Question Incoming mail is stored in Junk folder

[EnriqueR]

Server operating system version

Ubuntu 24.04.1 LTS

Plesk version and microupdate number

18.0.66 #2

I have 2 emails on my Plesk server from 2 different domains. When I send a message from user@domain1.com to user@domain2.com, the message is stored in the Junk folder.

I have tried sending messages from another email account type user2@domain1.com to the same recipient user@domain2.com, and the messages are saved correctly in INBOX. Only messages from user@domain1.com are automatically saved in the Junk folder.

I have tried disabling DMARC verification by adding the domain domain1.com to the /etc/psa/dmarc.conf file, but it still doesn't work.
I have tried sending the message from Roundcube and from Thunderbird, but they still end up in the Junk folder.

The SpamAssassin service is disabled for this email, it has no filtering rules, and the server not have Plesk Antivirus installed.

The truth is that it is very strange and I am desperate, I don't know what could be happening. Please, if you can help me solve the problem, I would be very grateful.

Header of the message that arrives at the user@domain2.com email

Return-Path: <user@domain1.com>
X-Original-To: user@domain2.com
Delivered-To: user@domain2.com
Received: from webmail.domain1.com (localhost.localdomain [IPv6:::1])
by servidor.qserviciosinternet.es (Postfix) with ESMTPSA id E7013C5912
for <user@domain2.com>; Tue, 21 Jan 2025 13:16:25 +0100 (CET)
Authentication-Results: servidor.qserviciosinternet.es;
dmarc=pass (p=QUARANTINE sp=NONE) smtp.from=domain1.com header.from=domain1.com;
spf=pass (sender IP is ::1) smtp.mailfrom=user@domain1.com smtp.helo=webmail.domain1.com
Received-SPF: pass (servidor.qserviciosinternet.es: connection is authenticated)
MIME-Version: 1.0
Date: Tue, 21 Jan 2025 13:16:25 +0100
From: user@domain1.com
To: user <user@domain2.com>
Subject: Asunto
Message-ID: <b32ab487592ce9e318123cf9b2fe53da@domain1.com>
X-Sender: user@domain1.com
Content-Type: text/plain; charset=US-ASCII;
format=flowed
Content-Transfer-Encoding: 7bit
X-PPP-Message-ID:
<173746178611.2139549.12358503014807937545@servidor.qserviciosinternet.es>
X-PPP-Vhost: domain1.com

Message

maillog entry

Jan 21 12:52:40 servidor postfix/smtpd[2130655]: connect from localhost.localdomain[::1]
Jan 21 12:52:40 servidor postfix/smtpd[2130655]: TLS SNI localhost from localhost.localdomain[::1] not matched, using default chain
Jan 21 12:52:41 servidor postfix/smtpd[2130655]: 09C7BC3082: client=localhost.localdomain[::1], sasl_method=PLAIN, sasl_username=user@domain1.com
Jan 21 12:52:41 servidor psa-pc-remote[299613]: 09C7BC3082: from=<user@domain1.com> to=<user@domain2.com>
Jan 21 12:52:41 servidor postfix/cleanup[2126503]: 09C7BC3082: message-id=<abc0042d12b163986397d6ce67959cd8@domain1.com>
Jan 21 12:52:41 servidor psa-pc-remote[299613]: 09C7BC3082: py-limit-out: stderr: INFO:__main__:Setting 'X-PPP-Vhost' header to 'domain1.com'
Jan 21 12:52:41 servidor psa-pc-remote[299613]: 09C7BC3082: py-limit-out: stderr: PASS
Jan 21 12:52:41 servidor psa-pc-remote[299613]: 09C7BC3082: spf: stderr: PASS
Jan 21 12:52:41 servidor psa-pc-remote[299613]: 09C7BC3082: check-quota: stderr: SKIP
Jan 21 12:52:41 servidor postfix/qmgr[301326]: 09C7BC3082: from=<user@domain1.com>, size=630, nrcpt=1 (queue active)
Jan 21 12:52:41 servidor postfix/smtpd[2130655]: disconnect from localhost.localdomain[::1] ehlo=1 auth=1 mail=1 rcpt=1 data=1 quit=1 commands=6
Jan 21 12:52:41 servidor postfix-local[2130688]: 09C7BC3082: from=<user@domain1.com>, to=<user@domain2.com>, dirname=/var/qmail/mailnames
Jan 21 12:52:41 servidor dk_check[2130690]: 09C7BC3082: DKIM Feed: No signature
Jan 21 12:52:41 servidor postfix-local[2130688]: 09C7BC3082: dk_check: stderr: PASS
Jan 21 12:52:41 servidor dovecot: imap-login: Login: user=<user@domain1.com>, method=PLAIN, rip=::1, lip=::1, mpid=2130692, TLS, session=<K4qlAzYs4rgAAAAAAAAAAAAAAAAAAAAB>
Jan 21 12:52:41 servidor postfix-local[2130688]: 09C7BC3082: dmarc: stderr: PASS
Jan 21 12:52:41 servidor dovecot: service=imap, user=user@domain1.com, ip=[::1]. Disconnected: Logged out rcvd=487, sent=750
Jan 21 12:52:41 servidor dovecot: service=lda, user=user@domain2.com, ip=[]. sieve: msgid=<abc0042d12b163986397d6ce67959cd8@domain1.com>: stored mail into mailbox 'INBOX'
Jan 21 12:52:41 servidor postfix/pipe[2129944]: 09C7BC3082: to=<user@domain2.com>, relay=plesk_virtual, delay=0.3, delays=0.25/0/0/0.05, dsn=2.0.0, status=sent (delivered via plesk_virtual service)
Jan 21 12:52:41 servidor postfix/qmgr[301326]: 09C7BC3082: removed

 

[Kaspar]

The maillog entry below shows that up on receiving the email, the dovecot stores the message in the INBOX folder.

Jan 21 12:52:41 servidor dovecot: service=lda, user=user@domain2.com, ip=[]. sieve: msgid=<abc0042d12b163986397d6ce67959cd8@domain1.com>: stored mail into mailbox 'INBOX'

Somehow it gets moved to the junk folder afterwards. Maybe there is an mailbox filter rule in webmail which moves the messages? Or maybe there is a mailbox filter in an email client (like Outlook, Thunderbird or on your smartphone) which moves the email message to the junk folder?

 

[EnriqueR]

Webmail does not have any filter applied. Is there any way to know if a client moves the message via IMAP as soon as it arrives to the Junk folder?

I've tried sending a message and instantly checking the /var/qmail/mailnames/domain2.com/user/Maildir/new folder to see if it ever gets stored there, but it doesn't show up, it shows up in the Junk folder.

 

[Kaspar]

Is there any way to know if a client moves the message via IMAP as soon as it arrives to the Junk folder?

You can configure Dovecot to log all IMAP activity. But this can be a bit tedious te achieve. Some more info on how to achieve this can be found here:

Dovecot - Log All IMAP Commands

I have Dovecot 2.2.27 running successfully on Debian Stretch. I have some suspicious activity on my server and I want to log ALL raw IMAP communications sent/received by my server. Here is a .conf ...

serverfault.com

Instead, it might be easier to just change the password of the receiving mailbox. That way any current configured email client won't be able to access the mailbox. If after changing the password the email message is still moved to the junk folder, you can pretty much rule out that this is caused by any email client.

 

[EnriqueR]

I changed the password for the user@domain2.com email and emails from user@domain1.com are still arriving in the Junk folder.
I have checked the filtering rules again and there are none. Attached screenshot.

Are there any other filter rules that cannot be reviewed from Roundcube Webmail?

 

[Kaspar]

Look trough the Sieve filter files at /var/qmail/mailnames/example.com/info/sieve and at /etc/dovecot/conf.d/ to see if they contain any code that may move your message. If that does not bear any fruit you could enable debug logging for Dovecot, maybe that will give you some clues on whats causes the messages to move to your spam folder.

Lastly, what you could try, at your own risk, is to switch to Courier and then back to Dovecot again. This would re-initiate the Dovecot configuration. However I would advice against doing this if you have a large number of email users on your server. As all email messages have to be downloaded again by email clients (Apple mail, Outlook, Thunderbird, ect) after each switch. But if you just have a couple of mailboxes for your own use you could try switching. In any case make sure to make a backup of your server in case things get sour.

 

[EnriqueR]

Thank you very much for the reply. In the end I started testing by making some changes to the postfix configuration and to my surprise I saw that when I restarted the service to take the new configuration, it ignored me, ignoring the changes.

I proceeded to restart the server and sent another test message to user@domain1.com to user@domain2.com and to my surprise, it appeared in the inbox. It's as if the postfix service had been blocked for some reason. A restart solved the problem, what a thing.