Amavis Mark Email as Spam, Automatically Move Spam to Junk Spam Folder

So I've been doing some experimenting this weekend with the idea of what to do with suspected junk/spam email and whether we should leave it up to the end user to deal with it, or get the server to do something about it. With iRedMail installed, Dovecot, Postfix and Amavis can take care of this for you, to whatever level you wish.

If you want, you could just have suspected email have a special "tag" added to the subject and then your users can use this to create their own rules to do what they want with it. I want to go one step further, I want "tagged" spam mail to automatically get put into the spam folder. This way, users can still check if they want to, but it will keep their main inbox folder clean and tidy.

Ok, so how do we automatically move spam emails to the junk folder? It's a multistep process..

The first thing we need to do is make sure that all of your domains are included in the Amavis list to be checked and tagged (by default, iRedMail will only do this with your initial/main/Fully Qualified Domain Name). So, thanks to the official iRedMail Forum's user "cmjnissen" for this).

Edit the Amavis configuration file (Ubuntu 12.04 location : /etc/amavis/conf.d/50-user)

Find and comment out the line

#@local_domains_maps = ( [".mydomain.com"] );

and add all of the domains that you host

This ensures all of them are checked and tagged for spam. So now we need to make sure that all emails have a tag added to their subject. We need to scroll down (or search with 'CTRL+w') to the line with the variable "$sa_spam_subject_tag" and make sure it is set to "1". By default, Amavis will fall back to the default settings (/etc/amavis/conf.d/20-debian_defaults) and add the tag "***SPAM***" to the subject line. If you want to change this, add a "$sa_spam_subject_ta" variable to the 50-user configuration with a string that you wish to use. (More info can be found here).

With a quick "sudo service amavis restart", you can now check the headers in any (newly) received emails and you should see spam flags such as :

X-Spam-Flag: NO
X-Spam-Score: 0
X-Spam-Level: 
X-Spam-Status: No, score=0 tagged_above=-999 required=4
    tests=[RCVD_IN_DNSWL_NONE=-0.0001] autolearn=ham

Ok, so now we have tagged spam emails, we need to move them to the junk folder automatically. Firstly, we need to set the Dovecot "sieve" file to be used. So, edit the file "/etc/dovecot/dovecot.conf" and scroll to the "# Global sieve settings." section and edit the variable "sieve_global_path" so it is as follows: "sieve_global_path = /var/vmail/sieve/dovecot.sieve". Before restarting Dovecot, we need to make sure that the sieve file exists, so CD to "/var/vmail/sieve" you will need to do this as root, so "sudo -i" first.

List everything in the directory and you should see a file named "dovecot.sieve.sample" copy it to "dovecot.sieve" (

cp dovecot.sieve.sample dovecot.sieve"

). Now, change the permissions to 0700 (

chmod 0700 dovecot.sieve

) and change the owner and group to vmail (

chown vmail:vmail dovecot.sieve

). (Have a look at the file and you will see and "if" statement that designates anything with the "X-Spam-Flag" header as "Yes", will be moved to the "Junk" folder:

if header :is "X-Spam-Flag" "YES"
{
    fileinto "Junk";
    stop;
}

Finally, restart dovecot and you should see any new spam emails automatically pushed to the Junk folder. Rather than waiting for a spam email to come through, you can send one to yourself (from an external server, such as gmail), with the GTUBE (Generic Test for Unsolicited Bulk Email) content, found here :

Subject: Test spam mail (GTUBE)

Content:
This is the GTUBE, the
 Generic
 Test for
 Unsolicited
 Bulk
 Email

XJS*C4JDBQADN1.NSBN3*2IDNEN*GTUBE-STANDARD-ANTI-UBE-TEST-EMAIL*C.34X

So there we go, automatically move spam to your junk folder.