[SOLVED] Confused about the filter rules, don't seem to work

[RAPIDE Software]

Hello everyone,

I have been trying to set up the gateway to our needs and we have some customers that want spam level 3 filtering and other that want spam level 5 filtering.
The rule below doesn't do anything for the domains in the Spam (Level 5) Domains Who object.

What I want to have happen is that every domain that is added to Who object Spam (Level 5) Domains get spam level 5 filtering and all other domains get level 3 filtering.
How do I make this happen?

All other rules are default and whitelist and blacklist are working fine.

Thanks in advance!

 

[oguz]

hi,

from the admin guide [0]

Spam Filter
Matches if detected spam level is equal or greater than the configured value.

so spam level 5 will stop mails which have a spam level of 5 or greater.

if you want a stricter filtering then the level needs to be lower.

[0]: https://pmg.proxmox.com/pmg-docs/pmg-admin-guide.html#chapter_mailfilter

 

[RAPIDE Software]

hi,

from the admin guide [0]



so spam level 5 will stop mails which have a spam level of 5 or greater.

if you want a stricter filtering then the level needs to be lower.

[0]: https://pmg.proxmox.com/pmg-docs/pmg-admin-guide.html#chapter_mailfilter

You didn't really answer my question, I understand how the scores work.

With these rules as I have them in my screenshot mails that are sent to domains that I added to the Who object for level 5 spam are still being blocked by the level 3 spam rule.
So it is ignoring the level 5 spam rule even though it has a higher priority.

 

[Stoiko Ivanov]

my guess:
* you who object does not match the envelope address of the mail (SMTP MAIL FROM...)
* please paste the logs of such a mail (and the who object Spam (level 5) domains)

I hope this helps!

 

[RAPIDE Software]

my guess:
* you who object does not match the envelope address of the mail (SMTP MAIL FROM...)
* please paste the logs of such a mail (and the who object Spam (level 5) domains)

I hope this helps!

Removed the logs for privacy reasons



I dont want to check for the sender but the receiving domain, in my OP in use the TO rule on the Who object.

 

[Stoiko Ivanov]

Please use code-tags when posting logs/files - it makes reading them much easier!

In this case the rule-system works as it should:
* the mail has 4 points from SpamAssassin, therefore the rule with spam-level 5 (and the domain) does not trigger
* the rule with spam-level 3 below does trigger (I assume it has no associated Who object )

Since the rule system does not have negation for Objects in general - try the following:
* move the priority of the level-5 domain rule to 82
* add a rule at priority 81 with: To: spam-level 5 domains and Action: ACCEPT

that way the mails will get accepted and further processing won't happen

I hope this helps!

 

[RAPIDE Software]

Please use code-tags when posting logs/files - it makes reading them much easier!

In this case the rule-system works as it should:
* the mail has 4 points from SpamAssassin, therefore the rule with spam-level 5 (and the domain) does not trigger
* the rule with spam-level 3 below does trigger (I assume it has no associated Who object )

Since the rule system does not have negation for Objects in general - try the following:
* move the priority of the level-5 domain rule to 82
* add a rule at priority 81 with: To: spam-level 5 domains and Action: ACCEPT

that way the mails will get accepted and further processing won't happen

I hope this helps!

So, just for confirmation.
My rules now look like this.

The Quarantine/Mark Spam (Level 3 and 5) are default and the Spam (Level 5) Domains Accept uses the objects seen in the image.

Now mail should get checked against Quarantine/Mark Spam (Level 5) first and if it passes it goes on to Quarantine/Mark Spam (Level 3) unless it gets accepted in the Spam (Level 5) Domains Accept rule because the domain is on the list.

It makes sense now, I was expecting domains to stop checking after the first rule it hits.

 

[Stoiko Ivanov]

It makes sense now, I was expecting domains to stop checking after the first rule it hits.

processing stops after a mail hits one of 3 final actions: Accept, Block, Quarantine

I hope this explains it

Please mark the thread as 'SOLVED' this helps other users with similar questions
Thanks!