Blocklist?

Michael,
I’ve taken one of your scripts and modified it to process messages out of mail folders that I call “Train Good”, “Train Spam” and “TrainTrash”. When I have a message in my Junk folder that I never want to see again ever, I put it in “TrainTrash” and the script runs every 5 minutes processing those three mailboxes. TrainTrash processes it’s messages through this procedure:

The issue I’m having is that messages are still appearing in the Junk mailbox instead of being sent directly to trash. Here is a message I received today that SpamSieve did not put in the Trash but apparently is in the blocklist. Notice that it was received this morning in my Junk mailbox and that the name and address are both in the block list but were not matched so it was put in Junk and not Trash. What could be wrong? The only thing I know that I’m having an issue with is my script, for some reason, ocassionally gets a timeout and puts up a dialog (and I haven’t found where yet), but I don’t know why that should effect SpamSieve if my script is hung up on the dialog message.

Thanks

Rand

Could this be because of iCloud Junk filtering? Can SpamSieve rescan the Spam mailbox again and put these messages in the trash? Would that work? Is there a script example for that?

Thanks

Rand

I see that the messages in your screenshot have no background color, which makes me wonder whether they were moved to Junk by a server filter so that Apple Mail and SpamSieve never processed them. What does SpamSieve’s Log window say about these messages? You may want to set up the rescue script and configure it to move blue messages to the trash.

As far as I know, the only process that might have moved them to junk is the “iCloud Junk Spam Filter”, which I have understood from you cannot be turned off. If that is the case and SpamSieve never sees them, then seems like I have to rescan the Junk mailbox after processing TrainTrash.

I had forgotten about iCloud putting messages in the Spam folder. Unless you know of some way to turn that off so that SpamSieve processes all incoming messages. It is also possible that my other Macs mail programs do not have junk filtering turned off, so I’ll check that. Don’t think iPhone has any junk filtering. Hopefully I’ll find the problem and will not have to rescan the Junk folder every 5 minutes.

Thanks

Rand

Michael,

There are two other Macs that are logged into my account and run mail. I have checked both and both have “Junk Mail Filtering” turned off. Other than iCloud, not sure what would be moving those messages to Junk except SpamSieve. You are correct though that most are not colored and I have that option set in SpamSieve. Unless it is iCloud, I’m stumped at the moment.

Michael,

Just watched a message enter the Spam mailbox colored yellow. Then the yellow color disappeared and it turned white. Any idea what might cause that? Can two filters move it to the Spam mailbox at the same time? Still trying to understand what is happening. Thanks

Michael,

Just saw another message enter the Spam mailbox (which I call Junk) and was colored yellow. It should have matched the blocklist as both the name and email address are in the blocklist. It should have been moved to Trash by SpamSieve. I looked again and now the message color is White. SpamSieve must have seen it because the color was originally yellow. “Junk” is the junk mail folder set in mail for my iCloud account. Checked the name and email address against the blocklist and it looks same to me but apparently didn’t match. When I went back to look at the message it was now colored white. It should have matched blocklist. Any other thoughts?

Thanks

Rand

P.S. Also check my other mail programs running under my account. There were no rules and no extensions and as I mentioned junk filtering was disabled.

Michael,

Here is another example. I saw an email message from “Successful Beat” enter my Junk mailbox colored yellow and took a picture. Then clicked the message to check the email address. Matched the blocklist. But when I clicked on it the message turned white.

Here is the email address copied from the message:

hello@sb.successfulbeat.com

There is a screenshot when the message was yellow and where it should match the blocklist but didn’t.

Why didn’t SpamSieve put that message in the iCloud Trash instead of leaving it in the Junk mailbox? Why did the message turn White when I clicked on it to check the email address? I cannot explain this yet. Any more ideas?

Michael,

Something else I cannot explain. A message appeared in my Junk mailbox colored Yellow. I only have SpamSieve running on one machine my “server” in the basement. I brought up the SpamSieve log and that message is not in the log. Later as I was watching the message turned white. Here is a screen of the log when the message was yellow. I don’t have my script running.

Also what is the error that i"m pointing to in the Log and how do I find the message that is causing it? I’ve rebuilt all Inboxes for all accounts using "Mail->Mailbox->Rebuild.

Thanks for continue to look at this and offer suggestions.

Rand

Guess messages moved to Junk folder without being trained don’t appear in log.

UFO Revealed also appears in blocklist. So does “Paul Mathis”.

I’ve made sure my script isn’t running. I deleted ALL mail message from Junk. SpamSieve is running.

I do have one thing in my script that maybe is setting the color back. The script “Take All Accounts Offline” then “Synchronize All Accounts” (which turns them back online) before I run through TrainGood, TrainSpam, and TrainTrash. Maybe that changes the color back. As I remember I was doing that because mail on my other system didn’t appear synced until I did that. I can comment that out, but first I want to get Junk without my script running and see if I still see colored messages in Junk that should go to Trash because they are in blocklist but do not. Let you know.

Michael,

Pristine example. My script is not running. Junk mail iCloud folder was empty. A single junk email appeared and it is yellow. Checked it against the blocklist. It is not being moved to Trash. It was not matched. From what I can tell, SpamSieve 3.0.4 on Mac OS X Sonoma 14.5, Apple Mai lVersion 16.0 (3774.600.62 ) is not matching Junk email name and/or address to blocklist and moving the message to Trash.

Now maybe there is something wrong with the Blocklist or the Blocklist changed and no longer matches older entries. The messages not matching may have been added some time ago, at least this one was.

Thanks

Rand

Michael,

One other thing that I’ve noticed. In my script portion that I sent where I extracted the “name” and “address” to add to the blocklist, the current blocklist has both the “name” and “address” in the “name field”. Have no idea if that what you expect or not.

Here is that portion of the script again, called in TrainTrash loop for each message,

Rand

If the fact that no match occurs because the name contains the @address for all new blocklist entries created by my script due to what Apple Mail is doing, got any suggestions as how to fix this in the script?

Thanks

Rand

That should have said that the “name” and “address” are in the address field. I cannot expand “Text to Match” but the name appears to just be the name. Anyone not matching.

Appears that the newer created blocklist entries from the script are not matching. Not sure about older ones.

Michael,

Could it be something that SpamSieve looks for in the header? I notice that Apple Mail knows this email is junk, but junk filtering is not enabled. See

X-Spam-Flag: yes
X-Apple-Action: BL/Junk

for example. The header is below,

To: Rand Childs <randchilds@mac.com>
Reply-To: support@realfinancialgain.com
X-Dmarc-Policy: v=DMARC1; p=reject; sp=reject; pct=100;rua=mailto:dmarc@realfinancialgain.com
X-Sg-Id: u001.SdBcvi+Evd/bQef8eZF3BpTL9BgbK5wfSJMJGMsmprBkkoo3Jz4rspq/x5d35vN/axI0C31I7I0sT7vJg8lAnlZjkAD0s8x0VqDYmZkxdFrU033XV7URepbgHr4qtCHzEJX6FeV3yS2YFbQOdD6xaUX2TrCc3b+rrnBWZUkyZ0wh2Qbm36rtE+353AuaEM4xNCnYjMHVcqOXRY7+vo9+987AxzZgqtVnTE9/WIsjiTDvE7y+FU9nlKX2yb/H9KxYc2sHGlMRIbdWE4AB3RxwfnOQCWeetguERTIjE6LJ0cPyc5z1jP4co2OrnQtL2bsJXrIY6cj2Y7Zm/UNYMLSiSAm0NDygFQXnolzGXuBhpnERR18R4F4XT2/JpVDO/tM8
X-Proofpoint-Orig-Guid: aVv3twZtTH2wRgEazQcSr-hjnWG-kiBh
X-Icl-Score: 4.333034440041
Authentication-Results: bimi.icloud.com; bimi=none
Authentication-Results: arc.icloud.com; arc=none
Authentication-Results: dmarc.icloud.com; dmarc=pass header.from=agents.realfinancialgain.com
Authentication-Results: dkim-verifier.icloud.com; dkim=pass (2048-bit key) header.d=agents.realfinancialgain.com header.i=@agents.realfinancialgain.com header.b=S8VsJ25N
Authentication-Results: spf.icloud.com; spf=pass (spf.icloud.com: domain of bounces+39765774-8d16-randchilds=mac.com@msg.agents.realfinancialgain.com designates 159.183.105.35 as permitted sender) smtp.mailfrom="bounces+39765774-8d16-randchilds=mac.com@msg.agents.realfinancialgain.com"
List-Unsubscribe-Post: List-Unsubscribe=One-Click
Return-Path: <bounces+39765774-8d16-randchilds=mac.com@msg.agents.realfinancialgain.com>
X-Proofpoint-Guid: aVv3twZtTH2wRgEazQcSr-hjnWG-kiBh
X-Spam-Flag: yes
X-Apple-Action: BL/Junk
X-Campaignid: 6661c6d20359661472f0ad7a
X-Suspected-Spam: true
Original-Recipient: rfc822;randchilds@mac.com
X-Apple-Uuid: e5a8384b-7c90-4dd6-aa85-08d335d8c402
<K5hIaVmaRmOSLryhMYa0HA@geopod-ismtpd-25>
X-Sg-Eid: u001.zF3HK04i8VdroHG1f5aeDCi25YeEmtAbTr2SMepGkwBFQc21zxB6FiznRNrap58Nc3X5gkjbfCVlbJKBqKZ4rgWrpiDrD35OnV/fWYKVv1E6PA6uAf5QkP2cRumzWOBJyFdU4JMXex2OGKCucWMhTqYWFyMTOJN+f/mX9/oAWgp5A8blWjL1WyHGqkn0fhSwvuvIjwji7KvjGpTOHIa/Vr34Br4EQ/RxY4j8kG3SADArjOwWFoas0qJlykCyRAQp/Kv9+nVwuz74azGiGpH84A==
X-Dmarc-Info: pass=pass; dmarc-policy=reject; s=r1; d=r1; pdomain=agents.realfinancialgain.com
X-Arc-Info: policy=fail; arc=none
Mime-Version: 1.0
X-Clx-Shades: PersonalBlock
X-Entity-Id: u001.vcFNMJEu142eECvN30FIZw==
Content-Transfer-Encoding: quoted-printable
Received: from ms13p00im-qukt33072702.me.com by p110-mailgateway-smtp-6bf4c96bb4-pbv86 (mailgateway 2418B58) with SMTP id e5a8384b-7c90-4dd6-aa85-08d335d8c402 for <randchilds@mac.com>; Thu, 6 Jun 2024 23:59:07 GMT
Received: from o1900.msg.agents.realfinancialgain.com (o1900.msg.agents.realfinancialgain.com [159.183.105.35]) by ms13p00im-qukt33072702.me.com (Postfix) with ESMTPS id 94C056900173 for <randchilds@mac.com>; Thu, 6 Jun 2024 23:59:03 +0000 (UTC)
Received: by recvd-8567ccc85d-8rtrm with SMTP id recvd-8567ccc85d-8rtrm-1-66624CF0-5 2024-06-06 23:57:36.775138023 +0000 UTC m=+182346.807532504
Received: from Mzk3NjU3NzQ (unknown) by geopod-ismtpd-25 (SG) with HTTP id K5hIaVmaRmOSLryhMYa0HA Thu, 06 Jun 2024 23:57:36.726 +0000 (UTC)
Content-Type: text/html; charset=utf-8
X-Mantsh: 1TFkXBxsaGRgRCllEF2xbe25PX3htHHpbEQpZTRd6T1hZRURLRmhGRUlBEQpfWRc HGx8bEQpfTRdgX0RBEQpZSRcacRoQGncGBxsZG3EbGhoQGBoSGHcGBxgaBhoRClleF2xseREKQ 04XS3xcGV5dcF5+YhhdeE1vS1B7SXlYB0JARH1tB0FDaEIRClhcFxkEGgQfGgUbGgQbHBgEGRo EHxAbHhofGhEKXlkXTkYFYkARCk1cFxgSEQpMWhduRnpSQRwRCk1OF2gRCkxGF2NNaxEKQ1oXG x8TBBsSGQQbGh8EGR8RCkJeFxsRCkJGF2d7Hn1iX0h+bRxJEQpCRxdgS0doWH1LcgFQHBEKQlw XGxEKQksXYWsFUmx4cHtEEh8RCkJJF2xIZk8cSGNrXVwFEQpCRRdnf3IecFgTE3tEQxEKQk4Xb EhmTxxIY2tdXAURCkJMF298YhMBbk8Zfx4dEQpCbBdnWGBMYk1JSHsfQhEKQkAXen5LQB9cbRM dfE0RCkJYF2VtR19tR05jAUNoEQpCeBdoS09nSVlfAQVCUhEKWlgXHhEKcGcXZkVQYEtQX3JjS EcQBx4SEQpwaBdgcxh6ZlxTWF5DQBAaEQpwaBdjGVJse1lNfFpdQBAaEQpwaBdjXV4aU09AEwV vXRAaEQpwaBdobGlkEx0aTWVpGBAHHhIRCnBoF28aRHlGQ0FaHHpfEBoRCnBoF29/Rkh9aGlge k5IEBoRCnBoF2Z/RUldWR9FbXwBEAcbGx0RCnBoF2lhU2AZE3pte31LEAceExEKcH8XZlBmenp gekxDXEgQBx4SEQpwXxdkWEJhaB8FX2dhexAHHhIRCnB9F2BfRkh/R0EcbmsBEBoRCnB/F2VLb l9tU3l8SXhMEAcTHREKcF8Xek5eZnt5QHMFWUAQBxsbGxEKcH0XZGh7fWEfQVxsbVgQGhEKcH0 XY3p6EnIYS057X08QGhEKcF8XYFhBHGkZH3BhBR0QBxkaEQpwfRdpGGheUH1/XWFFexAaEQpwf RdsflNteFBieHhgfhAaEQpwfRdvYFNie2NecHN/TBAaEQpwfRdvAX9oEm57XGtrExAaEQpwfRd hGxlNE10aX099XhAaEQpwfRdnfWl4b3gYGh1+YxAHHhIRCnB9F2wBY3xFR11BGkl9EAceEhEKc F8XZ2BhExJDa01GSFwQBx4SEQpwfRdke2FbRElLaBteGBAaEQpwfRd6HX1sZXtHTkhZfBAaEQp wfRdhc2VlSF5dWGNgcBAaEQpwfRd6aWhCG01Jb35HbRAaEQpwfRdpR1poGFhYRmJJfRAaEQpwf Rdke2FbRElLaBteGBAaEQpwfRdmTH9cfktHX1p/cBAaEQpwfRdmc04BTlkbHUASbRAHHhIRCnB 9F2xhblNle1hGZ258EBoRCnBfF25+XnhhaUceHh1aEAceEhEKcH0XaBp4c2N8ZkASbVsQGhEKc H8XbR5LelpuAR4YSRIQBxkTEQpwXxdgYh0fQE1fHkMYQhAHExIRCnB9F2ZuUm15exsdUk9cEBo RCnBsF3obQgVMHkAaZUhdEAceEhEKbX4XGhEKWE0XSxE=
X-Apple-Movetofolder: Junk
X-Icl-Info: GAtbVUweBVFGSVVDTAQGUkFIRFcUWUIPAApbVRYSFhEAREQfHVlbBhQVClVYVVJfVxsJAhZTUxFe Sl9ATgUBVUFUXhNJBhsQFBcCFBBZWgYGRAsWGx5VDRg5CwQfHlcFEBcSBFZCUwMZHw8ZGV5VCxQV ARYRXhgBGhREVx5UC0AUHgMZDEMYEBAYChERXlcMFhAHGx9RXwxbGgkaWhBFCwVEREZNCRhTTUpI RkgFGFFAW0YfHVxZX1cWV05IABgPBh5IFh9VWBYGVxQSGVxQCxsYCBQRUVoFFBAIWRtfW0BVCRIF RRJZU0xJVlkVQ1FMFB4DGQxDGBAQGAoREV5XDBYQBxsfUV8MWxoJGloQUgZIWwcQHV5CEVsLAxYU Vl8MFBcFHhlcUQMcF0gUF10UQhgQAkpaDH1XHTAHIRVRZA86KioFAVh7OxRJLjY4V1MNBRYCWhFD WxYFHUtFTQ4UQgcaW1UKUVgGFhEPGxxDdg8UGkgUF10U
X-Icloud-Mail-Bwl: 0
Received-Spf: pass (spf.icloud.com: domain of bounces+39765774-8d16-randchilds=mac.com@msg.agents.realfinancialgain.com designates 159.183.105.35 as permitted sender) receiver=spf.icloud.com; client-ip=159.183.105.35; helo=o1900.msg.agents.realfinancialgain.com; envelope-from="bounces+39765774-8d16-randchilds=mac.com@msg.agents.realfinancialgain.com"
Dkim-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=agents.realfinancialgain.com; h=content-transfer-encoding:content-type:from:mime-version:subject: reply-to:list-unsubscribe-post:list-unsubscribe:to:cc:content-type:from: subject:to; s=msg; bh=vzpDVbewvtHN8cT86yoFc/DKZw7i6hznwEYX6TrXp2g=; b=S8VsJ25NY3nVy3CLL5+G1hgNs7zgsCW48Tt0OniHEw+/t7qWTMOAhkQYa3tzM4TPQFb9 bzvYHc3Be7W9uxgc3NustXIip+XDkjI/AKFi2TXPAb6XTNW7D2Befkk+S+Y+rFpnTZ5lEH 4apMFcvMfeNuPpF1QUm19wOUHsxSUadKG+2IT4vC5r9norDnNvodyerZX8LXpztE9QJRVP 1lzkzuFngOkX/K+fOhqXefaIVbb3UI9/KINdWxnPydNJ+tDhWZlwanL0lUZSJy5SZDks/q FDy4rGYsRMZGtWdBt9mrj3rjITuqaILdKMQEw+R+UyC63Kz98blGwV0zgP/Er/cw==

Yes, it’s probably iCloud, which can’t be turned off, but you can set up SpamSieve to filter them.

You can see in SpamSieve’s Log window whether it saw the message.

This can happen if another Mac moves the message while SpamSieve is in the middle of working with it.

I doubt it.

Like I said, you can see that it’s not a problem with the blocklist because the message isn’t in the Log window. I really think this is just due to iCloud’s filter.

Which rule in the screenshot do you think is incorrect?

This is proof that the iCloud junk filter moved the message to Junk so that it never went to the inbox in Apple Mail.

Thanks Michael. The only way I know to top iCloud Junk is to take all Junk and train it as good on iCloud Mail and then it gets back in the inbox, SpamSieve will trash it I suppose. That’s a lot to keep up with. If I add something to the script to have SpamSieve reprocess the Junk Folder, will that match and move messages to Trash if in blocklist?

Thanks

Rand