Knowledgebase

Overview

This article provides step-by-step instructions for verifying the functionality of the server's anti-spam and anti-virus filters using standardized test messages. The procedures utilize the GTUBE string for SpamAssassin validation and the EICAR test file for ClamAV validation.

Prerequisites

• Root or sudo access to the server.
• A valid email account hosted on the target server. Replace emailonserver@example.com with the actual recipient address in all commands.
• Greylisting must be disabled for the recipient domain prior to testing. Execute the following command:

/usr/local/psa/bin/grey_listing --update-domain example.com -status off

Testing SpamAssassin

To validate the anti-spam filter, send a GTUBE test email. This string is designed to trigger a maximum spam score (+1000), ensuring detection even if the recipient mailbox is whitelisted (whitelisting typically applies a -100 score modifier).

1. Install the required mail utility based on your operating system:
   • AlmaLinux/CloudLinux/RHEL:

   yum install s-nail

   • Debian/Ubuntu:

   apt-get install s-nail

2. Send the GTUBE test message:

echo "XJS*C4JDBQADN1.NSBN3*2IDNEN*GTUBE-STANDARD-ANTI-UBE-TEST-EMAIL*C.34X" | s-nail -S v15-compat -S smtp-auth=none -S mta=smtp://localhost -S from="sender@tester.com" -s "Spam test example" emailonserver@example.com

3. Verify the result. A properly configured filter will reject the message with a rejection notice:

s-nail: SMTP server: 554 5.7.0 Reject, id=511331-04 - spam
/root/dead.letter 10/298
s-nail: ... message not sent

4. Confirm the rejection in Warden -> Logs -> Message Log and the system maillog.

Testing ClamAV

To validate the anti-virus filter, send an email containing the EICAR test file. This is a standardized safe string used to verify antivirus detection without using actual malware.

1. Install the required mail utility (if not already installed):
   • AlmaLinux/CloudLinux/RHEL:

   yum install s-nail

   • Debian/Ubuntu:

   apt-get install s-nail

2. Download the EICAR test file:

wget http://www.eicar.org/download/eicar.com.txt

3. Send the test message with the attachment:

echo "TEST MESSAGE w/ ATTACHMENT" | s-nail -S v15-compat -S smtp-auth=none -S mta=smtp://localhost -S from="sender@tester.com" -s "A/V test example" -a eicar.com.txt emailonserver@example.com

4. Verify the result. A properly configured filter will reject the message with an infected status:

s-nail: SMTP server: 554 5.7.0 Reject, id=511330-04 - INFECTED: {HEX}test.test.eicar.1040.UNOFFICIAL
/root/dead.letter 30/938
s-nail: ... message not sent

5. Confirm the rejection in Warden -> Logs -> Message Log and the system maillog.

Troubleshooting & Common Issues

• Greylisting Interference: If greylisting is enabled for the recipient domain, test messages may be delayed or queued rather than immediately processed by the filters. Ensure it is disabled using the command provided in the Prerequisites section before testing.
• Whitelisting Behavior: The GTUBE string assigns a +1000 spam score. Standard whitelists typically apply a maximum negative modifier of -100. Consequently, whitelisted addresses will still trigger a rejection during this test, which is expected behavior.
• Log Verification: If the command-line output does not show a rejection notice, check Warden -> Logs -> Message Log and the system maillog for detailed processing information. Ensure the target email account exists on the server before running tests.