2 Replies Latest reply on Jun 24, 2013 12:05 AM by mnaji

    (RE: and FW: ) inbound mails are dropped

      Hi,

      I have a critical issue in IronMail 6.7.2, the issue is when reply or forward inbound mails (RE: , FW: )  it is processed as a spam and then dropped, how can I resolve this issue?

        • 1. Re: (RE: and FW: ) inbound mails are dropped
          ijahnke

          we would need to see a log excerpt or a sample of a message that was blocked as spam.

          • 2. Re: (RE: and FW: ) inbound mails are dropped

            thank you ijahnke for your response:

            Message ID1260773 
            Current QueueSuper Queue 
            Queue OrderAnti Virus » Spam 
            StatusDropped 
            Size7600  Bytes
            DateSat, 22 Jun 2013 20:49:11 +0300
            Scheduled TimeSat, 22 Jun 2013 20:49:11 +0300
            Frommnaji@ogersystems.com 
            Tomnaji@shura.gov.sa 
            SubjectRE: السلام عليكم و رحمة الله و بركاته 
            IP Address212.118.103.166 
            DirectionInbound 

             

            z

             

             

            this is the message details:

             

             

            this is the action taken for one of replied inbound message:

             

             

             

            Anti-Spam has performed Scores added as a X header by Enterprise Spam Profiler for message 1260773 based on the following rule:

            • param :
              • key : ESP<70>=
              • value : [SHA:<0> , UHA:<10> , ISC:<0> , BAYES:<31> , SenderID:<-1> , DKIM:<0> , TS:<30> , SIG: , DSC:<0> , TRU_spam1: <0>, TRU_profanity_spam: <0>, TRU_money_spam: <0>, TRU_medical_spam: <0>, TRU_urllinks: <0>, URL Real-Time Signatures: <0>, TRU_lotto_spam: <0>, TRU_watch_spam: <0>, TRU_scam_spam: <0>, TRU_freehosting: <0>, TRU_legal_spam: <0>, TRU_adult_spam: <0>, TRU_stock_spam: <0>, TRU_playsites: <0>, TRU_phish_spam: <0>]
            • header : X-esp

             

             

            and this is the log of the same message:

             

            20130622:20:49:12|1260773|9990|User - GroupID info -|{'mnaji@ogersystems.com': [1], 'ogersystems.com': [1], 'mnaji@shura.gov.sa': [1], 'shura.gov.sa': [1]}|

            20130622:20:49:12|1260773|9991|Group ID - Name -|{1: 'global'}|

            20130622:20:49:12|1260773|10038|Processing started for Message ID : <msgid> -|1260773|

            20130622:20:49:12|1260773|7938|Format identification and text extraction will be performed. <msgid> -|1260773|

            20130622:20:49:12|1260773|7190|Part will be treated as given xtn <part:given-xtn> -|<1:>|

            20130622:20:49:12|1260773|777|-|PART_STAT|AVQ|Authentium Engine|1260773|1|0|No Virus found.|

            20130622:20:49:12|1260773|777|-|PART_STAT|AVQ|Authentium Engine|1260773|3|0|No Virus found.|

            20130622:20:49:12|1260773|777|-|PART_STAT|AVQ|Authentium Engine|1260773|2|0|No Virus found.|

            20130622:20:49:12|1260773|4098|-|LOG_STAT|AVQ|1260773|0|0|0|0|

            20130622:20:49:12|1260773|4881|ISC returns score for Message ID: <score:msgid> -|<NOT_SPAM:1260773>|

            20130622:20:49:12|1260773|10500|User Defined Header Analysis was successful in evaluation of rule(s) for Message ID with Score details: <msgid:score> -|<1260773:<Received>-<None>-<0>:<10>>|

            20130622:20:49:12|1260773|3329|ESP policies, Thresholds <policies:ruleid> -|<[1L]:{50: 4L, 75: 5L, 100: 6L}>|

            20130622:20:49:12|1260773|3332|ESP_ISC score -|ISC:<0> |

            20130622:20:49:12|1260773|1285|Bayes Filtering was successful. Score details: -|72|

            20130622:20:49:13|1260773|2567|DYN returns for Message ID: <dsc:msgid> -|<(0, 'DSC:<0> '):1260773>|

            20130622:20:49:13|1260773|7206|Will scan for -|[('TRU_spam1', 34), ('TRU_playsites', 31), ('TRU_money_spam', 29), ('TRU_urllinks', 37), ('TRU_adult_spam', 8), ('URL Real-Time Signatures', 40), ('TRU_lotto_spam', 25), ('TRU_watch_spam', 38), ('TRU_scam_spam', 33), ('TRU_freehosting', 20), ('TRU_legal_spam', 24), ('TRU_medical_spam', 27), ('TRU_stock_spam', 36), ('TRU_profanity_spam', 32), ('TRU_phish_spam', 30)]|

            20130622:20:49:13|1260773|7200|--Scanning part -|0|

            20130622:20:49:13|1260773|7200|--Scanning part -|3|

            20130622:20:49:13|1260773|7200|--Scanning part -|2|

            20130622:20:49:13|1260773|7208|-----Scoring for -|('TRU_spam1', 34)|

            20130622:20:49:13|1260773|7208|-----Scoring for -|('TRU_playsites', 31)|

            20130622:20:49:13|1260773|7208|-----Scoring for -|('TRU_money_spam', 29)|

            20130622:20:49:13|1260773|7208|-----Scoring for -|('TRU_urllinks', 37)|

            20130622:20:49:13|1260773|7208|-----Scoring for -|('TRU_adult_spam', 8)|

            20130622:20:49:13|1260773|7208|-----Scoring for -|('URL Real-Time Signatures', 40)|

            20130622:20:49:13|1260773|7208|-----Scoring for -|('TRU_lotto_spam', 25)|

            20130622:20:49:13|1260773|7208|-----Scoring for -|('TRU_watch_spam', 38)|

            20130622:20:49:13|1260773|7208|-----Scoring for -|('TRU_scam_spam', 33)|

            20130622:20:49:13|1260773|7208|-----Scoring for -|('TRU_freehosting', 20)|

            20130622:20:49:13|1260773|7208|-----Scoring for -|('TRU_legal_spam', 24)|

            20130622:20:49:13|1260773|7208|-----Scoring for -|('TRU_medical_spam', 27)|

            20130622:20:49:13|1260773|7208|-----Scoring for -|('TRU_stock_spam', 36)|

            20130622:20:49:13|1260773|7208|-----Scoring for -|('TRU_profanity_spam', 32)|

            20130622:20:49:13|1260773|7208|-----Scoring for -|('TRU_phish_spam', 30)|

            20130622:20:49:13|1260773|3339|ESP total points for Message ID: <esp:msgid> -|<70:1260773>|

            20130622:20:49:13|1260773|527|This message is spam. Detected by ESP. Message ID: -|1260773|

            20130622:20:49:13|1260773|4098|-|LOG_STAT|SPAMQ|1260773|ESP|DROP|

            20130622:20:49:13|1260773|4098|-|SPAMQ|Notfn Rule Id=4|

            20130622:20:49:13|1260773|6917|customNotification, Stop||