[Rspamd-Users] messages tagged as spam when sending encrypted and signed via Thunderbird

[Arno Welzel]

David Mehler:

> Hello,
> 
> I just sent another message and checked on the web interface history
> tab and got this one line:
> 
> 748bc1f3-093a-fde1-f3d1-a8e5e3c8a809 at example.com	rewrite subject	4.80
> / 15	4/23/2020, 2:33:45 AM

When you click this message, it should open a more detailed view with
the rules which applied to that message.

> Since I knew the message was sent at 2:33 I took the entire 2:33
> minute here's the excerpt from my rspamd.log if it helps:
> 
[...]
> 2020-04-23 02:33:45 #3322(rspamd_proxy) <652600>; proxy;
> dkim_module_load_key_format: cannot load dkim key
> /var/db/rspamd/dkim/example.com.dkim.key: cannot stat key file:
> '/var/db/rspamd/dkim/example.com.dkim.key' No such file or directory
[...]

This is not the cause of your problem - but anyway: you should check
your DKIM configuration - either the key is missing or can not be found
due to a missing or incorrect domain or selector map or you should add
"try_fallback = false;" to /etc/rspamd/local.d/dkim_signing.conf.

If you don't use DKIM at all, disable the module by adding "enable =
fale" to /etc/rspamd/local.d/dkim_signing.conf.

[...]
> [KEYWORD_BL(5.00){},MIME_GOOD(-0.20){multipart/encrypted;},ARC_NA(0.00){},ASN(0.00){asn:10796,
> ipnet:69.133.0.0/18,
> country:US;},FREEMAIL_ENVRCPT(0.00){gmail.com;},FREEMAIL_TO(0.00){gmail.com;},FROM_EQ_ENVFROM(0.00){},FROM_HAS_DN(0.00){},MID_RHS_MATCH_FROM(0.00){},MIME_TRACE(0.00){0:+;1:~;2:~;},RCPT_COUNT_ONE(0.00){1;},RCVD_COUNT_ZERO(0.00){0;},TAGGED_RCPT(0.00){},TO_DN_NONE(0.00){},TO_MATCH_ENVRCPT_ALL(0.00){}]),


This is the reason why the mail got tagged as spam:

KEYWORD_BL - 5.00
MIME_GOOD - -0.20

Which sums up to 4.8.

However - where does "KEYWORD_BL" come from? This seems not to be a
standard symbol in rspamd. Did you define this locally?


Hope this helps,
Arno