Rspamd soft-reject emails with getMail (rowihei)

Hallo,
there is a new problem with emails. Some of them are soft reject by spamd, but there was no changing we made… and senders are OK:

Website of firma.de:980/rspamd/ shows this for the special email:

SUBJ_ALL_CAPS (0.15) [2]
RCVD_NO_TLS_LAST (0.1)
RCVD_COUNT_THREE (0) [4]
PREVIOUSLY_DELIVERED (0) [muster.mann@firma.de]
FROM_EQ_ENVFROM (0)
HAS_XOIP (0)
GENERIC_REPUTATION (0) [-0.063842656585994]
HAS_ATTACHMENT (0)
FROM_HAS_DN (0)
RCPT_COUNT_ONE (0) [1]
TO_DN_ALL (0)
MIME_TRACE (0) [0:+,1:+,2:+,3:~,4:~]
MIME_GOOD (-0.1) [multipart/mixed,multipart/alternative,text/plain]

What means this ? What is wrong there ? What should we do ?
Thanks for every advice

Rspamd does a soft reject, it means in short a ‘try again later’, the remote smtp will represents again the email in few time. It is not a rejection

This is due to reduce spam, some spammer smtp could not try again, it a way to protect your server.

The sender was good for you but the score is hight >6

If you want you can disable the greylisting and soft rejection should be stopped

soft reject is also called grey-listing. As @stephdl says, it will ask the sending smtp server to send again. In most cases the mail will be accepted after resending.

1 Like

15 posts were split to a new topic: Rspamd soft reject email with getMail (wbilger)

A decent configured SMTP server will ALWAYS resend when a greylist notification is received…

Maybe this is related: https://github.com/rspamd/rspamd/issues/2360
Can you comment on this @stephdl?

think you are right. We also use pop3-connector to get emails from smarthost.
Now I disabled spamd - service. But emails don’t come in - they stay on the smarthost.
Will wait till tomorrow

Good morning,
last night I disabled rspamd - no effect. 3…5 mails are “hanging” at the smarthost.
The rspamd statistics are looking “normal” - take a look

To completely disable greylisting
in /etc/rspamd/override.d/greylist.conf
with
enabled = false;

then restart rspamd

systemctl restart rspamd

if I make a point you use getmail to fetch the email, but they have had softreject by the server

does it is exact ?

In that particular case we do should to disable soft reject when getmail is installed

This support has been made from the cafeteria of the fosdem :smiley:

1 Like

I don’t agree.
If I am consolidating a mailserver for different external email addresses, getmail still be useful for retrieve old stuff and “wrong messages” from the old emailboxes.
Therefore, greylisting should be still be provided for hosted email boxes and addresses on the server.

The point is if the email is soft rejected and removed from the remote imap/pop account, then it cannot be retrieved again.

Good morning,

  • checked emails at smarthost - the email from 31.01.2020 stay there !
  • checked /var/log/mail.log and found only one line about this email (names are changed):

Jan 31 12:20:11 msrv rspamd[26880]: ; csession; rspamd_task_write_log: id: 0BD77A246CF70C44B8A90035533ADC4F020B2AF748@srvexchDB01.ikkclassic.local, ip: 127.0.0.1, from: emil.mueller@ikk-classic.de, (default: F (soft reject): [0.15/20.00] [SUBJ_ALL_CAPS(0.15){2;},MIME_GOOD(-0.10){multipart/mixed;multipart/alternative;text/plain;},RCVD_NO_TLS_LAST(0.10){},FROM_EQ_ENVFROM(0.00){},FROM_HAS_DN(0.00){},GENERIC_REPUTATION(0.00){-0.063842656585994;},HAS_ATTACHMENT(0.00){},HAS_XOIP(0.00){},MIME_TRACE(0.00){0:+;1:+;2:+;3:~;4:~;},PREVIOUSLY_DELIVERED(0.00){steffen.jacob@eds-systeme.de;},RCPT_COUNT_ONE(0.00){1;},RCVD_COUNT_THREE(0.00){4;},TO_DN_ALL(0.00){}]), len: 591623, time: 8023.068ms, dns req: 7, digest: <41f96f9674cbe608547867299d13c507>, mime_rcpts: muster.mann@firma.de, file: stdin, forced: soft reject “timeout processing message”; score=nan (set by task timeout)
Jan 31 12:20:11 msrv rspamd[26880]: ; csession; rspamd_protocol_http_reply: regexp statistics: 0 pcre regexps scanned, 2 regexps matched, 184 regexps total, 94 regexps cached, 0B scanned using pcre, 17.70KiB scanned total
Jan 31 12:20:11 msrv dovecot: lda(user01@eds.lan): sieve: msgid=0BD77A246CF70C44B8A90035533ADC4F020B2AF748@srvexchDB01.ikkclassic.local: marked message to be discarded if not explicitly delivered (discard action)
Jan 31 12:20:11 msrv getmail: msg 497/497 (599418 bytes) msgid 000093425134513e from emil.mueller@ikk-classic.de delivered to MDA_external command dovecot-lda ()
Jan 31 12:20:20 msrv clamd[2729]: Database correctly reloaded (6895964 signatures)

Yesterday I stopped greylist with enable = false in /etc/rspamd/override.d/greylist.conf (new file created)
Since 02.02.2020 at 6 o’clock there “thousands” of this lines:
Feb 2 06:54:24 msrv rspamd[11266]: ; map; http_map_error: error reading https://maps.rspamd.com/freemail/free.txt.zst(88.99.142.95:443): connection with http server terminated incorrectly: ssl connect error: ssl error: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed
Feb 2 06:54:25 msrv rspamd[11266]: ; map; http_map_error: error reading https://maps.rspamd.com/freemail/disposable.txt.zst(88.99.142.95:443): connection with http server terminated incorrectly: ssl connect error: ssl error: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed

I don’t think, that we are on the right trace …

it is not under our control, maps.rspamd.com is not on our resources, either you had a network issue, or rspamd from upstream got an undetermined issue

for what I read, your email has been well soft-rejected

it is officially a rspamd issue from a lets encrypt certificate

1 Like

I would like you try to increase the task_timeout = 8s; in /etc/rspamd/rspamd.conf

It is a template so any settings change in the filter panel will erase your change.

Lets say 15s

think to restart rspamd

cc @davidep

we have a timeout of 120s for getMail, in theory we should have the same

Which is why softreject should NEVER be applied against POP or IMAP access of mailboxes, only unsolicited mail received directlyat the server.

Cheers.

This is not related to greylist, but due to a task timeout

Exactly, how do I disable soft rejects, greylisting is disabled.