Whitelisted sender mail coming in to Junk.

Problem reported by Chris Danks - 9/22/2026 at 1:59 AM

Submitted

Hello,

We're running SmarterMail Build 9756 and noticed an issue, whitelisted senders are still going to spam folder.

SMTP Log for the particular email:

[2026.09.21] 18:22:37.024 [37428634] Delivery started for sender@gmail.com at 18:22:37
[2026.09.21] 18:22:40.031 [37428634] Added to SpamCheckQueue (1 queued; 2/30 processing)
[2026.09.21] 18:22:40.031 [37428634] [SpamCheckQueue] Begin Processing.
[2026.09.21] 18:22:40.038 [37428634] Blocked Sender Checks started.
[2026.09.21] 18:22:40.055 [37428634] Blocked Sender Checks completed.
[2026.09.21] 18:22:40.055 [37428634] [Cyren Client] Start Scanning Message. Enabled Services: All, MailFrom: sender@gmail.com, SenderIP: 74.125.227.147, MessagePath: C:/SmarterMail/Spool/SubSpool3/37428634.eml
[2026.09.21] 18:22:41.053 [37428634] [Cyren Client] Done Scanning Message. MessagePath: C:/SmarterMail/Spool/SubSpool3/37428634.eml Results AV: Unknown, AS: Unknown, RefID: str=0001.0A2D031A.6AB167E1.0021,ss=1,re=0.000,recu=0.000,reip=0.000,cl=1,cld=1,fgs=0
[2026.09.21] 18:22:41.054 [37428634] Spam Checks started.
[2026.09.21] 18:22:41.071 [37428634] Message exceeds maximum scanning size, skipping content based checks.
[2026.09.21] 18:22:41.071 [CyrenIP Client] Cyren Daemon already started. (2)18:22:41.297 [37428634] [CyrenIP Client] Done Scanning IP Address. IP Address: 74.125.227.147 Reputation: Low, Score: 70, IPClass: T3
[2026.09.21] 18:22:41.383 [37428634] Finished running spam checks. Time (non-rbls): 311ms, Time (URIBL/RBLS): 0ms
[2026.09.21] 18:22:41.384 [37428634] Spam Check results: [REVERSE DNS LOOKUP: 0,Passed], [_SPF: 0,Pass], [SPAMHAUS: 0], [BACKSCATTER: 0], [UCEPROTECT LEVEL 2: 0], [TRUNCATE: 0], [HOSTKARMA: 5], [SURRIEL: 0], [SEM - BLACK: 0], [UCEPROTECT LEVEL 1: 0], [BARRACUDA: 0], [SPAMCOP: 0], [_DMARC: 0,passed], [NULL SENDER: 0,passed], [_CYREN: 0,Unknown], [_CYRENIP: 0,LOW], [_DKIM: 0,Pass], [_ARC: pass]
[2026.09.21] 18:22:41.384 [37428634] Spam Checks completed.
[2026.09.21] 18:22:41.389 [37428634] Removed from SpamCheckQueue (0 queued or processing)
[2026.09.21] 18:22:43.066 [37428634] Added to LocalDeliveryQueue (1 queued; 2/50 processing)
[2026.09.21] 18:22:43.066 [37428634] [LocalDeliveryQueue] Begin Processing.
[2026.09.21] 18:22:43.103 [37428634] Starting local delivery to info@redacted.net
[2026.09.21] 18:22:43.126 [37428634] Skipping spam filtering: Trusted Sender (user level)
[2026.09.21] 18:22:43.197 [37428634] Message saved to MailProcessing directory for info@redacted.net. File name: 37428634-50002-NOID.tmpmsg
[2026.09.21] 18:22:43.197 [37428634] Process delivery status notification step from local recipient success. Recipient: [info@redacted.net], Notify: [], Delivered: [True], Forwarded: [False], Deleted: False
[2026.09.21] 18:22:43.198 [37428634] Delivery for sender@gmail.com to info@redacted.net has completed (Delivered) Filter: None
[2026.09.21] 18:22:43.198 [37428634] End delivery to info@redacted.net (MessageID: <CA+Eoc78OUsVfkNY_67dM2d0d1XLodAm7H-sS1QEvLe4vEVnF3g@mail.gmail.com>)
[2026.09.21] 18:22:43.198 [37428634] Removed from LocalDeliveryQueue (0 queued or processing)
[2026.09.21] 18:22:46.076 [37428634] Removing Spool message: Killed: False, Failed: False, Finished: True
[2026.09.21] 18:22:46.076 [37428634] Delivery finished for sender@gmail.com at 18:22:46    [id:37428634]

This issue happened not too long after we enabled spamfoo, could it be related?

7 Replies

Reply to Thread

terry fairbrother Replied

9/22/2026 at 3:03 AM

I have a custom anti spam rule with weights 'good' email addresses with -300 so it ensures they arrive

Chris Danks Replied

9/22/2026 at 3:09 AM

sounds like a good workaround but not a fix!

did you have this issue before spamfoo or only since enabling it?

terry fairbrother Replied

9/22/2026 at 3:26 AM

before spamfoo. But after spamfoo the number of false positives did increase and it was taking too much of my time to go into the spamfoo console and 'not spam'-ing emails / domains and reporting them

Millennium Systems Replied

9/22/2026 at 9:14 AM

Terry,

Did you check the Delivery log for more details? The SMTP log really doesn't provide the full picture.

terry fairbrother Replied

9/22/2026 at 9:52 AM

just looked in the header to see what weights had been applied with RspamD and spamfoo

Tony Scholz Replied

9/30/2026 at 4:05 PM

Employee Post

Hello Chris,

Looking at this line;

[2026.09.21] 18:22:43.198 [37428634] Delivery for sender@gmail.com to info@redacted.net has completed (Delivered) Filter: None

The message was delivered to the user’s inbox. If it appears in the “Junk Email” folder, it was relocated after delivery—either by the end user or a connected email client.

To troubleshoot this issue effectively, identify the devices from which the user connects and the protocols employed. Review the connected devices for configured filters and examine their logs to determine when the message was moved.

Administrative logs will record any relocations performed via webmail.

Webmail

# Move messages (via webmail):
[2026.05.08] 08:20:15 [192.168.1.50] User admin@domain.com (user@domain.com) calling move messages, owner: user@domain.com, folder: Inbox, newOwner: user@domain.com, new folder: Archive, count: 3

# Delete messages (via webmail):
[2026.05.08] 08:20:15 [192.168.1.50] User admin@domain.com (user@domain.com) calling delete messages, folder: Inbox, owner: user@domain.com, all: , count: 1

IMAP example

[2026.05.08] 08:16:50.123 [192.168.1.50][abc123def] connected at 5/8/2026 8:16:50 AM
[2026.05.08] 08:16:50.456 [192.168.1.50][abc123def] user@domain.com logged in
[2026.05.08] 08:16:50.789 [192.168.1.50][abc123def] command: SELECT "Inbox"
[2026.05.08] 08:16:51.100 [192.168.1.50][abc123def] response: * OK [UIDVALIDITY 1234] ...
[2026.05.08] 08:16:55.200 [192.168.1.50][abc123def] command: UID MOVE 1234 "Deleted Items"
[2026.05.08] 08:17:00.300 [192.168.1.50][abc123def] disconnected at 5/8/2026 8:17:00 AM

EWS example

[2026.05.08] 08:16:50.123 [192.168.1.50,user@domain.com,a1b2c3d4-e5f6-7890-abcd-ef1234567890,Microsoft Office/16.0 (Windows NT 10.0; Microsoft Outlook 16.0.12345; Pro)] 
IN << req#a1b2c3d4-e5f6-7890-abcd-ef1234567890 << (xml)
<MoveItem>...</MoveItem>

[2026.05.08] 08:16:50.456 [192.168.1.50,user@domain.com,a1b2c3d4-e5f6-7890-abcd-ef1234567890,Microsoft Office/16.0 ...] 
OUT >> req#a1b2c3d4-e5f6-7890-abcd-ef1234567890 >> (xml:200)
<MoveItemResponse>...</MoveItemResponse>

Thank you

Tony Scholz

Lead Network/System Administrator

SmarterTools Inc.

www.smartertools.com

Chris Danks Replied

10/1/2026 at 5:27 AM

I'll re-enable spamfoo and next time someone reports it i'll log a ticket if i cant find the cause.

Back to Community Threads

Reply to Thread

Enter the verification text