How can I drop all email globally above a certain spam score?

To create a global sieve filter that will drop all email over a certain spam score follow the directions below. This method works on Plesk 12.5, Plesk 17.X ,and Plesk 18.X. Note: These instructions are for servers running Dovecot. They will not work if your server is using Courier-imap.

Create a new global sieve filter:

su root
mkdir /etc/dovecot/conf.d/custom-sieve
cd /etc/dovecot/conf.d/custom-sieve
nano /etc/dovecot/conf.d/custom-sieve/global_after.sieve

Add the following code or any other sieve rules, in the above  file. Note: each * corresponds to 1.0 point of the spam score. So if you want to drop email with a spam score of  15.0 or higher you would change the X-Spam-Level to 15 stars like "***************" We recommend not setting this any lower than 15 stars at first to make sure that you don't discard any valid email.

#---------------------------------------------------------
if anyof (header :contains "X-Spam-Level" "***************")
{
discard;
stop;
}
#---------------------------------------------------------

Create the new global sieve configuration directive for Dovecot (the 37 order is important):

nano /etc/dovecot/conf.d/37-custom-global-sieve.conf

Add the following code to that file:

#---------------------------------------------------------
plugin {
sieve_after = /etc/dovecot/conf.d/custom-sieve/global_after.sieve
}
#---------------------------------------------------------

Run the sievec command to compile the new sieve (important):

sievec /etc/dovecot/conf.d/custom-sieve/global_after.sieve

Restart the SpamAssassin and Dovecot services:

service spamassassin restart
service dovecot restart

To verify the filter you can send a test spam message to the email as described here :. You will see entries like this in the mail log when a message goes over the limit you set and is discarded:

Jul 28 07:26:13 el7p17 dovecot: service=lda, user=test@example.com, ip=[]. sieve: msgid=<5d3da271.qXPVLDItCpWYFUU5%sender@example.com>: marked message to be discarded if not explicitly delivered (discard action)
Jul 28 07:26:13 el7p17 postfix-local[94765]: message discarded by a mail handler

Note: This will run your custom global sieve filter(s) after any other personal filters each account may have. To disable the global filter(s) for any individual accounts, simply add a new personal filter (in your Roundcube or other webmail client) that hits on all emails and simply has "Stop processing filters" as its only action.

We use the DROP action over REJECT as spammers almost always forge the FROM: header. If you use REJECT then backscatter would occur. Dropping at the sieve filter level also has the benefit of the entry still being logged in the Spam Log in Warden.

Credits go to G J Piper in the Plesk forums for this solution.

  • drop, sieve, reject, score
  • 1 Users Found This Useful
Was this answer helpful?

Related Articles

Why isn't autolearning working for me (autolearn=no) ?

Lots of people seem to be confused by the "autolearn=no" statement in the default X-Spam-Status...

I get the a 502 gateway error when clicking on the application. How can I fix this?

This can usually be fixed by just restarting the Plesk interface:/etc/init.d/psa restart

How can I fix the error WARNING: Ignoring deprecated option AllowSupplementaryGroups after upgrading to ClamAV 1.00?

The AllowSupplementaryGroups option was deprecated in ClamAV 1.00. If this option is present in...

How can I fix the error: spamass-milter[27944]: Could not extract score from <> ?

When you look at your email log you see: spamass-milter[27944]: Could not extract score from...

How can I stop encrypted archives from being allowed though ClamAV?

For ClamAV 0.100 and belowUnder Warden -> Settings -> Scanning Settings -> Block...