[SOLVED]Sorting order/decision "Mark as Spam" by different filters

For any other discussion relating to MailEnable.
Post Reply
poweredge
Posts: 99
Joined: Sat May 29, 2021 11:16 am

[SOLVED]Sorting order/decision "Mark as Spam" by different filters

Post by poweredge » Thu Jun 17, 2021 4:47 am

Question regarding the sorting order/decision "Mark as Spam" in header

I've seen 4 different headers so far. (X-RBL-Result/X-ME-Bayesian/X-ME-Spam)

X-RBL-Result: Generic, Fail (Result) <This is the failed RBL/URL
X-ME-Bayesian: 1.469720 (Result) <This WILL NOT trigger Mark as Spam right? As it will only be one of the factor counted in overall spam score (ie, below)
X-ME-Spam: High (1005) (Result) <This is the overall spam score, (in MTAFilter log [System Spam Filter] ADD_HEADER) but do we still have to create a filter in order to Mark as Spam for High Score?

X-ME-Content: Deliver-To=Junk (This is "Mark as Spam" header) (Could be marked by RBL/Total Score/Spamassassin, but which one?)

Does it mean if a message failed any of the above 3, it will be marked as Spam? or any of the two, or there is a precedence order for X-RBL-Result>X-ME-Spam>Spamassassin (Mark as Spam)?

Thanks.
Last edited by poweredge on Thu Jun 24, 2021 3:18 pm, edited 1 time in total.

MailEnable-Ian
Site Admin
Posts: 9483
Joined: Mon Mar 22, 2004 4:44 am
Location: Melbourne, Victoria, Australia

Re: Sorting order/decision "Mark as Spam" by different filters

Post by MailEnable-Ian » Thu Jun 17, 2021 6:52 am

Hi,

Please review: https://www.mailenable.com/kb/content/article.asp?ID=ME020529

The only way the X-ME-Content: Deliver-To=Junk header is added to a message is via a message content filter you create that actions with the "Mark as Spam" header or via the SMTP Reverese DNS/URL blacklisting action. The spam protection script scores will not add any mark as spam headers. The spam protection script scores will only actioned by the mailbox spam rules set in web mail.

Please see:

https://www.mailenable.com/kb/content/article.asp?ID=ME020391
https://www.mailenable.com/kb/content/article.asp?ID=ME020586

The Bayesian filter scores are used by the spam protection script weighting or can be used to create message content filters for spam probability. It will not add mark as spam headers.
Regards,

Ian Margarone
MailEnable Support

poweredge
Posts: 99
Joined: Sat May 29, 2021 11:16 am

Re: Sorting order/decision "Mark as Spam" by different filters

Post by poweredge » Fri Jun 18, 2021 6:52 am

Many thanks for your reply again, Ian! Really appreciated!

I've read ME020529 and many other documents and forum posts, and had a much better understanding what triggered spam mail to Junk folder.
The only way the X-ME-Content: Deliver-To=Junk header is added to a message is via a message content filter you create that actions with the "Mark as Spam" header or via the SMTP Reverese DNS/URL blacklisting action.
This is so important, I shall always remember this Rule #1!

Question 1. Btw, I still have this confusion, I see "Fails SpamAssassin > Always marked as spam" in Spam protection weighting page, as I thought everything in this panel will be just used to calculate the total spam score instead of taking any action (ie, it does not mean mark as spam>Junk folder). That's why I created such global filter called "SpamAssassin" to deliver marked as spam to junk mail.

My question is am I doing the right thing or is my customized filter "SpamAssassin" redundant?
2.jpg
2.jpg (207.74 KiB) Viewed 2225 times
1.jpg
1.jpg (231.91 KiB) Viewed 2225 times
If I remove it, my guess is the "Fails SpamAssassin > Always marked as spam" will NOT actually move the spam mail to junk as "Fails SpamAssassin Always marked as spam" is just used to calculate the spam total score, for any action, we still have to create the >Mark as Spam (hence>Junk folder) action in global filter.

Question 2. I still couldn't find information regarding the precedence / order of which filter actually took in action move the email to Junk box.

Say if the email failed RBL, also failed my customized "SpamAssassin", and finally scored a High in spam score for example High (1040).

For example, there are 5 headers added by ME below

X-RBL-Result: Generic, Fail
X-PTR-Result: Generic, Fail
X-ME-Bayesian: 0.446927
X-ME-Spam: High (1040)
X-ME-Content: Deliver-To=Junk

==========================
From SMTP Debug loog
06/18/21 12:50:25 ME-E0113: [1772] Message marked as spam: (114.237.154.45) was found in DNSBL Barracuda Reputation Block List.
06/18/21 12:50:25 ME-E0114: [1772] Recipient Denied: (114.237.154.45) has no PTR. Result 9003.

From MTA Filter log
06/18/21 12:50:31 Executed 550AF0225E784CC9B2AB77C750BCDA8B.MAI SMTP [System Spam Filter] ADD_HEADER [SMTP:opnxmrl@znym.com] 114.237.154.45 High (1040) =?utf-8?B?UmXvvJog57K+5a+G6Z2e5qCH6Zu26YOo5Lu25a6a5Yi25Yqg5bel?=
06/18/21 12:50:31 Executed 550AF0225E784CC9B2AB77C750BCDA8B.MAI SMTP SpamAssassin ADD_HEADER [SMTP:opnxmrl@znym.com] 114.237.154.45 CRITERIA=SPAMASSASSIN, DATA=<PASS>1</PASS> =?utf-8?B?UmXvvJog57K+5a+G6Z2e5qCH6Zu26YOo5Lu25a6a5Yi25Yqg5bel?=
==========================

I believe the ONLY thing triggered it to junk folder is "X-RBL-Result: Generic, Fail", all the rest three header X-PTR-Result/X-ME-Bayesian/X-ME-Spam DO NOT put spam mail into junk box and they are just information, we can use these information to create domain/postoffice/mailbox filter and Mark as Spam > Junk folder.

However, there is one confusion, Since Mark as Spam happened on both RBL blacklist and my customized SpamAssassin filter, so which one actually move it to Junk mail folder at the end? what's the order? RBL comes before customized global filter?

Am I correct on this?


Question 3. Finally, somehow I do have a feeling now that the total spam score (X-ME-Spam: High (1040)) in the header DOES NOT take any action, meaning it will be only useful if we allow users to change the spam protection level in webmail option. and select the action according to Low/Medium and High. Otherwise, it just a tag showing the spam score, but do not move the spam to junk.

Am I correct on this?

Question 4. Is there any way to setup filter on the X-ME-Spam tag?

If header contains "*X-ME-Spam: High*", Then mark as Spam, is this correct?


Please kindly let me know, many thanks again in advance.

poweredge
Posts: 99
Joined: Sat May 29, 2021 11:16 am

Re: Sorting order/decision "Mark as Spam" by different filters

Post by poweredge » Wed Jun 23, 2021 2:47 am

Could you kindly help please? Thanks.

MailEnable-Ian
Site Admin
Posts: 9483
Joined: Mon Mar 22, 2004 4:44 am
Location: Melbourne, Victoria, Australia

Re: Sorting order/decision "Mark as Spam" by different filters

Post by MailEnable-Ian » Thu Jun 24, 2021 2:50 am

Hi,
Question 1. Btw, I still have this confusion, I see "Fails SpamAssassin > Always marked as spam" in Spam protection weighting page, as I thought everything in this panel will be just used to calculate the total spam score instead of taking any action (ie, it does not mean mark as spam>Junk folder). That's why I created such global filter called "SpamAssassin" to deliver marked as spam to junk mail.

My question is am I doing the right thing or is my customized filter "SpamAssassin" redundant?

If I remove it, my guess is the "Fails SpamAssassin > Always marked as spam" will NOT actually move the spam mail to junk as "Fails SpamAssassin Always marked as spam" is just used to calculate the spam total score, for any action, we still have to create the >Mark as Spam (hence>Junk folder) action in global filter.
The "Fails SpamAssassin" is juts used as a 100% positive weighting towards spam and thus we just represented this with "Always marked as spam". It will not add any headers. The "Spam Protection" will not add any headers for moving junk at any time. It only adds spam scores to the message headers.
Question 2. I still couldn't find information regarding the precedence / order of which filter actually took in action move the email to Junk box.

Say if the email failed RBL, also failed my customized "SpamAssassin", and finally scored a High in spam score for example High (1040).

For example, there are 5 headers added by ME below

X-RBL-Result: Generic, Fail
X-PTR-Result: Generic, Fail
X-ME-Bayesian: 0.446927
X-ME-Spam: High (1040)
X-ME-Content: Deliver-To=Junk

==========================
From SMTP Debug loog
06/18/21 12:50:25 ME-E0113: [1772] Message marked as spam: (114.237.154.45) was found in DNSBL Barracuda Reputation Block List.
06/18/21 12:50:25 ME-E0114: [1772] Recipient Denied: (114.237.154.45) has no PTR. Result 9003.

From MTA Filter log
06/18/21 12:50:31 Executed 550AF0225E784CC9B2AB77C750BCDA8B.MAI SMTP [System Spam Filter] ADD_HEADER [SMTP:opnxmrl@znym.com] 114.237.154.45 High (1040) =?utf-8?B?UmXvvJog57K+5a+G6Z2e5qCH6Zu26YOo5Lu25a6a5Yi25Yqg5bel?=
06/18/21 12:50:31 Executed 550AF0225E784CC9B2AB77C750BCDA8B.MAI SMTP SpamAssassin ADD_HEADER [SMTP:opnxmrl@znym.com] 114.237.154.45 CRITERIA=SPAMASSASSIN, DATA=<PASS>1</PASS> =?utf-8?B?UmXvvJog57K+5a+G6Z2e5qCH6Zu26YOo5Lu25a6a5Yi25Yqg5bel?=
==========================

I believe the ONLY thing triggered it to junk folder is "X-RBL-Result: Generic, Fail", all the rest three header X-PTR-Result/X-ME-Bayesian/X-ME-Spam DO NOT put spam mail into junk box and they are just information, we can use these information to create domain/postoffice/mailbox filter and Mark as Spam > Junk folder.

However, there is one confusion, Since Mark as Spam happened on both RBL blacklist and my customized SpamAssassin filter, so which one actually move it to Junk mail folder at the end? what's the order? RBL comes before customized global filter?

Am I correct on this?
The SMTP level Reverse DNS Blacklisting "Mark as spam" will be the first filter that will add the deliver to junk header as the check is performed at the SMTP when the message is being received by the remote mail server. You can see this in your log snippet:

Code: Select all

06/18/21 12:50:25 ME-E0113: [1772] Message marked as spam: (114.237.154.45) was found in DNSBL Barracuda Reputation Block List.
If the message is not found to be in a blacklist at the SMTP level and a global filter is triggered and actions with mark as spam then this will be the filter that adds the deliver to junk header. The header can only be added once.
Question 3. Finally, somehow I do have a feeling now that the total spam score (X-ME-Spam: High (1040)) in the header DOES NOT take any action, meaning it will be only useful if we allow users to change the spam protection level in webmail option. and select the action according to Low/Medium and High. Otherwise, it just a tag showing the spam score, but do not move the spam to junk.

Am I correct on this?
Yes you can only action on the scores by configuring the spam rules in the web mail client.
Question 4. Is there any way to setup filter on the X-ME-Spam tag?

If header contains "*X-ME-Spam: High*", Then mark as Spam, is this correct?
Set them up at the postoffice level
Regards,

Ian Margarone
MailEnable Support

poweredge
Posts: 99
Joined: Sat May 29, 2021 11:16 am

Re: Sorting order/decision "Mark as Spam" by different filters

Post by poweredge » Thu Jun 24, 2021 3:18 pm

Many thanks Ian for helping me.
Yes you can only action on the scores by configuring the spam rules in the web mail client.
I followed your instruction in another post, and created a Postoffice level filter specifically for this score purpose, hopefully it will work this time.
The "Fails SpamAssassin" is juts used as a 100% positive weighting towards spam
I would strongly suggest to change it to 100, as Marks as Spam will confuse many with the actual "Marks as Spam" such as in RBL DNS Blacklist drop down action.

Post Reply