Mail from Outside our Domain not Stored

[Shawn Iverson]

I do see a subtle clue...

1)  The "X-Spam-Status: No" is actually not present.

"X-Spam-Flag: NO" is actually coming from amavisd-new on the next hop (the
Zimbra mail server itself, I think) and hence why it is so far up in the
Received chain.

2) Becuase X-Spam-Status is not there, the Non Spam Actions appears to have
been ignored for some reason.

At this point, we are going to need a maillog of an inbound message that
fails to get quarantined, along with a maillog of an outbound message that
is being quarantined for further clues.




On Wed, Jun 12, 2019 at 2:08 PM Lamar Milligan via MailScanner <
mailscanner at lists.mailscanner.info> wrote:

> > -----Original Message-----
> > From: MailScanner <mailscanner-
> > bounces+lmilligan=co.walton.ga.us at lists.mailscanner.info> On Behalf Of
> > Antony Stone
> > Sent: Wednesday, June 12, 2019 11:00 AM
> > To: MailScanner Discussion <mailscanner at lists.mailscanner.info>
> > Subject: Re: Mail from Outside our Domain not Stored
> >
> > On Wednesday 12 June 2019 at 15:07:19, Lamar Milligan via MailScanner
> > wrote:
> >
> > > > -----Original Message-----
> > > > From: Antony Stone
> > > > Sent: Wednesday, June 12, 2019 8:58 AM
> > > > To: MailScanner Discussion <mailscanner at lists.mailscanner.info>
> > > > Subject: Re: Mail from Outside our Domain not Stored
> > > >
> > > > Could you perhaps paste the full headers of this reply to you, as
> > > > you receive it from the list, so we can see the flow you describe?
> >
> > Well, these certainly prove that your inbound mail is going via
> MailScanner:
> >
> > > Received: from mail.co.walton.ga.us (mail.co.walton.ga.us
> [192.168.40.2])
> > >     by zimbra1.co.walton.ga.us (Postfix) with ESMTPS id 203C9E17E0
> > >     for <lmilligan at zimbra1.co.walton.ga.us>; Wed, 12 Jun 2019 08:58:19
> > > -0400 (EDT)
> > > X-WaltonCountyITDept-sendmail-Watermark:
> > > 1560949091.80167 at FJ8m24fBRzhG94806ypJvw
> > > X-WaltonCountyITDept-MailScanner-From:
> > > mailscanner-bounces+lmilligan=co.walton.ga.us at lists.mailscanner.info
> > > X-WaltonCountyITDept-MailScanner-SpamCheck: not spam,
> > >     SpamAssassin (not cached, score=-10.15, required 5,
> > >     autolearn=not spam, BAYES_00 -1.90, DKIM_SIGNED 0.10,
> > >     DKIM_VALID -0.10, HEADER_FROM_DIFFERENT_DOMAINS 0.25,
> > >     MAILING_LIST_MULTI -1.00, SPF_HELO_NONE 0.00, SPF_PASS -0.00,
> > >     USER_IN_DEF_SPF_WL -7.50)
> > > X-WaltonCountyITDept-MailScanner: Found to be clean
> > > X-WaltonCountyITDept-MailScanner-ID: x5CCwAt3017923
> > > X-WaltonCountyITDept-MailScanner-Information: Please contact the ISP
> > > for more information
> > > Received: from ms1.mailscanner.info (ms1.mailscanner.info
> [52.73.170.51])
> > >     by mail.co.walton.ga.us (8.14.4/8.14.4) with ESMTP id
> > > x5CCwAt3017923
> > >     (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384
> > bits=256
> > > verify=NO)
> > >     for <lmilligan at co.walton.ga.us>; Wed, 12 Jun 2019 08:58:10 -0400
> >
> > So, we're back to wondering why your MS configuration is causing inbound
> > emails to be scanned but not stored...
> >
> > You've already said that you have:
> >
> > Spam Actions = store header "X-Spam-Status: Yes"
> > High Scoring Spam Actions = store header "X-Spam-Status: Oh Yes"
> > Non Spam Actions = store deliver header "X-Spam-Status: No"
> >
> > The only bit that puzzles me about this (and hopefully someone else can
> > comment if I'm completely wrong about this) is the positioning of the
> "X-
> > Spam- Status" header in your received email - it comes *above* the
> > Received header showing the mail passing from MailScanner to Zimbra,
> > whereas I would have expected to see it amongst the "X-
> > WaltonCountyITDept-MailScanner..." headers.
> >
> > But anyway, it's clear that MS is scanning the mail - maybe you could
> post the
> > remainder of your mailscanner.conf (omit comments and blank lines) so we
> > can see if there's something odd there?
> >
> >
> > Antony.
> >
>
> I have attached the config file you requested.  Thanks again for your help
> with this,
>
> Lamar
>
> > --
> > "Life is just a lot better if you feel you're having 10 [small] wins a
> day rather
> > than a [big] win every 10 years or so."
> >
> >  - Chris Hadfield, former skiing (and ski racing) instructor
> >
> >                                                    Please reply to the
> list;
> >                                                          please *don't*
> CC me.
> >
> >
> > --
> > MailScanner mailing list
> > mailscanner at lists.mailscanner.info
> > http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
>
>
> --
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
>

-- 
Shawn Iverson, CETL
Director of Technology
Rush County Schools
765-932-3901 option 7
iversons at rushville.k12.in.us

[image: Cybersecurity]
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.mailscanner.info/pipermail/mailscanner/attachments/20190612/a18be824/attachment.html>