Mdaemon. What filters mail to the spam folder?

Question

Mail server

I came across an interesting behavior of the mdaemon mailer.

Some emails end up in the "Junk E-mail" folder even if the sender is whitelisted, even if spam filtering is disabled. And the most interesting thing is that one user has all the mail of another user of the same domain also goes to spam.

Started white lists, trained spam filter, turned off spam filter, deleted all filtering rules from the user - nothing helps. And not all mail, but only some letters, some go through.

I thought the user had an antivirus, but no (disabled / deleted).

Help defeat filtering!

Spam header example:

X-MDAV-Result: clean
X-MDAV-Processed: XXXXXX.ru, Mon, 19 Jul 2021 04:13:06 +0300
Return-path:
Authentication-Results: XXXXXX.ru;
spf=pass [email protected];
dkim=pass (good signature) header.d=meshok.net header.b=mRqJ1G+ZFk;
dmarc=pass header.from=mail.meshok.net (p=reject sampling=98 pct=100);
iprev=pass policy.iprev=94.130.174.226 (PTR mail2.meshok.net);
iprev=pass policy.iprev=94.130.174.226 (HELO mail2.meshok.net);
iprev=pass policy.iprev=94.130.174.226 (MAIL [email protected])
Received-SPF: pass (XXXXXX.ru: domain mail.meshok.net
designates 94.130.174.226 as permitted sender)
receiver=XXXXXX.ru; client-ip=94.130.174.226;
mechanism=a; envelope-from="[email protected]";
helo=mail2.meshok.net;
Received: from mail2.meshok.net (mail2.meshok.net [94.130.174.226]) by XXXXXX.ru
with ESMTPS id md50001683395.msg; Mon, 19 Jul 2021 04:13:05 +0300
X-Spam-Processed: XXXXXX.ru, Mon, 19 Jul 2021 04:13:05 +0300
(not processed: spam filter heuristic analysis disabled)
X-MDDKIM-Result: unapproved (XXXXXX.ru)
X-MDSPF-Result: unapproved (XXXXXX.ru)
X-MDRemoteIP: 94.130.174.226
X-MDHelo: mail2.meshok.net
X-MDArrival-Date: Mon, 19 Jul 2021 04:13:05 +0300
X-Rcpt-To: [email protected]
X-MDRcpt-To: [email protected]
X-Return-Path: [email protected]
X-Envelope-From: [email protected]
X-MDaemon-Deliver-To: [email protected]
Received: by mail2.meshok.net (8.15.2/8.15.2/Debian-8+deb9u1) with ESMTPS id 16J1D4jV011146; Mon, 19 Jul 2021 04:13:04 +0300
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=meshok.net;
s=default; t=1626657184;
bh=i+H1Ltf83c5rlejOdkC4kATsYsZUfeXZci9UMZyxWwE=;
h=Date:To:From:Reply-To:Subject:From;
= mRqJ1G + b ZFkdVS4vdXKtoD8gXJVryoF768uj7UHz9UARFKnBMPk2grwfgZOIP8svR6
VmNr9fGKFOTE460E0V92813F5AyEyBaTYywCQnPNxKZY + 7z / WJu5wsUebjNm + GyKhT
i9a2PsTQFSu / 2wcl5 / nzj0n Sl1FxSWNRMn4KHOU + =
Received: (from root @ localhost)
by mail2.meshok.net (8.15.2 / 8.15.2 / Submit) id 16J1D4tf011132;
Mon, 19 Jul 2021 04:13:04 +0300
Date: Mon, 19 Jul 2021 04:13:04 +0300
To: [email protected]
From: =?utf-8?B?0JzQtdGI0L7Qujog0J/QvtC00L/QuNGB0LrQsA== ?=
Reply-To: =?utf-8?B?0JzQtdGI0L7Qujog0J/QvtC00L/QuNGB0LrQsA==?=
Subject: =?utf-8?B?NTAg0YbQtdC90YLQvtCyICjQnNC10YLQsNC70Ls6INCh0LXRgNC10LHRgNC+?== ?
utf-8?B=? K
-ID: <[email protected]>
X-Priority: 3
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="b1_709123ef57c66312e21af4ecba5d4478"

Answer 1

mdaemon uses Spamassassin as a spam filter - You wrote that you set up whitelists - put in the whitelist settings, let's say "-500" to the spam score - then the message should definitely not be qualified as spam.
If even after this the letters will fall into the spam folder, then it’s definitely the user who has tricked himself into filtering - you have to hit the playful hands with a stick!