Can't discard spam messages on arrival using Sieve filters

[d19dotca]

I am writing a dedicated bug report based on a post I made in another thread.

Use case: Discard spam messages on arrival using Sieve filters via Roundcube.

I was able to setup redirects in the mailbox and they are working where they only forward non-spam messages by using the following filter:

# rule:[Forward non-spam messages]
if allof (not header :contains "x-spam-status" "Yes,")
{
	redirect "<externalEmailAddress>";
}

However, all messages marked as spam still save in the mailbox regardless of any filters I set to discard them. In my case, I want the spam messages to be discarded/deleted automatically as there's no sense in them remaining in the "forwarding only" mailbox. It seems maybe there's a priority filter going on elsewhere in Cloudron that's overriding my sieve filter?

Using a filter like this:

# rule:[Discard spam messages on arrival]
if allof (header :contains "x-spam-status" "Yes,")
{
	discard;
	stop;
}

... will still see the email saved in the Spam folder. I've tried variations of it too such as apply to all messages (i.e. no filter) after the redirect rule is applied, but still no-dice. Basically I can't get any filters to work when it's been identified as spam, only filters when it's NOT spam.

Here's a way to reproduce it:

1. Set this filter in Roundcube:

# rule:[Discard spam messages on arrival]
if allof (header :contains "x-spam-status" "Yes,")
{
	discard;
	stop;
}

2. Send a message to the email account using the GTUBE string which SpamAssassin automatically marks with 1000 points, it's basically a test for spam filters: XJS*C4JDBQADN1.NSBN3*2IDNEN*GTUBE-STANDARD-ANTI-UBE-TEST-EMAIL*C.34X

3. See if the message is really discarded per the sieve filter or if it's still arriving in the Spam folder. In my cases, they still arrive in the Spam folder which seems to be incorrect behaviour.

[d19dotca]

Any help / update on this? I'm wondering @girish - is this perhaps a limitation inside of Cloudron's current configs for Sieve and the webmail apps?

[ccfu]

@d19dotca I tried to set up something similar with filters on Rainloop and can confirm that it does not work as intended - the mails that should be discarded are still delievered to the SPAM folder.

[d19dotca]

@ccfu said in Can't discard spam messages on arrival using Sieve filters:

@d19dotca I tried to set up something similar with filters on Rainloop and can confirm that it does not work as intended - the mails that should be discarded are still delievered to the SPAM folder.

Correct, yeah it’s definitely a sieve thing (not specific to webmail app). I’m disappointed this is the current case because it basically undoes half the reason I had tried migrating from mailing lists to a mailbox in the first place. I always used mailing lists when forwarding all mail to an external address originally sent to a domain hosted on Cloudron, and in order to stop spam from being forwarded on I converted them to mailboxes with sieve rules. Now the spam doesn’t forward on to the target address (this is one step forward), but now it’s storing all the spam mail on disk (this is one step back).

[robi]

It sounds like you're trying to catch spam before it's marked as spam, then when it is, it gets put into the spam folder correctly, but you don't process it further.

So why not add a sieve rule after it hits the spam folder to delete or only keep X days worth?

[d19dotca]

@robi said in Can't discard spam messages on arrival using Sieve filters:

It sounds like you're trying to catch spam before it's marked as spam, then when it is, it gets put into the spam folder correctly, but you don't process it further.

So why not add a sieve rule after it hits the spam folder to delete or only keep X days worth?

No, I don't actually think that’s the issue in this case. If that was the issue then forwarding only non-spam would not work correctly and end up forwarding everything, right? So it’s definitely been processed by SpamAssassin and marked as spam before it hits any of the sieve rules, since the filters I use for sending non-spam only rely on the SpamAssassin headers. By the time any messages hit the sieve filters they’ve already got all of their headers which means they were processed by the different layers already.

Additionally, I’m trying to discard all messages (not just spam messages), I don’t want any messages stored in these mailboxes when they’re dedicated to forwarding only. However only spam messages remain since the redirect to external address works successfully for non-spam - the redirect means it doesn’t save the message locally after forwarding.

[robi]

@d19dotca so what can you do after the spam messages are in the spam folder?

[d19dotca]

@robi That’s the thing, it doesn’t seem like any sieve filters work on messages marked as spam by SpamAssassin when it comes to discarding messages. I had tried a while back the Discard with Reply option and still no dice. I haven’t tested all possibilities, but ultimately I’m needing to discard all messages and it’s not happening if it’s been marked as spam by SpamAssassin before it arrives in the mailbox.

[robi]

@d19dotca is it something about the spam folder?
can you have spam messages drop in a different folder?
can you match on something else in the header and get a log message or indication it did?
can you leave the spam in the inbox and discard from there?
can MTA be configured to not deliver spam at all?
does Sieve only work on inbox?

[ccfu]

@robi said in Can't discard spam messages on arrival using Sieve filters:

does Sieve only work on inbox?

From what I have observed it looks like this could indeed be the reason.

[d19dotca]

@robi said in Can't discard spam messages on arrival using Sieve filters:

@d19dotca is it something about the spam folder?

That's for Cloudron team to confirm. I can't say for sure, but yes it certainly seems related to the spam folder itself. If I had to guess, I think the Spam sieve or rules are overriding any of the custom user sieve filters.

can you have spam messages drop in a different folder?

Not that I've been able to do so far but like I said, I haven't tried every possibility. Doesn't seem worthwhile to test every possibility when none of the other ones get to me what I want in my particular use-case anyways. I've done a ton of troubleshooting for various issues, this week I'm a bit tired out. Maybe I'll do more testing next week sometime to get a better picture, but regardless of that I can say for certain that my use-case is not working correctly and I'm pretty certain it's because any user Sieve filters are overwritten by a particular Spam sieve or MTA rule with a higher priority.

can you match on something else in the header and get a log message or indication it did?

As I noted earlier, I can make a rule that works correctly to redirect only non-spam using the sieve filter mentioned in the first comment, so sieve filters definitely work on any message headers including the Spam header when it comes to rules other than discard. Redirect works, for example. But I cannot use the Discard rule apparently on any spam messages.

can you leave the spam in the inbox and discard from there?

It doesn't appear so, no. That's why I suspect this whole thing is being caused by a higher priority Sieve filter or MTA rule that is forcing the message into the Spam folder. There isn't a way that I'm aware of to prevent spam from entering the designated Spam folder and stay in another folder like the inbox for example. This is another reason I'm pretty sure this is all because of a higher priority rule that's preventing any Sieve filters from changing the placement (including discarding completely) any identified spam messages.

can MTA be configured to not deliver spam at all?

That's ultimately what I wanted to some extent. Unfortunately there's no way to prevent spam from being delivered to a mailing list, so that's what led me to consider using mailboxes instead with the sole use-case of redirecting only non-spam and deleting all mail (regardless of spam or not) after it was processed, but no-dice. Wasted a lot of time unfortunately making all these changes and testing. I am one step ahead in the sense that spam isn't forwarded anymore and only non-spam is, but one step back in the sense that now I'm using disk space to store a lot of spam from certain users who receive a ton of it (like talking most days 20-40+ messages a day of just spam because they have a publicly listed email address which has been used for nearly a decade or longer).

does Sieve only work on inbox?

This is a possibility but again, the Cloudron team really needs to confirm this as I am not a programmer so sifting through the code in their Git repo only gets me so far unfortunately. It's their design (whether intentional or not).

[d19dotca]

FWIW, I've tried with a general "discard all" after the redirect, but still no-dice which is why I'm certain this is to do with some rule taking a higher priority when it comes to messages marked as spam.

# rule:[Discard messages after redirect complete]
if true
{
	discard;
}

So in my case, the full Sieve file looks like this right now, but still not working to remove any spam messages:

# rule:[Redirect non-spam messages]
if allof (not header :contains "x-spam-status" "Yes")
{
	redirect "<clientExternalEmailAddress>";
}
# rule:[Discard messages after redirect complete]
if true
{
	discard;
}

[robi]

@d19dotca try:
if true, move to delete-me folder, then from delete-me context delete all that arrive there.

[d19dotca]

@robi hmm, the filter is already “delete all incoming messages” though

[robi]

@d19dotca yes, but on "special" folders like inbox and spam which could be hardcoded elsewhere.

delete-me for sure isn't one of those.

[d19dotca]

@robi oh okay, so you’re saying to make a rule that tells all incoming mail to go to a particular new folder then run the other sieve filters on that new folder? I can try later I guess, I’m doubtful that’ll work because that’s kind of the issue… whatever exists that makes spam go to the Spam folder is overwriting everything else, basically completely bypassing Sieve filters. I’ll try when I can though (likely next week, I’m going to be away for the next few days after tomorrow).

[robi]

@d19dotca right..

otherwise it might be time to look through the mail container

[girish]

@d19dotca Just got around to looking into this. This doesn't work because the mail server processes spam messages using dovecot's sieve_before flag - https://doc.dovecot.org/settings/pigeonhole/#plugin-sieve-setting-sieve-before . You can check the /app/dovecot-config/sieve_before/spam-move.sieve script in the mail container which is moving X-Spam-Flag into the Spam folder. Because the filter below is run before user messages, your filters don't work. This also makes it easy for the end user to not worry about processing spam messages when writing filters, so I think the default behavior is good.

require ["fileinto","mailbox"];

if header :contains "X-Spam-Flag" "YES" {
    fileinto "Spam";
    stop;
}

For the original use case of discarding all spam for forwarding mailboxes, this is the default behavior in next release.

[ccfu]

@girish said in Can't discard spam messages on arrival using Sieve filters:

so I think the default behavior is good.

As a default I think so too, but whilst the spam protection in Cloudron is reliable, sometimes the end user wants / needs to be able to filter spam messages directly It would therefore be good to have a simple way of filtering mails to discard spam selectively rather than just having all SPAM go to the SPAM folder. Mails with a SPAMASSASSIN score of over 20, for example, do not need to be saved anywhere, but those with a score of 7 or 8 could in theory be false positives so would warrant 'quarantining' rather than discarding altogether. The same applies to certain sender addresses and subjects.

This does not need to be something defined in webmail clients per domain, but could be a server-wide setting similar to the custom spamassassin rules.

[girish]

@ccfu yes, I can look into adding customization for spam handling in the coming releases. I have also wanted a user editable whitelist/blacklist for spam (instead of having to rely on admin).