Search results

Pls write in English as I do not understand what you are saying. Pls show what is the SA score of the spam mail.

Who object refer to Return-Path: <rpmelike@e.creafone.com>. Did you add e.creafone.com domain?

Show the spam mail header is raw format.

/etc/mail/spamassassin/custom.cf will remain after restart. Read more about creating your own spamassassin rules. https://cwiki.apache.org/confluence/display/SPAMASSASSIN/writingrules https://gist.github.com/jult/9bfdc4d07b44be01a02cc2aaf25b7c39 https://github.com/kawaiipantsu/spamassassin-rules

Pls show your syslog from tracking center. As you can see it will add 5 heuristic score to spamassassin score and hit my quarantine level 5 spam rule. Mar 18 15:35:12 pmg postfix/smtpd[115503]: connect from mail.superns.com[218.208.91.110] Mar 18 15:35:12 pmg postfix/smtpd[115503]: NOQUEUE...

Another option is spamassassin custom rule for subject with UTF-8 encoding. Add or create /etc/mail/spamassassin/custom.cf with below rules and run systemctl restart pmg-smtp-filter to restart the filter service...

Try this what object.

What is your Heuristic Score? Refer to thread (https://forum.proxmox.com/threads/spam-filter.74719/) regarding clamav heuristic score and encrypted archives.

Is the virus a password protected zip file? Did you enable block encrypted archivces and document?

Cannot open the MSG file. Pls provide as .eml file.

Pls provide a more complete spam mail raw format and paste as code for easy to check the header info.

show detail of your block viruses rule.

Is your virus mail rule higher priority than rule_possibleSpam (Level 2)?

which header content? Try what object -> match field

If it work. Pls mark the thread as solved.

It should be. But I am not sure will it work for the reply-to field. Not tested on my side.

Try this but I do not guarantee it will work. ^".*"<.*@badomain.com>.*$

Pls show the original spam mail in raw format.

Show the email in raw format. The what object rule work for me. Delivered-To: recipient@mydomain.com Return-Path: sender@gmail.com Received-SPF: pass (gmail.com ... _spf.google.com: Sender is authorized to use 'sender@gmail.com' in 'mfrom' identity (mechanism 'include:_netblocks.google.com'...

Like this