Local user marked as spammer

bittus · 10-28-2009, 09:29 PM

I am running postfix + amavis + clamav + spamassassin on my mail server. Today I got a complaint from my director asking why a mail sent from one of our employees was marked spam when he received it. I found my log files as :

Quote:

Oct 28 15:11:08 MYHOST amavis[11669]: (11669-14) ESMTP::10024 /var/amavis/tmp/amavis-20091028T144544-11669: <employee@MYDOMAIN.com> -> <director@MYDOMAIN.com> SIZE=2601 Received: from MYHOST.MYDOMAIN.com ([127.0.0.1]) by localhost (MYHOST.MYDOMAIN.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP for <director@MYDOMAIN.com>; Wed, 28 Oct 2009 15:11:08 -0700 (PDT)
Oct 28 15:11:08 MYHOST amavis[11669]: (11669-14) Checking: JrDsEXHnufSo <employee@MYDOMAIN.com> -> <director@MYDOMAIN.com>
Oct 28 15:11:14 MYHOST amavis[11669]: (11669-14) SPAM-TAG, <employee@MYDOMAIN.com> -> <director@MYDOMAIN.com>, Yes, score=3.582 tagged_above=-999 required=3 tests=[AWL=-1.067, BAYES_00=-2.599, DATE_IN_FUTURE_06_12=1.897, FORGED_MUA_OUTLOOK=3.116, RDNS_NONE=0.1, STOX_REPLY_TYPE=0.001, TVD_FINGER_02=2.134]
Oct 28 15:11:14 MYHOST amavis[11669]: (11669-14) FWD via SMTP: <employee@MYDOMAIN.com> -> <director@MYDOMAIN.com>,BODY=7BIT 250 2.6.0 Ok, id=11669-14, from MTA([127.0.0.1]:10025): 250 2.0.0 Ok: queued as 8190AF78273
Oct 28 15:11:14 MYHOST amavis[11669]: (11669-14) Passed SPAMMY, [aa.bb.cc.dd] <employee@MYDOMAIN.com> -> <director@MYDOMAIN.com>, Message-ID: <6C035AF581F0485A97C2FC1AD1A2F03A@Simi>, mail_id: JrDsEXHnufSo, Hits: 3.582, size: 2601, queued_as: 8190AF78273, 5842 ms

I don't get a clear idea of the logs. Can someone explain why this happened and how can I avoid this to happen in future?

Thanks.

bittus · 10-28-2009, 10:25 PM

Another thing i found :

If the mail is sent from outlook through our corporate network, it is marked as spam. But a mail sent thru the webmail (we use squrrelmail), it comes without any spam flag !!!!

bittus · 11-10-2009, 12:15 AM

Is there anyway to add my corporate network as trusted in spamassassin, so that it will not flag my local users as spam ?

bathory · 11-10-2009, 12:26 AM

You can add in local.cf

Code:

trusted_networks 192.168.0.0/24

or whatever your LAN ip range is.

Regards