On 05/11/2024 19:47, Nick Howitt wrote:
On 05/11/2024 17:31, Damian wrote:
I don't see any SPF or DMARC checking in the headers on inbound email
and I am currently researching it.
Amavis does not check SPF or DMARC itself, but SpamAssassin will do
it, if configured.
Odd one this. It may be doing the checks as I see the X-Virus-Scanned
header "Debian amavis at mail-www.howitts.co.uk".
Previously in ClearOS (based on Centos7), I would see in the mail log
something like:
Nov 4 08:42:04 server amavis[1874]: (01874-15) size: 105876, TIMING
[total 2285 ms] - SMTP greeting: 1.4 (0%)0, SMTP EHLO: 0.7 (0%)0,
SMTP pre-MAIL: 0.6 (0%)0, SMTP MAIL: 0.8 (0%)0, SMTP pre-DATA-flush:
1.0 (0%)0, SMTP DATA: 40 (2%)2, check_init: 0.3 (0%)2, digest_hdr:
1.4 (0%)2, digest_body_dkim: 7 (0%)2, collect_info: 4.1 (0%)3,
mime_decode: 10 (0%)3, get-file-type1: 10 (0%)3, parts_decode: 0.1
(0%)3, check_header: 0.2 (0%)3, AV-scan-1: 162 (7%)10, spam-wb-list:
0.2 (0%)10, SA msg read: 0.3 (0%)11, SA parse: 3.0 (0%)11, SA check:
1945 (85%)96, decide_mail_destiny: 4.5 (0%)96, notif-quar: 0.2
(0%)96, fwd-connect: 38 (2%)98, fwd-mail-pip: 4.3 (0%)98, fwd-rcpt-
pip: 0.2 (0%)98, fwd-data-chkpnt: 0.0 (0%)98, write-header: 0.5
(0%)98, fwd-data-contents: 2.2 (0%)98, fwd-end-chkpnt: 41 (2%)100,
prepare-dsn: 0.7 (0%)100, report: 1.1 (0%)100, main_log_entry: 2.9
(0%)100, update_snmp: 0.9 (0%)100, SMTP pre-response: 0.2 (0%)100,
SMTP response: 0.1 (0%)100, unlink-2-files: 0.2 (0%)100, rundown:
0.4 (0%)100
Nov 4 08:42:04 server amavis[16349]: (16349-18) ESMTP :10024 /var/
lib/amavis/tmp/amavis-20241103T141640-16349-3pL0YovS:
<[email protected]> -> <[email protected]> SIZE=108333 Received: from
mailserver.howitts.co.uk ([127.0.0.1]) by localhost
(server.howitts.co.uk [127.0.0.1]) (amavisd-new, port 10024) with
ESMTP for <[email protected]>; Mon, 4 Nov 2024 08:42:04 +0000 (GMT)
Nov 4 08:42:04 server mailfilter: starting up
([email protected], [email protected],
client_address=127.0.0.1)
Nov 4 08:42:04 server amavis[27659]: (27659-12) spam-tag,
<[email protected]> -> <[email protected]>, No, score=-7.488
tagged_above=-99 required=5 tests=[DKIM_SIGNED=0.1, DKIM_VALID=-0.1,
DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, MIME_HTML_ONLY=0.1,
SPF_HELO_NONE=0.001, T_REMOTE_IMAGE=0.01, USER_IN_DEF_DKIM_WL=-7.5]
autolearn=ham autolearn_force=no
So spamassassin must be communicating with amavis somehow. I'll keep
digging.
Fixed by setting "$log_level = 2;" in amavis.
