Hello,

a user of my server has a strange problem, all of his outgoing emails are marked as spam
with the subject ***SPAM***LOW

I guess this is done by clamav?

Any ideas on how to correct this? or even stop spamassassin/clamav from changing the subject to outgoing emails?

It is done by spamassassin.

The actual subject is set in /etc/mail/spamassassin/local.cf but if you have qmail-scanner then it is set in /etc/qmail-scanner.ini and from the subject you posted it looks like you have qmail-scanner installed.

As to what to do to resolve this, well, the first thing to do is find the cause. In /usr/local/psa/var/log/maillog try to find the entries relating to the email being sent, to see if anything is logged.

Some things that may be the cause include their public IP being on one or more blacklist or dynamic list, or being treated as such at least.

in local.cf you can add things like whitelist_from (e.g. whitelist_from *@domain.tld) which will whielist email "from" that particular sender's address. Of course if a spammer fakes their address and sends them spam, it won't be flagged.

You can also add things like trusted_networks aa.bb.cc.dd to trust IPs or subnets

There is a long thread somewhere -- either here or on the parallels forums, on attempts to stop spamassassin treating any email sent via authenticated smtp from being marked as spam. As I recall, the suggestions didn't work. I certainly never managed to make them work at any rate.

Faris.

If you use port 587 (make sure you have enabled Submission in Plesk) to send e-mail using auth via your qmail-scanner server then outgoing e-mail should be fine.

Really? I didn't know it could tell the difference. That's interesting and great.

And definitely find the cause... if your system is tagging his mail as spam the rest of us will probably tag his mail as spam too.