local system-generated messages tagged as spam

[David Mehler]

Hello,

I've got a situation with my rspamd setup. System-generated messages
from root to users, they're aliased to another user also on the
system, are being tagged as spam.

Any suggestions as to why?

What information is needed? The rspamd-status shows false yet the
subject is being rewritten to ***spam***

Thanks.
Dave.

[Bjoern Franke]

On 01.05.2018 23:17, David Mehler wrote:
> Hello,
>
> I've got a situation with my rspamd setup. System-generated messages
> from root to users, they're aliased to another user also on the
> system, are being tagged as spam.
>
> Any suggestions as to why?
>
>

If you provide no header, we have to ask the crystal ball.

[David Mehler]

Hello Bjoern and all,

Sorry, I definitely hit the send key to fast on that one, headers
below. The subject is being rewritten:

Subject: *** SECURITY information for hostname ***

and yet rspamd is set to false, this should not be occurring:

X-Spamd-Result: default: False [0.20 / 999.00];

Suggestions welcome.
Thanks.
Dave.

headers:
Return-Path: <ro...@domain.com>
Delivered-To: us...@domain.com
Received: from mail.domain.com
by mail.domain.com with LMTP
id K13yObii6FoFRgAA0J78UA
(envelope-from <ro...@domain.com>)
for <us...@domain.com>; Tue, 01 May 2018 13:24:08 -0400
ARC-Authentication-Results: i=1;
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=domain.com;
s=dkim; t=1525195448; h=from:from:sender:reply-to:subject:subject:date:date:
message-id:message-id:to:to:cc:mime-version:content-type:
content-transfer-encoding:in-reply-to:references;
bh=0jtA3oFo7Yz9ItIzzp+mwki0vOXa2nd4qqTtSPlVEbs=;
b=eX4qxCU70RADrUDbmGMae4QNEv2Kc6dCKs+1m9OrFFnr1cagRSkk6MCbGJL6PH/gY0GNml
mzc5QSxq3hHv1Vnou9H6twHUnYLonTbjOjvFIejfCjTdtLPLgkzwjRTTXgcsbuN4rtKpHI
YAiM0N8JYZy3bOn2NYohU8MaMnQ7KveZ7E99OyCOPXTkq1Qf6ID8+XdklNkfN45OfdbkqD
RPGqOyQM/5iWaFdNk/KeiZvc1O17/4KX7r76WbyiauFLfIOU60itAxD00/VftY3s5fZnID
3oOLBb1LBZWVCDZkBcy0Y3HSJxE/jFeKO76lCCPsgzn8xKNBq0PcUnpckkpvZQ==
ARC-Seal: i=1; s=dkim; d=domain.com; t=1525195448; a=rsa-sha256;
cv=none;
b=R4AHIvtZWAh5T4ntaVDarzKZxaY3I+rCFzWQNIH4xymk/W62xzYWuFHibVUnLisbdhOzUycl3aOwzqK0SxiaY1cdlHrZzDNtfLqnikOc14XvLl9Ikx1UuJWJ2VFX0dhHWGs49+0j2nUiF610BGJr2lRHtAFT9r+mmlbuhJnRuOcQgd6koN4ufDb68XAbtJFvwzI+gZ+uU/B804cefumeSPLYmlmev2FGLMkNt75qnnwmmS4Az2oco7AsAI7CLg8c5PdDrSSqi5Xa6KZcvlY3S6IQxW1ASKCZSVD3uQxTyAwPL4S5zlyWH0m6c1cgF/t/BYKTeqIn6PxB/pmXTj/U6g==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=domain.com;
s=dkim; t=1525195448; h=from:from:sender:reply-to:subject:subject:date:date:
message-id:message-id:to:to:cc:mime-version:content-type:
content-transfer-encoding:in-reply-to:references;
bh=0jtA3oFo7Yz9ItIzzp+mwki0vOXa2nd4qqTtSPlVEbs=;
b=kGeT9Au92UC/7n5Y2FelSd1QxX2ge1Ce+K3PLATnDO44/kMSViYIcvk2lYfq7giIBMa+Hr
SdyD9iu+HRnDqiKh3AnNxDw+Yh+KCZFPahkH87csAv1x+uhEOF8+vaCVq863vNF39J4uwa
eMOOteCkaYAOWS46HyEZef3Vv2Qg6D7c0i1GYrCobjmbYkYHg3Se985FzHRNHsVyWJd7Qs
slKUBFIW6pzyOzSEb7UwS1Vea2SiIZgFQNBcMEogylgFfbdsCk1zZRS5KLddvrMYFGEJem
ZZj8gUpUOVQ6+yPNete1flix9/xnztxCMdk191WqnVCzu0g75HT8IyoHkTj4Zw==
To: ro...@domain.com
From: us...@domain.com
Auto-Submitted: auto-generated
Subject: *** SECURITY information for hostname ***
Message-Id: <2018050117240...@mail.domain.com>
Date: Tue, 1 May 2018 13:24:08 -0400 (EDT)
X-Rspamd-Queue-Id: A8D3B4BED3F
X-Spamd-Result: default: False [0.20 / 999.00];
RCPT_COUNT_ONE(0.00)[1];
FROM_NO_DN(0.00)[];
RCVD_TLS_ALL(0.00)[];
MIME_GOOD(-0.10)[text/plain];
TO_MATCH_ENVRCPT_ALL(0.00)[];
ARC_SIGNED(0.00)[i=1];
FORGED_SENDER(0.30)[];
DKIM_SIGNED(0.00)[];
TO_DN_NONE(0.00)[];
FROM_NEQ_ENVFROM(0.00)[us...@domain.com,ro...@domain.com];
RCVD_COUNT_ZERO(0.00)[0];
ARC_NA(0.00)[];
TO_DOM_EQ_FROM_DOM(0.00)[]
X-Rspamd-Server: hostname
X-PWhois-Status: No originator identified

[Vsevolod Stakhov]

What are related Rspamd logs for this message?

https://rspamd.com/doc/faq.html#how-to-read-rspamd-logs

[David Mehler]

Hello,

Thanks. I'm not getting anything in my rspamd.log referencing the ID
in question. I do see information in my postfix log file, it gets the
message hands it off then nothing from rspamd. I've tried grepping the
rspamd.log file and manually searching for the id it's not there. I am
seeing a lot of this in the log I don't know if it's related:

2018-05-03 12:21:24 #89791(rspamd_proxy) <34d98a>; proxy;
fuzzy_check_io_callback: got error on IO with server
fuzzy.rspamd.com(88.99.142.95), on write, 13, Permission denied

Would a configdump help at least in determining why i'm not getting
useful debug information in the rspamd log? My debug level is set to
error if that helps.

Thanks.
Dave.

[Vsevolod Stakhov]

Please set it to at least 'silent'.

[David Mehler]

Hello,

Thanks, silent did it, got more debugging than thus far. I hope the
below helps to diagnose my issue.

Thanks.
Dave.

#grep 1DBD74BED3F postfix.log
May 3 14:38:30 hostname postfix/pickup[59696]: 1DBD74BED3F: uid=0 from=<root>
May 3 14:38:30 hostname postfix/cleanup[86369]: 1DBD74BED3F:
message-id=<2018050318383...@mail.domain.com>
May 3 14:38:30 hostname postfix/qmgr[46508]: 1DBD74BED3F:
from=<ro...@domain.com>, size=386, nrcpt=1 (queue active)
May 3 14:38:30 hostname postfix/lmtp[87552]: 1DBD74BED3F:
to=<us...@domain.com>, orig_to=<ro...@domain.com>,
relay=mail.domain.com[private/dovecot-lmtp], delay=0.4,
delays=0.28/0.01/0.01/0.1, dsn=2.0.0, status=sent (250 2.0.0
<us...@domain.com> yvWHFyZX61r8VwEA0J78UA Saved)
May 3 14:38:30 hostname postfix/qmgr[46508]: 1DBD74BED3F: removed

#grep 1DBD74BED3F rspamd/rspamd.log
2018-05-03 14:38:30 #44970(rspamd_proxy) <9fabf3>; proxy;
rspamd_task_write_log: id:
<2018050318383...@mail.domain.com>, qid: <1DBD74BED3F>, ip:
127.0.0.1, from: <ro...@domain.com>, (default: F (no action):
[0.20/999.00] [FORGED_SENDER(0.30){},MIME_GOOD(-0.10){text/plain;},ARC_NA(0.00){},ARC_SIGNED(0.00){i=1;},DKIM_SIGNED(0.00){},FROM_NEQ_ENVFROM(0.00){us...@domain.com;ro...@domain.com;},FROM_NO_DN(0.00){},RCPT_COUNT_ONE(0.00){1;},RCVD_COUNT_ZERO(0.00){0;},RCVD_TLS_ALL(0.00){},TO_DN_NONE(0.00){},TO_DOM_EQ_FROM_DOM(0.00){},TO_MATCH_ENVRCPT_ALL(0.00){}]),
len: 352, time: 131.649ms real, 11.299ms virtual, dns req: 0, digest:
<13b3855f7f3a56bb7a5ef5fc5c4807fe>, rcpts: <ro...@domain.com>,
mime_rcpts: <ro...@domain.com>

#cat rspamd/rspamd.log
2018-05-03 14:31:03 #43917(main) lua; lua_cfg_transform.lua:160: group
excessb64 has no symbols
2018-05-03 14:31:03 #43917(main) lua; lua_cfg_transform.lua:160: group
excessqp has no symbols
2018-05-03 14:31:03 #43917(main) cfg;
rspamd_rcl_maybe_apply_lua_transform: configuration has been
transformed in Lua
2018-05-03 14:31:03 #43917(main) rspamd_regexp_library_init: pcre is
compiled with JIT for x86 64bit (little endian + unaligned)
2018-05-03 14:31:03 #43917(main) <ehzkcx>; cfg;
rspamd_language_detector_read_file: loaded af language, 1541130
unigramms, 1328687 trigramms, 1328687 ngramms loaded; std=9458.49,
mean=2182.92, skipped=0, loaded=1525; (latin)
2018-05-03 14:31:03 #43917(main) <ehzkcx>; cfg;
rspamd_language_detector_read_file: loaded an language, 3992558
unigramms, 3895070 trigramms, 3895070 ngramms loaded; std=15859.57,
mean=2534.50, skipped=0, loaded=3953; (latin)
2018-05-03 14:31:03 #43917(main) <ehzkcx>; cfg;
rspamd_language_detector_read_file: loaded ar language, 11749565
unigramms, 9440598 trigramms, 9440598 ngramms loaded; std=63241.54,
mean=13397.18, skipped=0, loaded=1915; (tier1)
2018-05-03 14:31:03 #43917(main) <ehzkcx>; cfg;
rspamd_language_detector_read_file: loaded bg language, 7994134
unigramms, 6462334 trigramms, 6427835 ngramms loaded; std=39443.77,
mean=9100.59, skipped=24, loaded=1677; ()
2018-05-03 14:31:03 #43917(main) <ehzkcx>; cfg;
rspamd_language_detector_read_file: loaded bn language, 1969690
unigramms, 1502429 trigramms, 1492207 ngramms loaded; std=7777.14,
mean=1996.84, skipped=32, loaded=1728; ()
2018-05-03 14:31:03 #43917(main) <ehzkcx>; cfg;
rspamd_language_detector_read_file: loaded br language, 2305059
unigramms, 2226880 trigramms, 2226880 ngramms loaded; std=8111.66,
mean=1202.58, skipped=0, loaded=4791; (latin)
2018-05-03 14:31:03 #43917(main) <ehzkcx>; cfg;
rspamd_language_detector_read_file: loaded cs language, 11333226
unigramms, 8780627 trigramms, 8780627 ngramms loaded; std=44868.90,
mean=11202.09, skipped=0, loaded=2078; (latin)
2018-05-03 14:31:03 #43917(main) <ehzkcx>; cfg;
rspamd_language_detector_read_file: loaded cy language, 3639934
unigramms, 3548300 trigramms, 3548300 ngramms loaded; std=12318.67,
mean=1965.59, skipped=0, loaded=4798; (latin)
2018-05-03 14:31:03 #43917(main) <ehzkcx>; cfg;
rspamd_language_detector_read_file: loaded da language, 9674395
unigramms, 8090238 trigramms, 8090238 ngramms loaded; std=54489.98,
mean=12531.81, skipped=0, loaded=1632; (latin)
2018-05-03 14:31:03 #43917(main) <ehzkcx>; cfg;
rspamd_language_detector_read_file: loaded de language, 87197534
unigramms, 71857404 trigramms, 71857404 ngramms loaded; std=485017.26,
mean=111551.47, skipped=0, loaded=1614; (tier1,latin)
2018-05-03 14:31:03 #43917(main) <ehzkcx>; cfg;
rspamd_language_detector_read_file: loaded unicode script only el
language: 8
2018-05-03 14:31:03 #43917(main) <ehzkcx>; cfg;
rspamd_language_detector_read_file: loaded en language, 260942223
unigramms, 224934017 trigramms, 224934017 ngramms loaded;
std=1403859.58, mean=345254.01, skipped=0, loaded=1687; (tier0,latin)
2018-05-03 14:31:03 #43917(main) <ehzkcx>; cfg;
rspamd_language_detector_read_file: loaded es language, 70286890
unigramms, 60413548 trigramms, 60413548 ngramms loaded; std=422249.71,
mean=99966.04, skipped=0, loaded=1507; (tier1,latin)
2018-05-03 14:31:03 #43917(main) <ehzkcx>; cfg;
rspamd_language_detector_read_file: loaded et language, 4341644
unigramms, 4175920 trigramms, 4175920 ngramms loaded; std=13646.88,
mean=1910.17, skipped=0, loaded=5512; (latin)
2018-05-03 14:31:03 #43917(main) <ehzkcx>; cfg;
rspamd_language_detector_read_file: loaded eu language, 10862913
unigramms, 10572779 trigramms, 10572779 ngramms loaded; std=44303.99,
mean=6416.53, skipped=0, loaded=4185; (latin)
2018-05-03 14:31:03 #43917(main) <ehzkcx>; cfg;
rspamd_language_detector_read_file: loaded fa language, 8069793
unigramms, 6796528 trigramms, 6796528 ngramms loaded; std=46746.63,
mean=11382.50, skipped=0, loaded=1468; ()
2018-05-03 14:31:03 #43917(main) <ehzkcx>; cfg;
rspamd_language_detector_read_file: loaded fi language, 15184556
unigramms, 13033049 trigramms, 13033049 ngramms loaded; std=86368.77,
mean=19733.46, skipped=0, loaded=1697; (latin)
2018-05-03 14:31:03 #43917(main) <ehzkcx>; cfg;
rspamd_language_detector_read_file: loaded fr language, 66338594
unigramms, 56850284 trigramms, 56850284 ngramms loaded; std=383290.89,
mean=90398.61, skipped=0, loaded=1588; (tier1,latin)
2018-05-03 14:31:03 #43917(main) <ehzkcx>; cfg;
rspamd_language_detector_read_file: loaded ga language, 1346129
unigramms, 1308708 trigramms, 1308708 ngramms loaded; std=4879.21,
mean=727.38, skipped=0, loaded=4648; (latin)
2018-05-03 14:31:03 #43917(main) <ehzkcx>; cfg;
rspamd_language_detector_read_file: loaded gl language, 11035571
unigramms, 10739584 trigramms, 10739584 ngramms loaded; std=41994.20,
mean=6371.54, skipped=0, loaded=4385; (latin)
2018-05-03 14:31:03 #43917(main) <ehzkcx>; cfg;
rspamd_language_detector_read_file: loaded unicode script only gu
language: 18
2018-05-03 14:31:03 #43917(main) <ehzkcx>; cfg;
rspamd_language_detector_read_file: loaded he language, 7414842
unigramms, 5934016 trigramms, 5891019 ngramms loaded; std=35583.58,
mean=7932.54, skipped=36, loaded=1980; ()
2018-05-03 14:31:03 #43917(main) <ehzkcx>; cfg;
rspamd_language_detector_read_file: loaded hi language, 3436892
unigramms, 2722787 trigramms, 2722787 ngramms loaded; std=15238.17,
mean=4278.01, skipped=0, loaded=1503; ()
2018-05-03 14:31:03 #43917(main) <ehzkcx>; cfg;
rspamd_language_detector_read_file: loaded hr language, 5153330
unigramms, 4281211 trigramms, 4281211 ngramms loaded; std=26712.07,
mean=6319.58, skipped=0, loaded=1750; (latin)
2018-05-03 14:31:03 #43917(main) <ehzkcx>; cfg;
rspamd_language_detector_read_file: loaded hu language, 10929783
unigramms, 8457220 trigramms, 8457220 ngramms loaded; std=46705.43,
mean=11298.26, skipped=0, loaded=1945; (latin)
2018-05-03 14:31:03 #43917(main) <ehzkcx>; cfg;
rspamd_language_detector_read_file: loaded id language, 11077227
unigramms, 9643042 trigramms, 9643042 ngramms loaded; std=72842.50,
mean=17055.97, skipped=0, loaded=1408; (latin)
2018-05-03 14:31:03 #43917(main) <ehzkcx>; cfg;
rspamd_language_detector_read_file: loaded is language, 2831948
unigramms, 2728347 trigramms, 2728347 ngramms loaded; std=7806.90,
mean=1136.83, skipped=0, loaded=6386; (latin)
2018-05-03 14:31:03 #43917(main) <ehzkcx>; cfg;
rspamd_language_detector_read_file: loaded it language, 55820958
unigramms, 49460182 trigramms, 49460182 ngramms loaded; std=352389.09,
mean=87344.13, skipped=0, loaded=1427; (tier1,latin)
2018-05-03 14:31:03 #43917(main) <ehzkcx>; cfg;
rspamd_language_detector_read_file: loaded ja language, 10754229
unigramms, 5774482 trigramms, 10754229 ngramms loaded; std=131430.18,
mean=13589.18, skipped=0, loaded=506; (unigrams,tier1)
2018-05-03 14:31:03 #43917(main) <ehzkcx>; cfg;
rspamd_language_detector_read_file: loaded unicode script only km
language: 36
2018-05-03 14:31:03 #43917(main) <ehzkcx>; cfg;
rspamd_language_detector_read_file: loaded unicode script only kn
language: 22
2018-05-03 14:31:03 #43917(main) <ehzkcx>; cfg;
rspamd_language_detector_read_file: loaded ko language, 4985886
unigramms, 3260836 trigramms, 4985886 ngramms loaded; std=3574.29,
mean=617.91, skipped=0, loaded=1150; (unigrams,tier1)
2018-05-03 14:31:03 #43917(main) <ehzkcx>; cfg;
rspamd_language_detector_read_file: loaded lt language, 6266541
unigramms, 6094403 trigramms, 6094403 ngramms loaded; std=20232.17,
mean=2960.87, skipped=0, loaded=5364; (latin)
2018-05-03 14:31:03 #43917(main) <ehzkcx>; cfg;
rspamd_language_detector_read_file: loaded lv language, 2106271
unigramms, 2036825 trigramms, 2036825 ngramms loaded; std=6081.75,
mean=868.97, skipped=0, loaded=6138; (latin)
2018-05-03 14:31:03 #43917(main) <ehzkcx>; cfg;
rspamd_language_detector_read_file: loaded unicode script only ml
language: 23
2018-05-03 14:31:03 #43917(main) <ehzkcx>; cfg;
rspamd_language_detector_read_file: loaded mr language, 573395
unigramms, 442285 trigramms, 442285 ngramms loaded; std=2518.47,
mean=647.25, skipped=0, loaded=1617; ()
2018-05-03 14:31:03 #43917(main) <ehzkcx>; cfg;
rspamd_language_detector_read_file: loaded ms language, 8074753
unigramms, 7891301 trigramms, 7891301 ngramms loaded; std=33762.25,
mean=4926.64, skipped=0, loaded=4192; (latin)
2018-05-03 14:31:03 #43917(main) <ehzkcx>; cfg;
rspamd_language_detector_read_file: loaded ne language, 614665
unigramms, 490631 trigramms, 490631 ngramms loaded; std=2889.10,
mean=759.86, skipped=0, loaded=1495; ()
2018-05-03 14:31:03 #43917(main) <ehzkcx>; cfg;
rspamd_language_detector_read_file: loaded nl language, 56157687
unigramms, 47614417 trigramms, 47614417 ngramms loaded; std=344189.37,
mean=78198.93, skipped=0, loaded=1525; (tier1,latin)
2018-05-03 14:31:03 #43917(main) <ehzkcx>; cfg;
rspamd_language_detector_read_file: loaded no language, 20399254
unigramms, 17069273 trigramms, 17069273 ngramms loaded; std=114539.85,
mean=26789.68, skipped=0, loaded=1599; (latin)
2018-05-03 14:31:03 #43917(main) <ehzkcx>; cfg;
rspamd_language_detector_read_file: loaded pa language, 112478
unigramms, 89577 trigramms, 87684 ngramms loaded; std=487.83,
mean=146.07, skipped=83, loaded=1199; ()
2018-05-03 14:31:03 #43917(main) <ehzkcx>; cfg;
rspamd_language_detector_read_file: loaded pl language, 44927968
unigramms, 36530760 trigramms, 36530760 ngramms loaded; std=201603.84,
mean=50367.14, skipped=0, loaded=1863; (tier1,latin)
2018-05-03 14:31:03 #43917(main) <ehzkcx>; cfg;
rspamd_language_detector_read_file: loaded pt language, 49778514
unigramms, 42469388 trigramms, 42469388 ngramms loaded; std=291348.90,
mean=69766.63, skipped=0, loaded=1490; (tier1,latin)
2018-05-03 14:31:03 #43917(main) <ehzkcx>; cfg;
rspamd_language_detector_read_file: loaded ro language, 8213281
unigramms, 7977386 trigramms, 7977386 ngramms loaded; std=28445.82,
mean=4265.71, skipped=0, loaded=4893; (latin)
2018-05-03 14:31:03 #43917(main) <ehzkcx>; cfg;
rspamd_language_detector_read_file: loaded ru language, 36763344
unigramms, 29165701 trigramms, 29105244 ngramms loaded; std=160911.57,
mean=38564.22, skipped=12, loaded=1861; (tier1)
2018-05-03 14:31:03 #43917(main) <ehzkcx>; cfg;
rspamd_language_detector_read_file: loaded sl language, 5788075
unigramms, 5606921 trigramms, 5606921 ngramms loaded; std=18784.54,
mean=2832.22, skipped=0, loaded=5131; (latin)
2018-05-03 14:31:03 #43917(main) <ehzkcx>; cfg;
rspamd_language_detector_read_file: loaded so language, 94077
unigramms, 83288 trigramms, 83288 ngramms loaded; std=717.85,
mean=152.88, skipped=0, loaded=1287; (latin)
2018-05-03 14:31:03 #43917(main) <ehzkcx>; cfg;
rspamd_language_detector_read_file: loaded sq language, 1760559
unigramms, 1518161 trigramms, 1518161 ngramms loaded; std=9456.28,
mean=2324.28, skipped=0, loaded=1669; (latin)
2018-05-03 14:31:03 #43917(main) <ehzkcx>; cfg;
rspamd_language_detector_read_file: loaded sr language, 7556811
unigramms, 7383394 trigramms, 7383394 ngramms loaded; std=26291.11,
mean=4236.73, skipped=0, loaded=4652; ()
2018-05-03 14:31:03 #43917(main) <ehzkcx>; cfg;
rspamd_language_detector_read_file: loaded sv language, 31862602
unigramms, 26222440 trigramms, 26222440 ngramms loaded; std=162028.65,
mean=39534.87, skipped=0, loaded=1684; (latin)
2018-05-03 14:31:03 #43917(main) <ehzkcx>; cfg;
rspamd_language_detector_read_file: loaded sw language, 1316698
unigramms, 1165243 trigramms, 1165243 ngramms loaded; std=10402.96,
mean=2283.76, skipped=0, loaded=1226; (latin)
2018-05-03 14:31:03 #43917(main) <ehzkcx>; cfg;
rspamd_language_detector_read_file: loaded unicode script only ta
language: 20
2018-05-03 14:31:03 #43917(main) <ehzkcx>; cfg;
rspamd_language_detector_read_file: loaded unicode script only te
language: 21
2018-05-03 14:31:03 #43917(main) <ehzkcx>; cfg;
rspamd_language_detector_read_file: loaded unicode script only th
language: 25
2018-05-03 14:31:03 #43917(main) <ehzkcx>; cfg;
rspamd_language_detector_read_file: loaded tr language, 9192208
unigramms, 7620193 trigramms, 7620193 ngramms loaded; std=44677.42,
mean=10550.30, skipped=0, loaded=1815; (latin)
2018-05-03 14:31:03 #43917(main) <ehzkcx>; cfg;
rspamd_language_detector_read_file: loaded uk language, 15331232
unigramms, 12469252 trigramms, 12357933 ngramms loaded; std=67660.62,
mean=17760.65, skipped=7, loaded=1701; ()
2018-05-03 14:31:03 #43917(main) <ehzkcx>; cfg;
rspamd_language_detector_read_file: loaded ur language, 1602570
unigramms, 1324903 trigramms, 1324903 ngramms loaded; std=8723.95,
mean=2132.89, skipped=0, loaded=1582; ()
2018-05-03 14:31:03 #43917(main) <ehzkcx>; cfg;
rspamd_language_detector_read_file: loaded vi language, 13809827
unigramms, 13396979 trigramms, 13396979 ngramms loaded; std=44106.98,
mean=7006.95, skipped=0, loaded=4878; (latin)
2018-05-03 14:31:03 #43917(main) <ehzkcx>; cfg;
rspamd_language_detector_read_file: loaded yi language, 816181
unigramms, 801051 trigramms, 801051 ngramms loaded; std=3359.07,
mean=519.71, skipped=0, loaded=4133; ()
2018-05-03 14:31:03 #43917(main) <ehzkcx>; cfg;
rspamd_language_detector_read_file: loaded zh-CN language, 4792118
unigramms, 314544 trigramms, 4792118 ngramms loaded; std=8916.64,
mean=3169.06, skipped=0, loaded=827; (unigrams,tier1)
2018-05-03 14:31:03 #43917(main) <ehzkcx>; cfg;
rspamd_language_detector_init: loaded 60 languages, 8 unicode only
languages, 2101 unigramms, 37900 trigramms
2018-05-03 14:31:03 #43917(main) <ehzkcx>; cfg;
chartable_module_config: init internal chartable module
2018-05-03 14:31:03 #43917(main) <ehzkcx>; cfg; dkim_module_config:
init internal dkim module
2018-05-03 14:31:03 #43917(main) <ehzkcx>; cfg; spf_module_config:
init internal spf module
2018-05-03 14:31:03 #43917(main) <uy18in>; map; rspamd_map_add: added
map /usr/local/etc/rspamd/redirectors.inc
2018-05-03 14:31:03 #43917(main) <ehzkcx>; cfg;
rspamd_map_parse_backend: map '/var/db/rspamd/2tld.inc.local' is not
found, but it can be loaded automatically later
2018-05-03 14:31:03 #43917(main) <ehzkcx>; cfg;
rspamd_map_parse_backend: map
'/var/db/rspamd/surbl-whitelist.inc.local' is not found, but it can be
loaded automatically later
2018-05-03 14:31:03 #43917(main) <ehzkcx>; cfg; surbl_module_config:
init internal surbls module, 16 uribl rules loaded
2018-05-03 14:31:03 #43917(main) <ehzkcx>; cfg; regexp_module_config:
init internal regexp module, 120 regexp rules and 0 lua rules are
loaded
2018-05-03 14:31:03 #43917(main) <ehzkcx>; cfg; fuzzy_parse_rule:
added fuzzy rule LOCAL_FUZZY_UNKNOWN, key: ef43ae80cc8d, shingles_key:
ef43ae80cc8d, algorithm: mum
2018-05-03 14:31:04 #43917(main) <ehzkcx>; cfg; fuzzy_parse_rule:
added fuzzy rule FUZZY_UNKNOWN, key: ef43ae80cc8d, shingles_key:
ef43ae80cc8d, algorithm: mum
2018-05-03 14:31:04 #43917(main) <ehzkcx>; cfg;
fuzzy_check_module_config: init internal fuzzy_check module, 2 rules
loaded
2018-05-03 14:31:04 #43917(main) <ehzkcx>; lua; lua_redis.lua:193:
using default redis server for module antivirus
2018-05-03 14:31:04 #43917(main) <ehzkcx>; cfg;
rspamd_map_parse_backend: map
'/usr/local/etc/rspamd/local.d/antivirus.wl' is not found, but it can
be loaded automatically later
2018-05-03 14:31:04 #43917(main) <6mc9na>; map; rspamd_map_add: added
map /usr/local/etc/rspamd/local.d/antivirus.wl
2018-05-03 14:31:04 #43917(main) <ehzkcx>; cfg;
rspamd_init_lua_filters: init lua module antivirus
2018-05-03 14:31:04 #43917(main) <ehzkcx>; cfg;
rspamd_init_lua_filters: init lua module arc
2018-05-03 14:31:04 #43917(main) <ehzkcx>; cfg;
rspamd_init_lua_filters: init lua module asn
2018-05-03 14:31:04 #43917(main) <ehzkcx>; cfg;
rspamd_init_lua_filters: init lua module bayes_expiry
2018-05-03 14:31:04 #43917(main) <ehzkcx>; lua; clickhouse.lua:727: no
servers are specified, disabling module
2018-05-03 14:31:04 #43917(main) <ehzkcx>; cfg;
rspamd_init_lua_filters: init lua module clickhouse
2018-05-03 14:31:04 #43917(main) <ehzkcx>; cfg;
rspamd_init_lua_filters: init lua module dcc
2018-05-03 14:31:04 #43917(main) <ehzkcx>; cfg;
rspamd_init_lua_filters: init lua module dkim_signing
2018-05-03 14:31:04 #43917(main) <ehzkcx>; cfg;
rspamd_init_lua_filters: init lua module dmarc
2018-05-03 14:31:04 #43917(main) <ehzkcx>; cfg;
rspamd_config_is_module_enabled: lua module dynamic_conf is enabled
but has not been configured
2018-05-03 14:31:04 #43917(main) <ehzkcx>; cfg;
rspamd_config_is_module_enabled: dynamic_conf disabling unconfigured
lua module
2018-05-03 14:31:04 #43917(main) <ehzkcx>; lua; lua_redis.lua:193:
using default redis server for module elastic
2018-05-03 14:31:04 #43917(main) <ehzkcx>; lua; elastic.lua:391: no
servers are specified, disabling module
2018-05-03 14:31:04 #43917(main) <ehzkcx>; cfg;
rspamd_init_lua_filters: init lua module elastic
2018-05-03 14:31:04 #43917(main) <ehzkcx>; lua; emails.lua:205: add
emails rule ebl.msbl.org
2018-05-03 14:31:04 #43917(main) <ehzkcx>; lua; emails.lua:205: add
emails rule email.rspamd.com
2018-05-03 14:31:04 #43917(main) <ehzkcx>; cfg;
rspamd_init_lua_filters: init lua module emails
2018-05-03 14:31:04 #43917(main) <ehzkcx>; cfg;
rspamd_init_lua_filters: init lua module force_actions
2018-05-03 14:31:04 #43917(main) <ehzkcx>; cfg;
rspamd_init_lua_filters: init lua module forged_recipients
2018-05-03 14:31:04 #43917(main) <ehzkcx>; cfg;
rspamd_config_is_module_enabled: lua module fuzzy_collect is enabled
but has not been configured
2018-05-03 14:31:04 #43917(main) <ehzkcx>; cfg;
rspamd_config_is_module_enabled: fuzzy_collect disabling unconfigured
lua module
2018-05-03 14:31:04 #43917(main) <ehzkcx>; cfg;
rspamd_config_is_module_enabled: lua module greylist is disabled in
the configuration
2018-05-03 14:31:04 #43917(main) <ehzkcx>; cfg;
rspamd_init_lua_filters: init lua module hfilter
2018-05-03 14:31:04 #43917(main) <ehzkcx>; lua; lua_redis.lua:193:
using default redis server for module history_redis
2018-05-03 14:31:04 #43917(main) <ehzkcx>; cfg;
rspamd_init_lua_filters: init lua module history_redis
2018-05-03 14:31:04 #43917(main) <ehzkcx>; lua; lua_redis.lua:193:
using default redis server for module ip_score
2018-05-03 14:31:04 #43917(main) <ehzkcx>; cfg;
rspamd_init_lua_filters: init lua module ip_score
2018-05-03 14:31:04 #43917(main) <ehzkcx>; cfg;
rspamd_init_lua_filters: init lua module maillist
2018-05-03 14:31:04 #43917(main) <ehzkcx>; cfg;
rspamd_config_is_module_enabled: lua module maps_stats is enabled but
has not been configured
2018-05-03 14:31:04 #43917(main) <ehzkcx>; cfg;
rspamd_config_is_module_enabled: maps_stats disabling unconfigured lua
module
2018-05-03 14:31:04 #43917(main) <ehzkcx>; cfg;
rspamd_init_lua_filters: init lua module metadata_exporter
2018-05-03 14:31:04 #43917(main) <ehzkcx>; cfg;
rspamd_init_lua_filters: init lua module metric_exporter
2018-05-03 14:31:04 #43917(main) <ehzkcx>; cfg;
rspamd_map_parse_backend: map '/usr/local/etc/rspamd/local.d/mid.inc'
is not found, but it can be loaded automatically later
2018-05-03 14:31:04 #43917(main) <ehzkcx>; cfg;
rspamd_init_lua_filters: init lua module mid
2018-05-03 14:31:04 #43917(main) <ehzkcx>; lua;
milter_headers.lua:549: active routines
[x-spamd-result,x-rspamd-server,x-rspamd-queue-id,x-spam-level,authentication-results]
2018-05-03 14:31:04 #43917(main) <ehzkcx>; cfg;
rspamd_init_lua_filters: init lua module milter_headers
2018-05-03 14:31:04 #43917(main) <ehzkcx>; cfg;
rspamd_map_parse_backend: map '/var/db/rspamd/mime_types.inc.local' is
not found, but it can be loaded automatically later
2018-05-03 14:31:04 #43917(main) <ehzkcx>; cfg;
rspamd_init_lua_filters: init lua module mime_types
2018-05-03 14:31:04 #43917(main) <ehzkcx>; lua; lua_redis.lua:193:
using default redis server for module multimap
2018-05-03 14:31:04 #43917(main) <fdp86m>; map; rspamd_map_add: added
map https://maps.rspamd.com/freemail/free.txt.zst
2018-05-03 14:31:04 #43917(main) <fdp86m>; map; rspamd_map_add: added
map https://maps.rspamd.com/freemail/free.txt.zst
2018-05-03 14:31:04 #43917(main) <k8f914>; map; rspamd_map_add: added
map https://maps.rspamd.com/freemail/disposable.txt.zst
2018-05-03 14:31:04 #43917(main) <ehzkcx>; lua; multimap.lua:899:
reuse url for FREEMAIL_CC:
"https://maps.rspamd.com/freemail/free.txt.zst"
2018-05-03 14:31:04 #43917(main) <xa6qqy>; map; rspamd_map_add: added
map https://rspamd.com/freemail/disposable.txt.zst
2018-05-03 14:31:04 #43917(main) <ehzkcx>; lua; multimap.lua:899:
reuse url for FREEMAIL_REPLYTO:
"https://maps.rspamd.com/freemail/free.txt.zst"
2018-05-03 14:31:04 #43917(main) <ehzkcx>; lua; multimap.lua:899:
reuse url for FREEMAIL_FROM:
"https://maps.rspamd.com/freemail/free.txt.zst"
2018-05-03 14:31:04 #43917(main) <fdp86m>; map; rspamd_map_add: added
map https://maps.rspamd.com/freemail/free.txt.zst
2018-05-03 14:31:04 #43917(main) <ehzkcx>; lua; multimap.lua:899:
reuse url for DISPOSABLE_FROM:
"https://maps.rspamd.com/freemail/disposable.txt.zst"
2018-05-03 14:31:04 #43917(main) <ehzkcx>; lua; multimap.lua:899:
reuse url for DISPOSABLE_TO:
"https://maps.rspamd.com/freemail/disposable.txt.zst"
2018-05-03 14:31:04 #43917(main) <ehzkcx>; lua; multimap.lua:899:
reuse url for DISPOSABLE_REPLYTO:
"https://maps.rspamd.com/freemail/disposable.txt.zst"
2018-05-03 14:31:04 #43917(main) <k8f914>; map; rspamd_map_add: added
map https://maps.rspamd.com/freemail/disposable.txt.zst
2018-05-03 14:31:04 #43917(main) <ehzkcx>; cfg;
rspamd_init_lua_filters: init lua module multimap
2018-05-03 14:31:04 #43917(main) <ehzkcx>; lua; lua_redis.lua:193:
using default redis server for module mx_check
2018-05-03 14:31:04 #43917(main) <ehzkcx>; cfg;
rspamd_init_lua_filters: init lua module mx_check
2018-05-03 14:31:04 #43917(main) <ehzkcx>; lua; lua_redis.lua:193:
using default redis server for module neural
2018-05-03 14:31:04 #43917(main) <ehzkcx>; lua; neural.lua:976:
register ann rule RFANN
2018-05-03 14:31:04 #43917(main) <ehzkcx>; cfg;
rspamd_init_lua_filters: init lua module neural
2018-05-03 14:31:04 #43917(main) <ehzkcx>; cfg;
rspamd_init_lua_filters: init lua module once_received
2018-05-03 14:31:04 #43917(main) <9i1dgi>; map; rspamd_map_add: added
map https://www.openphish.com/feed.txt
2018-05-03 14:31:04 #43917(main) <tr59c5>; map; rspamd_map_add: added
map https://rspamd.com/phishtank/online-valid.json.zst
2018-05-03 14:31:04 #43917(main) <uy18in>; map; rspamd_map_add: added
map /usr/local/etc/rspamd/redirectors.inc
2018-05-03 14:31:04 #43917(main) <ehzkcx>; cfg;
rspamd_map_parse_backend: map
'/usr/local/etc/rspamd/local.d/redirectors.inc' is not found, but it
can be loaded automatically later
2018-05-03 14:31:04 #43917(main) <9uy4r1>; map; rspamd_map_add: added
map /usr/local/etc/rspamd/local.d/redirectors.inc
2018-05-03 14:31:04 #43917(main) <ehzkcx>; cfg;
rspamd_init_lua_filters: init lua module phishing
2018-05-03 14:31:04 #43917(main) <ehzkcx>; cfg;
rspamd_config_is_module_enabled: lua module pyzor is enabled but has
not been configured
2018-05-03 14:31:04 #43917(main) <ehzkcx>; cfg;
rspamd_config_is_module_enabled: pyzor disabling unconfigured lua
module
2018-05-03 14:31:04 #43917(main) <ehzkcx>; lua; ratelimit.lua:506:
enabled rate buckets: []
2018-05-03 14:31:04 #43917(main) <ehzkcx>; lua; lua_redis.lua:193:
using default redis server for module ratelimit
2018-05-03 14:31:04 #43917(main) <ehzkcx>; cfg;
rspamd_init_lua_filters: init lua module ratelimit
2018-05-03 14:31:04 #43917(main) <ehzkcx>; cfg;
rspamd_config_is_module_enabled: lua module razor is enabled but has
not been configured
2018-05-03 14:31:04 #43917(main) <ehzkcx>; cfg;
rspamd_config_is_module_enabled: razor disabling unconfigured lua
module
2018-05-03 14:31:04 #43917(main) <ehzkcx>; cfg;
rspamd_init_lua_filters: init lua module rbl
2018-05-03 14:31:04 #43917(main) <ehzkcx>; lua; lua_redis.lua:193:
using default redis server for module replies
2018-05-03 14:31:04 #43917(main) <ehzkcx>; cfg;
rspamd_init_lua_filters: init lua module replies
2018-05-03 14:31:04 #43917(main) <ehzkcx>; cfg;
rspamd_config_is_module_enabled: lua module reputation is enabled but
has not been configured
2018-05-03 14:31:04 #43917(main) <ehzkcx>; cfg;
rspamd_config_is_module_enabled: reputation disabling unconfigured lua
module
2018-05-03 14:31:04 #43917(main) <pr5857>; map; rspamd_map_add: added
map https://updates.rspamd.com/rspamd-1.7.ucl
2018-05-03 14:31:04 #43917(main) <ehzkcx>; cfg;
rspamd_init_lua_filters: init lua module rspamd_update
2018-05-03 14:31:04 #43917(main) <ehzkcx>; cfg;
rspamd_init_lua_filters: init lua module settings
2018-05-03 14:31:04 #43917(main) <ehzkcx>; lua; spamassassin.lua:1597:
loaded 0 freemail domains definitions
2018-05-03 14:31:04 #43917(main) <ehzkcx>; lua; spamassassin.lua:1600:
loaded 0 blacklist/whitelist elements
2018-05-03 14:31:04 #43917(main) <ehzkcx>; cfg;
rspamd_init_lua_filters: init lua module spamassassin
2018-05-03 14:31:04 #43917(main) <ehzkcx>; cfg;
rspamd_config_is_module_enabled: lua module spamtrap is disabled in
the configuration
2018-05-03 14:31:04 #43917(main) <ehzkcx>; lua; trie.lua:167: no tries defined
2018-05-03 14:31:04 #43917(main) <ehzkcx>; cfg;
rspamd_init_lua_filters: init lua module trie
2018-05-03 14:31:04 #43917(main) <ehzkcx>; lua; lua_redis.lua:193:
using default redis server for module url_redirector
2018-05-03 14:31:04 #43917(main) <ehzkcx>; cfg;
rspamd_init_lua_filters: init lua module url_redirector
2018-05-03 14:31:04 #43917(main) <ehzkcx>; cfg;
rspamd_init_lua_filters: init lua module url_reputation
2018-05-03 14:31:04 #43917(main) <ehzkcx>; cfg;
rspamd_init_lua_filters: init lua module url_tags
2018-05-03 14:31:04 #43917(main) <ehzkcx>; cfg;
rspamd_map_parse_backend: map
'/var/db/rspamd/spf_dkim_whitelist.inc.local' is not found, but it can
be loaded automatically later
2018-05-03 14:31:04 #43917(main) <ehzkcx>; cfg;
rspamd_map_parse_backend: map
'/var/db/rspamd/dmarc_whitelist.inc.local' is not found, but it can be
loaded automatically later
2018-05-03 14:31:04 #43917(main) <ehzkcx>; cfg;
rspamd_map_parse_backend: map
'/usr/local/etc/rspamd/dkim_whitelist.inc' is not found, but it can be
loaded automatically later
2018-05-03 14:31:04 #43917(main) <ehzkcx>; cfg;
rspamd_map_parse_backend: map
'/var/db/rspamd/dkim_whitelist.inc.local' is not found, but it can be
loaded automatically later
2018-05-03 14:31:04 #43917(main) <ehzkcx>; cfg;
rspamd_map_parse_backend: map
'/usr/local/etc/rspamd/spf_whitelist.inc' is not found, but it can be
loaded automatically later
2018-05-03 14:31:04 #43917(main) <ehzkcx>; cfg;
rspamd_map_parse_backend: map '/var/db/rspamd/spf_whitelist.inc.local'
is not found, but it can be loaded automatically later
2018-05-03 14:31:04 #43917(main) <ehzkcx>; cfg;
rspamd_init_lua_filters: init lua module whitelist
2018-05-03 14:31:07 #43917(main) <ehzkcx>; cfg;
rspamd_map_parse_backend: map '/var/db/rspamd/rspamd_dynamic' is not
found, but it can be loaded automatically later
2018-05-03 14:31:07 #43917(main) <ykjbdn>; map; rspamd_map_add: added
map /var/db/rspamd/rspamd_dynamic
2018-05-03 14:31:07 #43917(main) <d09034>; re_cache;
rspamd_re_cache_init: loaded hyperscan engine with cpu tune 'haswell'
and features ''
2018-05-03 14:31:07 #43917(main) <56c2e5>; main; main: rspamd 1.7.4 is
starting, build id: release
2018-05-03 14:31:07 #43917(main) <56c2e5>; main; main: cpu features:
avx2, avx, sse2, sse3, ssse3, sse4.1, sse4.2, rdrand
2018-05-03 14:31:07 #43917(main) <56c2e5>; main; main: cryptobox
configuration: curve25519(avx), chacha20(avx2), poly1305(avx2),
siphash(avx2), blake2(avx), base64(avx2)
2018-05-03 14:31:07 #43917(main) <56c2e5>; main; main: libottery prf: AES-128
2018-05-03 14:31:07 #43917(main) <56c2e5>; main; spawn_worker_type:
skip spawning of worker fuzzy: disabled in configuration
2018-05-03 14:31:07 #43917(main) <56c2e5>; main; spawn_workers: worker
of type normal is disabled in the config, skip spawning
2018-05-03 14:31:07 #43917(main) <56c2e5>; main; main: listening for
control commands on /var/db/rspamd/rspamd.sock
2018-05-03 14:31:07 #45248(controller) <ehzkcx>; controller;
rspamd_controller_password_sane: enable password is not set, so you
should filter controller availability by using of firewall or
`secure_ip` option
2018-05-03 14:31:30 #44970(rspamd_proxy) <e09517>; proxy;

fuzzy_check_io_callback: got error on IO with server
fuzzy.rspamd.com(88.99.142.95), on write, 13, Permission denied

2018-05-03 14:31:30 #44970(rspamd_proxy) <e09517>; proxy;
rspamd_task_write_log: id:
<2018050318313...@mail.domain.com>, qid: <3D10E4BEF4C>, ip:
127.0.0.1, from: <ro...@domain.com>, (default: F (no action):
[0.20/999.00] [FORGED_SENDER(0.30){},MIME_GOOD(-0.10){text/plain;},ARC_NA(0.00){},ARC_SIGNED(0.00){i=1;},DKIM_SIGNED(0.00){},FROM_NEQ_ENVFROM(0.00){us...@domain.com;ro...@domain.com;},FROM_NO_DN(0.00){},RCPT_COUNT_ONE(0.00){1;},RCVD_COUNT_ZERO(0.00){0;},RCVD_TLS_ALL(0.00){},TO_DN_NONE(0.00){},TO_DOM_EQ_FROM_DOM(0.00){},TO_MATCH_ENVRCPT_ALL(0.00){}]),
len: 352, time: 141.941ms real, 14.520ms virtual, dns req: 0, digest:
<268251cdfbe9fd558e448dc133bbe259>, rcpts: <ro...@domain.com>,
mime_rcpts: <ro...@domain.com>
2018-05-03 14:31:30 #44970(rspamd_proxy) <e09517>; proxy;
rspamd_protocol_http_reply: regexp statistics: 0 pcre regexps scanned,
1 regexps matched, 226 regexps total, 89 regexps cached, 0B bytes
scanned using pcre, 611B bytes scanned total
2018-05-03 14:35:00 #44970(rspamd_proxy) <e7e1ce>; proxy;

fuzzy_check_io_callback: got error on IO with server
fuzzy.rspamd.com(88.99.142.95), on write, 13, Permission denied

2018-05-03 14:35:00 #44970(rspamd_proxy) <e7e1ce>; proxy;
rspamd_task_write_log: id:
<2018050318350...@mail.domain.com>, qid: <194354BED3F>, ip:
127.0.0.1, from: <us...@domain.com>, (default: F (no action):
[0.20/999.00] [FORGED_SENDER(0.30){},MIME_GOOD(-0.10){text/plain;},ARC_NA(0.00){},FROM_HAS_DN(0.00){},FROM_NEQ_ENVFROM(0.00){user@hostname;us...@domain.com;},RCPT_COUNT_ONE(0.00){1;},RCVD_COUNT_ZERO(0.00){0;},RCVD_TLS_ALL(0.00){},TO_DN_NONE(0.00){},TO_MATCH_ENVRCPT_ALL(0.00){}]),
len: 438, time: 124.074ms real, 5.437ms virtual, dns req: 0, digest:
<b2cc46f56b341b1db54de6a9b84ef608>, rcpts: <us...@domain.com>,
mime_rcpts: <us...@domain.com>
2018-05-03 14:35:00 #44970(rspamd_proxy) <e7e1ce>; proxy;
rspamd_protocol_http_reply: regexp statistics: 0 pcre regexps scanned,
1 regexps matched, 226 regexps total, 89 regexps cached, 0B bytes
scanned using pcre, 428B bytes scanned total
2018-05-03 14:36:11 #44970(rspamd_proxy) <62bd6b>; proxy;

fuzzy_check_io_callback: got error on IO with server
fuzzy.rspamd.com(88.99.142.95), on write, 13, Permission denied

2018-05-03 14:36:15 #44970(rspamd_proxy) <62bd6b>; proxy;
rspamd_task_write_log: id:
<0.0.0.56.1D3E30...@mail.1502.us>, qid: <1E69D4BEE11>,
ip: 174.136.110.154, from: <1ink-user=domai...@1502.us>, (default: F
(rewrite subject): [13.42/999.00]
[R_SUSPICIOUS_IMAGES(2.89){},IP_SCORE(2.70){ip: (5.71), ipnet:
174.136.96.0/20(4.57), asn: 25795(2.85), country:
US(0.35);},HFILTER_URL_ONELINE(2.50){html:0:1;},DCC_BULK(2.00){bulk
Body=1 Fuz1=1 Fuz2=many;},HTML_SHORT_LINK_IMG_1(2.00){},MX_INVALID(1.00){greylisted;},HFILTER_URL_ONLY(0.89){0.4047619047619;},DMARC_POLICY_ALLOW(-0.25){1502.us;none;},R_DKIM_ALLOW(-0.20){1502.us;},MIME_GOOD(-0.10){multipart/alternative;text/plain;},HAS_LIST_UNSUB(-0.01){},ARC_NA(0.00){},ASN(0.00){asn:25795,
ipnet:174.136.96.0/20,
country:US;},DKIM_TRACE(0.00){1502.us:+;},FORGED_SENDER_VERP_SRS(0.00){},FROM_HAS_DN(0.00){},FROM_NEQ_ENVFROM(0.00){1i...@1502.us;1ink-user=domai...@1502.us;},RCPT_COUNT_ONE(0.00){1;},RCVD_COUNT_ZERO(0.00){0;},RCVD_TLS_ALL(0.00){},R_SPF_NEUTRAL(0.00){?all;},TO_DN_NONE(0.00){},TO_MATCH_ENVRCPT_ALL(0.00){}]),
len: 4970, time: 4215.563ms real, 18.808ms virtual, dns req: 35,
digest: <98f2184d643b2487cb1c130aeb707ac8>, rcpts: <us...@domain.com>,
mime_rcpts: <us...@domain.com>
2018-05-03 14:36:15 #44970(rspamd_proxy) <62bd6b>; proxy;
rspamd_protocol_http_reply: regexp statistics: 0 pcre regexps scanned,
3 regexps matched, 226 regexps total, 89 regexps cached, 0B bytes
scanned using pcre, 4.63k bytes scanned total
2018-05-03 14:38:30 #44970(rspamd_proxy) <9fabf3>; proxy;

fuzzy_check_io_callback: got error on IO with server
fuzzy.rspamd.com(88.99.142.95), on write, 13, Permission denied

2018-05-03 14:38:30 #44970(rspamd_proxy) <9fabf3>; proxy;
rspamd_task_write_log: id:
<2018050318383...@mail.domain.com>, qid: <1DBD74BED3F>, ip:
127.0.0.1, from: <ro...@domain.com>, (default: F (no action):
[0.20/999.00] [FORGED_SENDER(0.30){},MIME_GOOD(-0.10){text/plain;},ARC_NA(0.00){},ARC_SIGNED(0.00){i=1;},DKIM_SIGNED(0.00){},FROM_NEQ_ENVFROM(0.00){us...@domain.com;ro...@domain.com;},FROM_NO_DN(0.00){},RCPT_COUNT_ONE(0.00){1;},RCVD_COUNT_ZERO(0.00){0;},RCVD_TLS_ALL(0.00){},TO_DN_NONE(0.00){},TO_DOM_EQ_FROM_DOM(0.00){},TO_MATCH_ENVRCPT_ALL(0.00){}]),
len: 352, time: 131.649ms real, 11.299ms virtual, dns req: 0, digest:
<13b3855f7f3a56bb7a5ef5fc5c4807fe>, rcpts: <ro...@domain.com>,
mime_rcpts: <ro...@domain.com>
2018-05-03 14:38:30 #44970(rspamd_proxy) <9fabf3>; proxy;
rspamd_protocol_http_reply: regexp statistics: 0 pcre regexps scanned,
1 regexps matched, 226 regexps total, 89 regexps cached, 0B bytes
scanned using pcre, 611B bytes scanned total

headers:
Return-Path:
<ro...@domain.com>
Delivered-To:
us...@domain.com
Received:
from mail.domain.com by mail.domain.com with LMTP id

yvWHFyZX61r8VwEA0J78UA (envelope-from <ro...@domain.com>) for
<us...@domain.com>; Thu, 03 May 2018 14:38:30 -0400
Authentication-Results:
hostname

DKIM-Signature:
v=1; a=rsa-sha256; c=relaxed/relaxed; d=domain.com; s=dkim;

t=1525372710; h=from:from:sender:reply-to:subject:subject:date:date:

message-id:message-id:to:to:cc:mime-version:content-type:
content-transfer-encoding:in-reply-to:references;

bh=wR6vKxuzFaJrs4Ebsrg7EaTevMNXJChQfPy7IhekKpk=; b=h669/Ybj.. Show
ARC-Authentication-Results:
i=1; hostname
ARC-Seal:
i=1; s=dkim; d=domain.com; t=1525372710; a=rsa-sha256; cv=none;
b=AlNHugJhk7uXpEuCbD4bioUoxGlTlXW87RHnhxoEEUVa23r+5huGfTeeDvYqOf1oEYIJX48a57ckEMwbLGy1ImYDz+MfaeCeEhkMFgv+vQpBcW7QhnvXsIYNKMg/kpr5nEKk4qRLOPa+wwdYPO/ReqdQxzGYcPxdm06rX75TFDmsGwA7Mz+RYB7RFgq3DEBzw8/LPsBriuZmnleEUcH9p/Nqf91S9eDNfuZHUV..
Show

ARC-Message-Signature:
i=1; a=rsa-sha256; c=relaxed/relaxed; d=domain.com; s=dkim;

t=1525372710; h=from:from:sender:reply-to:subject:subject:date:date:

message-id:message-id:to:to:cc:mime-version:content-type:
content-transfer-encoding:in-reply-to:references;

bh=wR6vKxuzFaJrs4Ebsrg7EaTevMNXJChQfPy7IhekKpk=; b=H/4/RvSR.. Show

To:
ro...@domain.com
From:
us...@domain.com
Auto-Submitted:
auto-generated
Subject:

*** Spam: SECURITY information for hostname ***
Message-Id:
<2018050318383...@mail.domain.com>
Date:
Thu, 3 May 2018 14:38:30 -0400 (EDT)
X-Rspamd-Queue-Id:
1DBD74BED3F
X-Spamd-Result:
default: False [0.20 / 999.00]; RCVD_COUNT_ZERO(0.00)[0];
ARC_NA(0.00)[]; RCPT_COUNT_ONE(0.00)[1]; TO_MATCH_ENVRCPT_ALL(0.00)[];
TO_DN_NONE(0.00)[];
FROM_NEQ_ENVFROM(0.00)[us...@domain.com,ro...@domain.com];
FORGED_SENDER(0.30)[]; DKIM_SIGNED(0.00)[];
TO_DOM_EQ_FROM_DOM(0.00)[]; FROM_NO_DN(.. Show

X-Rspamd-Server:
hostname
X-PWhois-Status:
No originator identified

Flags:
\Seen