ConfigServer Community Forum

Hi, I reported this on the cpanel forum as it was tied in with an exim issue I was having but they advised that I bring this over to your own forum for you guys to check out.

The emails I have been receiving from CSF (root access alert, high load alert etc..) are all going in to spam and when I look in to the header of the message, one of the high scoring spam markers is related to the content of the email.

One of them for example was an SSH root access alert, 7 lines in the body of the email (those 2 are blank lines), and the header said:
KAM_LINKBAIT Short messages containing little more than a link, from a domain with no security in place 2.0
So the email is being penalised for being too short.

On the alerts I get for high load:
HTML_MESSAGE BODY: HTML included in message 0.5
KAM_NUMSUBJECT Subject ends in numbers excluding current years 1.0
T_HTML_ATTACH HTML attachment to bypass scanning? 2.0
So there is another 3.5 points for the subject containing numbers, HTML attachments etc..

Is there any way these can be marked not to go to spam via the server rather than having to do something in the mail client?

Thanks.

You have 2 choices:
- in MailScanner learn that email as HAM.
- You can create your own spamassassin rule with a negative score.

In my servers I have a file called whitelist.cf and I add in there rules for emails that behaves like the one you are telling; on doing this, the emails will not go to spam.

do you setup your spf and damrc record? some mail software will ban email without spf and dmarc records

Sergio - Thanks, will take a look at the spamassassin settings/rules.

Pepsi - Yes SPF and DMARC are set up correctly, as I said in my post the email is getting points towards being spam for the content of the email and the subject line, which are generated within CSF, these aren't anything to do with the mail/server config.

If you need help creating the spamassassin rule, paste (changing all sensitive info) the header and body of the email that was blocked.
To do that, go to MailScanner FE Control and enter into the "View/Status" of the email that was blocked.

But your problem by SpamAssassin not csf

try whitelist your email inside spamassassin (low SpamAssassin score):
https://www.lifewire.com/spamassassin-w ... er-1166251