    Content analysis details: (11.8 points, 3.0 required)
    pts rule name description
    ---- ---------------------- --------------------------------------------------
    -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at https://www.dnswl.org/, no
    trust
    [80.233.244.44 listed in list.dnswl.org]
    0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked.
    See
    http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
    for more information.
    [URIs: cps-expo.ru]
    1.6 SUBJ_ALL_CAPS Subject is all capitals
    -0.4 RCVD_IN_IADB_LISTED RBL: Participates in the IADB system
    [80.233.244.44 listed in iadb.isipp.com]
    -0.2 RCVD_IN_IADB_RDNS RBL: IADB: Sender has reverse DNS record
    -0.0 RCVD_IN_IADB_DOPTIN_LT50 RBL: IADB: Confirmed opt-in used less than
    50% of the time
    -2.2 RCVD_IN_IADB_VOUCHED RBL: ISIPP IADB lists as vouched-for sender
    -0.0 RCVD_IN_IADB_SPF RBL: IADB: Sender publishes SPF record
    -0.0 RCVD_IN_IADB_SENDERID RBL: IADB: Sender publishes Sender ID record
    -0.2 RCVD_IN_IADB_DK RBL: IADB: Sender publishes Domain Keys record
    0.0 HTML_MESSAGE BODY: HTML included in message
    0.0 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars
    -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
    0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
    -1.0 MAILING_LIST_MULTI Multiple indicators imply a widely-seen list
    manager
    0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily
    7.0 RU_WENTOR_PHONE RU_WENTOR_PHONE
    7.0 RU_WENTOR_RASSILKA RU_WENTOR_RASSILKA
X-Spam-Status: Yes
X-ACL-Warn: SpamAssassin detected spam (from [email protected] to [email protected]).

Пример письма которое не считало:

Return-path: <[email protected]>
Envelope-to: [email protected]
Delivery-date: Wed, 13 Mar 2019 11:37:05 +0200
Received: from mail.intestell.co.ua ([176.9.103.48])
    by server.myserver.com with esmtp (Exim 4.91)
    (envelope-from <[email protected]>)
    id 1h40Jt-0005E0-5j
    for [email protected]; Wed, 13 Mar 2019 11:37:05 +0200
Received: from intestell.co.ua (unknown [195.216.190.7])
    by mail.intestell.co.ua (Postfix) with ESMTPA id 9D9892A01035;
    Wed, 13 Mar 2019 11:33:54 +0200 (EET)
Message-ID: <f1f001d4d990$a740d930$a247989c@ovvewcc>
From: "=?windows-1251?B?wS/OIMLl8O7t6OrgLiDO5OXx8erg/yDu4esu?=" <[email protected]>
To: <[email protected]>
Subject: =?windows-1251?B?1+XsIPDg7fz45SDy5ewg5OX45eLr5S4=?=
Date: Wed, 13 Mar 2019 11:34:00 +0200
MIME-Version: 1.0
Content-Type: multipart/related;
    type="multipart/alternative";
    boundary="----=_NextPart_000_0006_01D4D98F.AD0120B0"
X-MSMail-Priority: Normal
X-Mailer: Microsoft Windows Live Mail 14.0.8117.416
X-MimeOLE: Produced By Microsoft MimeOLE V14.0.8117.416

Затем сохраняю данное письмо в файл и через ssh запускаю проверку и показывает:

Mar 13 12:23:44.520 [23577] dbg: rules: compiled meta tests
Mar 13 12:23:44.521 [23577] dbg: check: is spam? score=14.94 required=3
Mar 13 12:23:44.521 [23577] dbg: check: tests=FROM_EXCESS_BASE64,HTML_IMAGE_ONLY_20,HTML_IMAGE_RATIO_02,HTML_MESSAGE,HTML_SHORT_LINK_IMG_3,RCVD_IN_DNSWL_NONE,RU_WENTOR_2GT,RU_WENTOR_PHONE,URIBL_BLOCKED
Mar 13 12:23:44.521 [23577] dbg: check: subtests=__ANY_IMAGE_ATTACH,__ANY_TEXT_ATTACH,__ANY_TEXT_ATTACH_DOC,__BODY_TEXT_LINE,__BODY_TEXT_LINE,__BODY_TEXT_LINE,__BODY_TEXT_LINE,__BODY_TEXT_LINE,__BODY_TEXT_LINE,__BODY_TEXT_LINE,__BODY_TEXT_LINE,__BODY_TEXT_LINE,__CT,__CTYPE_HAS_BOUNDARY,__CTYPE_MULTIPART_ALT,__CTYPE_MULTIPART_ANY,__DC_IMG_HTML_RATIO,__DC_IMG_TEXT_RATIO,__DKIM_DEPENDABLE,__DOS_HAS_ANY_URI,__DOS_RCVD_WED,__DOS_RELAYED_EXT,__ENV_AND_HDR_FROM_MATCH,__FB_NUM_PERCNT,__FROM_ENCODED_B64,__FROM_FULL_NAME,__HAS_ANY_EMAIL,__HAS_ANY_URI,__HAS_DATE,__HAS_FROM,__HAS_MESSAGE_ID,__HAS_MIMEOLE,__HAS_MSGID,__HAS_MSMAIL_PRI,__HAS_RCVD,__HAS_SUBJECT,__HAS_TO,__HAS_URI,__HAS_XMAIL,__HAS_X_MAILER,__HIGHBITS,__HTML_IMG_ONLY,__HTML_LENGTH_1536_2048,__HTML_LINK_IMAGE,__IMG_LE_300K,__JPEG_ATTACH,__JPEG_ATTACH_1,__LAST_EXTERNAL_RELAY_NO_AUTH,__LAST_UNTRUSTED_RELAY_NO_AUTH,__LCL__ENV_AND_HDR_FROM_MATCH,__LOCAL_PP_NONPPURL,__L_BODY_8BITS,__MIMEOLE_MS,__MIME_BASE64,__MIME_HTML,__MIME_QP,__MIME_VERSION,__MISSING_REF,__MISSING_REPLY,__MSGID_DOLLARS_MAYBE,__MSGID_DOLLARS_OK,__MSGID_NOFQDN2,__MSGID_OK_HEX,__MSGID_OK_HOST,__MSGID_RANDY,__NONEMPTY_BODY,__OE_MSGID_2,__ONE_IMG,__RCD_RDNS_MAIL,__RCD_RDNS_MAIL_MESSY,__RCVD_IN_DNSWL,__RP_MATCHES_RCVD,__RU_WENTOR_PHONE_KOI8,__RU_WENTOR_PHONE_UTF8,__RU_WENTOR_PHONE_WIN1251,__RU_WENTOR_RCPTS,__SANE_MSGID,__SA_RUS_HLINK,__SUBJECT_ENCODED_B64,__SUBJ_NOT_SHORT,__TAG_EXISTS_BODY,__TAG_EXISTS_HEAD,__TAG_EXISTS_HTML,__TAG_EXISTS_META,__TOCC_EXISTS,__TO___LOWER,__TVD_MIME_ATT_TP,__URI_MAILTO
Mar 13 12:23:44.522 [23577] dbg: timing: total 6466 ms - init: 4879 (75.5%), parse: 10 (0.2%), extract_message_metadata: 62 (1.0%), poll_dns_idle: 0.91 (0.0%), get_uri_detail_list: 2 (0.0%), tests_pri_-1000: 28 (0.4%), compile_gen: 553 (8.5%), compile_eval: 22 (0.3%), tests_pri_-950: 7 (0.1%), tests_pri_-900: 8 (0.1%), tests_pri_-90: 5 (0.1%), tests_pri_0: 1322 (20.4%), dkim_load_modules: 59 (0.9%), check_dkim_signature: 7 (0.1%), check_dkim_adsp: 4 (0.1%), check_spf: 1.51 (0.0%), tests_pri_10: 7 (0.1%), check_dcc: 0.61 (0.0%), tests_pri_20: 7 (0.1%), tests_pri_30: 6 (0.1%), check_pyzor: 0.29 (0.0%), tests_pri_500: 89 (1.4%), tests_pri_1000: 6 (0.1%)
Return-path: <[email protected]>
X-Spam-Report: 
        * -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at https://www.dnswl.org/, no
        *      trust
        *      [176.9.103.48 listed in list.dnswl.org]
        *  0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked.
        *       See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
        *      for more information.
        *      [URIs: veronika.in.ua]
        *  0.7 HTML_IMAGE_ONLY_20 BODY: HTML: images with 1600-2000 bytes of words
        *  0.8 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image area
        *  0.0 HTML_MESSAGE BODY: HTML included in message
        *  6.0 RU_WENTOR_2GT RAW: RU_WENTOR_2GT
        *  0.3 HTML_SHORT_LINK_IMG_3 HTML is very short with a linked image
        *  0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily
        *  7.0 RU_WENTOR_PHONE RU_WENTOR_PHONE
X-Spam-Flag: YES
X-Spam-Status: Yes, score=14.9 required=3.0 tests=FROM_EXCESS_BASE64,
        HTML_IMAGE_ONLY_20,HTML_IMAGE_RATIO_02,HTML_MESSAGE,HTML_SHORT_LINK_IMG_3,
        RCVD_IN_DNSWL_NONE,RU_WENTOR_2GT,RU_WENTOR_PHONE,URIBL_BLOCKED
        autolearn=disabled version=3.3.1
X-Spam-Level: **************
X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on server.myserver.com
Envelope-to: [email protected]
Delivery-date: Wed, 13 Mar 2019 11:37:05 +0200
Received: from mail.intestell.co.ua ([176.9.103.48])
        by server.myserver.com with esmtp (Exim 4.91)
        (envelope-from <[email protected]>)
        id 1h40Jt-0005E0-5j
        for [email protected]; Wed, 13 Mar 2019 11:37:05 +0200
Received: from intestell.co.ua (unknown [195.216.190.7])
        by mail.intestell.co.ua (Postfix) with ESMTPA id 9D9892A01035;
        Wed, 13 Mar 2019 11:33:54 +0200 (EET)
Message-ID: <f1f001d4d990$a740d930$a247989c@ovvewcc>
From: "=?windows-1251?B?wS/OIMLl8O7t6OrgLiDO5OXx8erg/yDu4esu?=" <[email protected]>
To: <[email protected]>
Subject: [SPAM] =?windows-1251?B?1+XsIPDg7fz45SDy5ewg5OX45eLr5S4=?=
Date: Wed, 13 Mar 2019 11:34:00 +0200
MIME-Version: 1.0
Content-Type: multipart/related;
        type="multipart/alternative";
        boundary="----=_NextPart_000_0006_01D4D98F.AD0120B0"
X-MSMail-Priority: Normal
X-Mailer: Microsoft Windows Live Mail 14.0.8117.416
X-MimeOLE: Produced By Microsoft MimeOLE V14.0.8117.416
X-Spam-Prev-Subject: =?windows-1251?B?1+XsIPDg7fz45SDy5ewg5OX45eLr5S4=?=

This is a multi-part message in MIME format.

------=_NextPart_000_0006_01D4D98F.AD0120B0
Content-Type: multipart/alternative;
        boundary="----=_NextPart_000_0007_01D4D98F.AD0120B0"

------=_NextPart_000_0007_01D4D98F.AD0120B0
Content-Type: text/plain;
        charset="windows-1251"
Content-Transfer-Encoding: quoted-printable

Исходя из всего этого, как я понимаю, правила настроены верно, но почему spamassasin не выставляет свои заголовки в каждое письмо? Явные же спам, даже сам понимает. Если нужны дополнительные логи – обязательно приведу.

1 ответ 1

0

Как оказалось, Spamassasin не проверяет по дефолту письма > 100К.

Решение: изменить сроку в exim

condition = ${if < {$message_size}{100K}}

Изменить на

condition = ${if < {$message_size}{100000K}}

Ваш ответ

Нажимая «Отправить ответ», вы соглашаетесь с условиями пользования и подтверждаете, что прочитали политику конфиденциальности.

Всё ещё ищете ответ? Посмотрите другие вопросы с метками или задайте свой вопрос.