In WHM or cPanel I have configured MailScanner to delete all high-scoring spam, but emails marked with {Definitely Spam?} are still being delivered to domains on the server. What is wrong?

1. Check the ruleset files (usr/mailscanner/etc/rules/spamhigh.action.rules for high-scoring spam or spam.action.rules for low-scoring spam) to see if it actually is listed correctly as "delete" for the domain(s) in question.

2a. If it IS correct in the ruleset files, make sure that if another domain's email is being forwarded to the first domain, the forwarded domain also has the same setting in the cPanel front-end and the ruleset files.

2b. If it is NOT correct in the ruleset files, check the individual domain's cPanel settings for MailScanner (if enabled) to ensure that they have not already set it to Deliver or Forward.

3. You should always ensure that crond is running; if it isn't, restart crond (type 'service crond restart' at the shell prompt).

4. Make sure that the spam emails are definitely being delivered and not deleted. You cannot go by what it says for the action in MailWatch as that is not always accurate. Test an actual account to make sure that emails marked as definitely spam are still being delivered.

Was this answer helpful?

Related Articles

cPanel MailScanner Install/Upgrade Package

Please read this whole page before downloading the package Through our experience of...

Mailscanner front end

cd /usr/src/rm -fv msfe*wget http://www.configserver.com/free/msfeinstaller.tgz tar -xzf...

How can I get the MailScanner configuration to appear in the Xmail cPanel theme?

Do the following steps: cd /usr/local/cpanel/base/frontend/xmail ln -s ../x/cells/ pico -w...

How can I filter spam by blackhole lists such as spamcop.net?

In WHM > MailScanner > MailScanner Configuration you will find a setting for 'Spam List =...

What does the {Disarmed?} tag mean and can I disable it?

The {Disarmed} tag is added by MailScanner when it has detected and disarmed potentially...