Issue E-Mail Problem (Spam)

[JogoVogo]

Server operating system version

CentOS Linux 7.9.2009 (Core)

Plesk version and microupdate number

Plesk Obsidian v18.0.48_build1800221104.03 os_CentOS 7

Hi all, somehow it looks like the emails are coming from 127.0.0.1.

They are not php-mails but e-mails from outside.
But this is spam and will be delivered...

X-Spam-Level:
Mime-Version: 1.0
Content-Type: multipart/alternative; boundary="171bc3796d983a8397dc032ad79bc92fd"
X-Spam-Status: No, score=-1.647 tagged_above=-9999 required=3 tests=[BAYES_00=-1.9, HEADER_FROM_DIFFERENT_DOMAINS=0.25, HTML_IMAGE_RATIO_02=0.001, HTML_MESSAGE=0.001, KHOP_HELO_FCRDNS=0.001] autolearn=no autolearn_force=no
X-Spam-Score: -1.647
Return-Path: <www-data@managergram.com>
X-Spam-Flag: NO
Content-Transfer-Encoding: 8bit
X-Original-To: info@xyz123.de
<6365a94370dbce1c71cc3e35e5baad20@altern.com>
Received: from sunstar.xyz123.de (localhost.localdomain [127.0.0.1]) by mail.xyz123.de (Postfix) with ESMTP id CAE11401E065C for <info@xyz123.de>; Mon, 19 Dec 2022 16:10:37 +0100 (CET)
Received: from mail.xyz123.de ([127.0.0.1]) by sunstar.xyz123.de (sunstar.xyz123.de [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 33p_8GJuPbfE for <info@xyz123.de>; Mon, 19 Dec 2022 16:10:35 +0100 (CET)
Received: from managergram.com (vm4115374.25ssd.had.wf [80.89.228.164]) by mail.xyz123.de (Postfix) with ESMTPS id 1894E403030A3 for <info@xyz123.de>; Mon, 19 Dec 2022 16:10:31 +0100 (CET)
Received: by managergram.com (Postfix, from userid 33) id 13D642485A; Mon, 19 Dec 2022 17:09:43 +0200 (EET)
Delivered-To: info@xyz123.de


Similar or same problem;

Issue - SPF useless when Plesk Email Security installed?

I have SPF active on my Plesk installation and addesd the free Version of Plesk email Security. Since then the header of ALL emails say: "Received-Spf: pass (XXXXX.de: localhost is always allowed.) client-ip=127.0.0.1; envelope-from=newcclasse@t-online.de; helo=XXXXX.de;" When I look further...

talk.plesk.com

regards,
ron

 

[GwenDragon]

Your Anavis mail scanner (127.0.0.1) does not send you spam.
It is a external IP: 80.89.228.164
Relevant line is
Received: from managergram.com (vm4115374.25ssd.had.wf [80.89.228.164]) by mail.xyz123.de (Postfix) with ESMTPS id 1894E403030A3 for <[EMAIL]info@xyz123.de[/EMAIL]>; Mon, 19 Dec 2022 16:10:31 +0100 (CET)

 

[JogoVogo]

Hi, thanks for your reply that may be, but, It always comes through spam, and massive.

See here, also it does not seem to learn itself...

Domainkey-Signature: a=rsa-sha1; q=dns; c=simple; s=key1; d=minkolinges.radio.am; h=Message-ID:From:To:Subjectate:MIME-Version:Content-Type; b=RdiY4DQvpNIbwFxBCp/3BEFAErgbmdqushOb2mizCVJj3nVR8y5UCTAnvTFtJvs3OEicQ8l/XWHjxhHeW/Qd6clW5cmnm+AmpflDIDh3C1jNIp+66P6w4aumsAVzAVzi3lWiPzU6Ue/HUA8Iv7Ny2xfIMy6f6K8A5ndpTPq5kso=;
X-Spam-Level:
Mime-Version: 1.0
Content-Type: multipart/related; type="multipart/alternative"; boundary="----=_NextPart_000_000F_01D913D5.8E5FB8E0"
X-Spam-Status: No, score=-1.987 tagged_above=-9999 required=1 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_32=0.001, HTML_IMAGE_RATIO_08=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_TVD_MIME_EPI=0.01] autolearn=ham autolearn_force=no
Dkim-Signature: v=1; a=rsa-sha256; c=simple; d=minkolinges.radio.am; s=key2; h=DomainKey-Signature:Message-ID: From:To:Subjectate:MIME-Version:Content-Type; bh=BePI7jZT2AD08 YA328AcH+tSIpmpQ5cbiBR3J9+lfWs=; b=OCMfP17bXIKGLST7WQ0PCCiGPbfnE +VDqYmB3xWwhNSixQt5XV0T3qtnM6Gbjyjlog6hJ1zpy7JYTsy3aeswXhePTEjuV Ph29WCR1QEdLMJNSbIP1cmomk7pFJ1BlC5PzgctsZQCoTGRah0oi13mLzrvLogVj E8pATD9fYccqy0=
X-Spam-Score: -1.987
Return-Path: <ehrafpl@minkolinges.radio.am>
X-Spam-Flag: NO
X-Original-To: info@xyz123.de
Received: from sunstar.xyz123.de (localhost.localdomain [127.0.0.1]) by mail.xyz123.de (Postfix) with ESMTP id CEF104096B67B for <info@xyz123.de>; Mon, 19 Dec 2022 17:41:52 +0100 (CET)
Received: from mail.xyz123.de ([127.0.0.1]) by sunstar.xyz123.de (sunstar.xyz123.de [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Di0D_tHM80nj for <info@xyz123.de>; Mon, 19 Dec 2022 17:41:51 +0100 (CET)
Received: from mail.minkolinges.radio.am (mail.minkolinges.radio.am [193.3.23.33]) by mail.xyz123.de (Postfix) with ESMTP id 5A14C401E067F for <info@xyz123.de>; Mon, 19 Dec 2022 17:41:49 +0100 (CET)
Received: from minkolinges.radio.am (229004-5.vm.clodoserver.ru [62.76.188.81]) by mail.minkolinges.radio.am (Postfix) with ESMTPA id 7B00E3015B2; Mon, 19 Dec 2022 18:23:11 +0200 (EET)
<2163043574550578786201345615535732727540@minkolinges.radio.am>
Delivered-To: info@xyz123.de
Authentication-Results: sunstar.xyz123.de; dkim=pass header.d=minkolinges.radio.am
Authentication-Results: sunstar.xyz123.de (amavisd-new); dkim=pass (1024-bit key) header.d=minkolinges.radio.am; domainkeys=pass (1024-bit key) header.from=ehrafpl@minkolinges.radio.am header.d=minkolinges.radio.am

 

[Kaspar]

The SpamAssasin 'learing' ability is overrated. It needs a rather large sample size and does a mediocre job at any language other then English.

My honest advice would be to ditch Plesk Email Security and use Warden Anti-spam and Virus Protection instead. You'll have a much beter experience.

 

[GwenDragon]

@JogoVogo Move Spam to your IMAP Spam folder instead of deleting, and next morning Spamassassin can learn.
SpamA needs some amount of mail to learn which mail is Spam and which Ham.

 

[JogoVogo]

Plesk's spam protection used to work really well.

somehow it doesn't work at all at the moment no matter if with the free or purchased version

the only thing that really brought something was Magic Spam.