some entries being removed from whitelist & blacklist

[kh61]

After adding email domain to the blacklist I get an email titled "cPanel -> MailScanner Report" which tells me that an certain domains have been removed from the blacklist, for example;

mail.xxxx-clairvoyant.com removed from spam.blacklist.rules

A similar thing is happening with the whitelist rules

Why is this happening and how can I stop this?

[Sarah]

This usually happens if there is a problem with one of these files:

/etc/localdomains
/etc/secondarymx

For instance, if a domain is listed twice or there are double line feeds or special characters where there should not be.

[kh61]

Thanks Sarah.

I can see a possible issue in /etc/localdomains

mydomain.net was listed and I added svr4.mydomain.net

I have removed it and I will see if it makes any difference

[Sarah]

That shouldn't cause a problem. It's only if there are actual duplicates or blank lines.

[kh61]

Hi Sarah,
I can't see any issue with the previously mentioned files, however whenever I edit the following files, my edits are reverted overnight;
spam.blacklist.rules
spam.action.rules
spamhigh.action.rules

In the spam.blacklist.rules I am adding an email address, but that is removed overnight.

in the spam action rules I am changing "deliver" to "delete", but it is changed back to "deliver" overnight.

The only file I have changed which is NOT being reverted is spam.whitelist.rules

The owner of these files is mailnull and I am editing them as root.

[Sarah]

If you're using MSFE you cannot edit those files directly as they are controlled by MSFE. You should make any changes via the WHM or cPanel MSFE.

[kh61]

Thanks Sarah.

I can't see any way to do that in WHM > Configserver MSFE ?

In MSFE, if I go into MailControl and then into a single message I can learn as ham or spam, and report the message, or resend or forward if it has been quarantined, but I can't see any way to whitelist or blacklist the sender. Nor can I see any way to change spam action or highspam action (deliver of delete)

[Sarah]

Go to WHM > Plugins > ConfigServer MailScanner FE > Front-End Settings. Scroll down to the bottom for the server-wide blacklist and whitelist. The default spam and high spam actions can also be set on that page. If you want settings to be different for each account, go into the cPanel MSFE for the user account and either go to Email Black/Whitelist settings, or Change All Domain Settings or Individual Domain Settings for the spam actions etc.

[kh61]

Thanks again Sarah. I was looking in the Mailscanner Configuration. I hadn't looked in Front End settings as I assumed it related to the user interface (as in 'front end'!)