Blocked spam emails myself

At least you could do this (it’s just copy/paste).

cat > /etc/spamassassin/disable-validity.cf << EOF
dns_query_restriction deny sa-trusted.bondedsender.org
dns_query_restriction deny sa-accredit.habeas.com
dns_query_restriction deny bl.score.senderscore.com
EOF
cat > /etc/spamassassin/disable-mailspike.cf << EOF
dns_query_restriction deny bl.mailspike.net
dns_query_restriction deny wl.mailspike.net
EOF
cat > /etc/spamassassin/disable-dnswl.cf << EOF
dns_query_restriction deny list.dnswl.org
score RCVD_IN_DNSWL_* 0
EOF

Once done, restart Spamassassin.

systemctl restart spamd

I get more spam in my gmail account than in my own server account.

Failed to restart spamd.service: Unit spamd.service not found
Last login: Wed Jun  3 16:02:39 2026 from 66.220.206.5
root@server:~# cat > /etc/spamassassin/disable-validity.cf << EOF
dns_query_restriction deny sa-trusted.bondedsender.org
dns_query_restriction deny sa-accredit.habeas.com
dns_query_restriction deny bl.score.senderscore.com
EOF
root@server:~# cat > /etc/spamassassin/disable-mailspike.cf << EOF
dns_query_restriction deny bl.mailspike.net
dns_query_restriction deny wl.mailspike.net
EOF
root@server:~# cat > /etc/spamassassin/disable-dnswl.cf << EOF
dns_query_restriction deny list.dnswl.org
score RCVD_IN_DNSWL_* 0
EOF
root@server:~# systemctl restart spamd
Failed to restart spamd.service: Unit spamd.service not found.
root@server:~#

That’s because you are using an old OS, Use this command instead:

systemctl restart spamassassin

Done, Th…you for help! Spam be moe blocket?

Work! good, today no 100 emails, onlt one come today Th…you! What you mean OS old? you meane HesiaCP support now Ubuntu 26.04 LTS (Resolute Raccoon) ?

Great!

I mean Ubuntu 22.04, but no worries, it is still supported. And no, Hestia doesn’t support 26.04 yet.

today again come spam emailes.

Return-path: [email protected]
Envelope-to: [email protected]
Delivery-date: Fri, 05 Jun 2026 14:31:33 -0400
Received: from 64.251.73.34.bc.googleusercontent.com ([34.73.251.64] helo=wols.nl)
by server.emkolbaski.net with smtp (Exim 4.95)
(envelope-from [email protected])
id 1wVZKP-003HlV-6e
for [email protected];
Fri, 05 Jun 2026 14:31:33 -0400
From: Cloud Storage [email protected]
To: [email protected]
Subject: Account Volume Is Peaking | Expand Today and Save 75% | ID:132639-84849
Message-ID: [email protected]
Date: Fri, 05 Jun 2026 18:31:32 +0000
Reply-To: [email protected]
List-ID: notifications.wols.nl
List-Unsubscribe: mailto:[email protected]?subject=unsubscribe, https://wols.nl/unsubscribe/643ce9d697154e21a7932ed0a6f86db4
List-Unsubscribe-Post: List-Unsubscribe=One-Click
X-Mailer: CloudMailer/2.1
MIME-Version: 1.0
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: quoted-printable
X-Spam-Score: 5
X-Spam-Bar: /
X-Spam-Report: Spam detection software, running on the system “server.emkolbaski.net”,
has NOT identified this incoming email as spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.

Content preview: Account Urgency: Storage Limit Exceeded ⚠️ CRITICAL ACCOUNT
STATUS Your Cloud Storage is 100% Full

Content analysis details: (0.5 points, 5.0 required)

pts rule name description


0.0 TVD_RCVD_IP Message was received from an IP address
-0.0 SPF_PASS SPF: sender matches SPF record
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
0.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76
chars
0.0 T_KAM_HTML_FONT_INVALID Test for Invalidly Named or Formatted
Colors in HTML
0.4 RDNS_DYNAMIC Delivered to internal network by host with
dynamic-looking rDNS

Account Urgency: Storage Limit Exceeded /\* Reset & Override Styles \*/ body { width: 100% !important; -webkit-text-size-adjust: 100%; -ms-text= -size-adjust: 100%; margin: 0; padding: 0; background-color: #f8fafc; font-= family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, A= rial, sans-serif; } table { border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rsp= ace: 0pt; } td { border-collapse: collapse; } img { outline: none; text-decoration: none; -ms-interpolation-mode: bic= ubic; } =20 .ExternalClass { width: 100%; } .ExternalClass, .ExternalClass p, .ExternalClass span, .ExternalClass f= ont, .ExternalClass td, .ExternalClass div { line-height: 100%; } /\* Mobile Responsiveness \*/ @media only screen and (max-width: 580px) { .container { width: 100% !important; max-width: 100% !important; } .mobile-padding { padding-left: 20px !important; padding-right: 20px = !important; } .headline { font-size: 26px !important; line-height: 32px !important;= } .cta-button { width: 100% !important; display: block !important; } .cta-button td { padding: 0 !important; } .cta-button a { display: block !important; padding: 16px 0 !important= ; box-sizing: border-box; } }
=20 =20
=E2=9A=A0=EF=B8=8F CRITICAL ACCOUNT STATUS

Your Cloud Storage is 100% Full

Your account has officially exceeded its maximum capacity l= imit. Background synchronization and active backups have been suspended.

=F0=9F=9A=A8 ACTION REQUIRED: Your Documents Are At R= isk of Deletion

Accounts that remain over capacity trigger automated = data retention protocols. To ensure your existing photos, documents, and ba= ckups are not permanently purged from our servers, you must clear space or = expand your storage immediately.

=20

Current System Disruptions:

=20
= =E2=80=A2 Syncing Suspended: New documents= and photos can no longer upload properly across your linked devices.
= =E2=80=A2 Backup Interrupted: Automatic de= vice backups cannot complete until space is cleared or expanded.

To help secure your data instantly, a pre-approved = 75% promotional discount has been applied to your account upgrade = path.

Secure Your Files & Save 75%

Note: This 75% upgrade offer is time-sensitive and tied dir= ectly to your storage restoration timeline.

This email is an automated account notification regarding sys= tem limits.
If you wish to opt out of future marketing adjustments, you c= an=20 unsubscribe here .

and

Return-path: <[email protected]>
Envelope-to: [email protected]
Delivery-date: Fri, 05 Jun 2026 14:00:09 -0400
Received: from 54.187.192.35.bc.googleusercontent.com ([35.192.187.54] helo=leschroniques.net)
        by server.emkolbaski.net with smtp (Exim 4.95)
        (envelope-from <[email protected]>)
        id 1wVYq0-003FBt-N8
        for [email protected];
        Fri, 05 Jun 2026 14:00:09 -0400
From: CNN Health <[email protected]>
To: [email protected]
Subject: Warning: Pain medication alert from Dr. Gupta | ID:120427-84602
Message-ID: <[email protected]>
Date: Fri, 05 Jun 2026 18:00:08 +0000
Reply-To: [email protected]
List-ID: notifications.leschroniques.net
List-Unsubscribe: <mailto:[email protected]?subject=unsubscribe>, <https://leschroniques.net/unsubscribe/de609319bcf54773b18495fb13613496>
List-Unsubscribe-Post: List-Unsubscribe=One-Click
X-Mailer: CloudMailer/2.1
MIME-Version: 1.0
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: quoted-printable
X-Spam-Score: 5
X-Spam-Bar: /
X-Spam-Report: Spam detection software, running on the system "server.emkolbaski.net",
 has NOT identified this incoming email as spam.  The original
 message has been attached to this so you can view it or label
 similar future email.  If you have any questions, see
 @@CONTACT_ADDRESS@@ for details.
 
 Content preview:  CNN Health Breaking News CNN Health • Watch Live Health
   • 9 Min Read 10X MORE EFFECTIVE THAN PAIN DRUGS: THE NAT= URAL BREAKTHROUGH
    SHOCKING DOCTORS By Dr. Sanjay Gupta Your video has already started<= /div>
    🔇 
 
 Content analysis details:   (0.5 points, 5.0 required)
 
  pts rule name              description
 ---- ---------------------- --------------------------------------------------
  0.0 URIBL_BLOCKED          ADMINISTRATOR NOTICE: The query to URIBL was
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: ni03hfph.com]
  0.0 TVD_RCVD_IP            Message was received from an IP address
 -0.0 SPF_PASS               SPF: sender matches SPF record
 -0.0 SPF_HELO_PASS          SPF: HELO matches SPF record
  0.1 MIME_HTML_ONLY         BODY: Message only has text/html MIME parts
  0.0 HTML_MESSAGE           BODY: HTML included in message
  0.0 MIME_QP_LONG_LINE      RAW: Quoted-printable line longer than 76
                             chars
  0.0 T_KAM_HTML_FONT_INVALID Test for Invalidly Named or Formatted
                             Colors in HTML
  0.4 RDNS_DYNAMIC           Delivered to internal network by host with
                             dynamic-looking rDNS

<!DOCTYPE html     PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/x= html1/DTD/xhtml1-transitional.dtd"> <html xmlns=3D"http://www.w3.org/1999/xhtml">  <head>     <meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3DUTF-8= " />     <meta name=3D"viewport" content=3D"width=3Ddevice-width, initial-scale= =3D1.0" />     <title>CNN Health Breaking News</title> </head>  <body     style=3D"margin: 0; padding: 0; background-color: #f4f4f4; font-family:=  'Helvetica Neue', Helvetica, Arial, sans-serif;">      <table border=3D"0" cellpadding=3D"0" cellspacing=3D"0" width=3D"100%" = style=3D"background-color: #f4f4f4;">         <tr>             <td align=3D"center" style=3D"padding: 20px 0;">                  <table border=3D"0" cellpadding=3D"0" cellspacing=3D"0" wid= th=3D"600"                     style=3D"background-color: #ffffff; max-width: 600px; b= order: 1px solid #e5e5e5;">                      <!-- CNN Header -->                     <tr>                         <td style=3D"padding: 15px 20px; border-bottom: 2px=  solid #cc0000; background-color: #ffffff;">                             <table border=3D"0" cellpadding=3D"0" cellspaci= ng=3D"0" width=3D"100%">                                 <tr>                                     <td align=3D"left"                                         style=3D"font-size: 24px; font-weig= ht: bold; color: #cc0000; font-family: Arial, sans-serif; letter-spacing: -= 1px;">                                         CNN <span style=3D"color: #222222;"= >Health</span>                                     </td>                                     <td align=3D"right" style=3D"font-size:=  14px; font-weight: bold; color: #cc0000;">                                         <a href=3D"https://corestrengthcnn.= storage.googleapis.com/f26267dd-8b0a-48bf-be31-e93bb1f00496.html" style=3D"= color: #cc0000; text-decoration: none;">&bull;                                             Watch Live</a>                                     </td>                                 </tr>                             </table>                         </td>                     </tr>                      <!-- Content -->                     <tr>                         <td style=3D"padding: 25px 20px;">                              <!-- Byline -->                             <div                                 style=3D"font-size: 12px; color: #666666; f= ont-weight: bold; text-transform: uppercase; margin-bottom: 10px;">                                 Health &bull; 9 Min Read                             </div>                              <h1                                 style=3D"font-size: 28px; font-weight: 800;=  color: #000000; margin: 0 0 15px 0; line-height: 1.2;">                                 10X MORE EFFECTIVE THAN PAIN DRUGS: THE NAT= URAL BREAKTHROUGH SHOCKING DOCTORS                             </h1>                              <div style=3D"margin-bottom: 20px;">                                 <table border=3D"0" cellpadding=3D"0" cells= pacing=3D"0">                                     <tr>                                         <td valign=3D"middle" style=3D"padd= ing-right: 10px;">                                             <img src=3D"https://www.ni03hfp= h.com/686/offers/19593/c/58482/assets/2.png" alt=3D"Dr Sanjay Gupta" width= =3D"40" height=3D"40" style=3D"border-radius: 50%; display: block;" />                                         </td>                                         <td valign=3D"middle" style=3D"font= -size: 14px; color: #333333;">                                             By <strong>Dr. Sanjay Gupta</st= rong>                                         </td>                                     </tr>                                 </table>                             </div>                              <!-- Fake Video Player -->                             <a href=3D"https://corestrengthcnn.storage.goog= leapis.com/f26267dd-8b0a-48bf-be31-e93bb1f00496.html"                                 style=3D"display: block; text-decoration: n= one; position: relative; margin-bottom: 15px;">                                 <div style=3D"position: relative; backgroun= d-color: #000000;">                                     <img src=3D"https://www.ni03hfph.com/68= 6/offers/19593/c/58482/assets/1.png" alt=3D"Video presentation" width=3D"10= 0%" style=3D"display: block; opacity: 0.8;" />                                      <!-- Purple Overlay Box (matching image= ) -->                                     <div                                         style=3D"position: absolute; top: 4= 0%; left: 50%; transform: translate(-50%, -50%); background-color: rgba(94,=  76, 148, 0.95); padding: 15px 20px; border-radius: 5px; text-align: center= ; width: 220px; box-shadow: 0 4px 10px rgba(0,0,0,0.5);">                                         <div                                             style=3D"color: #ffffff; font-s= ize: 12px; font-weight: bold; margin-bottom: 8px;">                                             Your video has already started<= /div>                                         <div style=3D"font-size: 28px; colo= r: #ffffff; margin-bottom: 5px;">&#128263;                                         </div>                                         <div style=3D"color: #ffffff; font-= size: 14px; font-weight: bold;">Click to listen                                         </div>                                     </div>                                      <!-- Lower Third -->                                     <div                                         style=3D"position: absolute; bottom= : 0; left: 0; width: 100%; background-color: rgba(255, 255, 255, 0.9);">                                         <div                                             style=3D"background-color: #cc0= 000; color: #ffffff; padding: 4px 10px; font-size: 12px; font-weight: bold;=  display: inline-block;">                                             BREAKING NEWS</div>                                         <div                                             style=3D"padding: 8px 10px; fon= t-size: 14px; font-weight: 800; color: #000000; line-height: 1.2;">                                             10X MORE EFFECTIVE THAN PAIN DR= UGS:<br>THE NATURAL BREAKTHROUGH SHOCKING DOCTORS                                         </div>                                     </div>                                 </div>                             </a>                              <!-- Urgency Text -->                             <div                                 style=3D"text-align: center; font-size: 16p= x; font-weight: bold; color: #000000; margin-bottom: 25px;">                                 534 people watching now...                             </div>                              <p style=3D"font-size: 18px; color: #333333; li= ne-height: 1.6; margin-bottom: 20px;">                                 <strong>(CNN) &mdash;</strong> It is being = called the "most important discovery in                                 history" for chronic pain.                             </p>                              <p style=3D"font-size: 18px; color: #333333; li= ne-height: 1.6; margin-bottom: 25px;">                                 A leaked presentation reveals a natural alt= ernative that works                                 <strong>10 times better than prescription p= ainkillers</strong>=E2=80=94without the deadly side                                 effects. Medical establishments are scrambl= ing to hide this video before it's taken                                 offline completely.                             </p>                              <div style=3D"text-align: center; margin-bottom= : 20px;">                                 <a href=3D"https://corestrengthcnn.storage.= googleapis.com/f26267dd-8b0a-48bf-be31-e93bb1f00496.html"                                     style=3D"background-color: #cc0000; col= or: #ffffff; font-size: 18px; font-weight: bold; text-decoration: none; pad= ding: 15px 30px; display: inline-block; border-radius: 4px;">WATCH:                                     The Controversial Pain Discovery &raquo= ;</a>                             </div>                          </td>                     </tr>                      <!-- Footer -->                     <tr>                         <td style=3D"background-color: #111111; padding: 20= px; text-align: center;">                            =20                             <div style=3D"color: #666666; font-size: 11px; = font-family: Arial, sans-serif;">                                 Copyright 2026. All rights reserved.<br><br>                                 <a href=3D"https://corestrengthcnn.storage.= googleapis.com/c52d5dd4-639b-4244-8ff0-6fe0c9ba3ee0.html" style=3D"color: #= 999999; text-decoration: underline;">Update                                     Communication Preferences</a>                             </div>                         </td>                     </tr>                 </table>              </td>         </tr>     </table> </body>  </html>

You must train SpamAssassin to be able to identify those messages as spam.

ok, th…you! I no see Sieve on my hestiaCP, may be a need add Sieve?

Show the output of:

dpkg -l | grep dovecot

ok here

Last login: Wed Jun  3 16:29:07 2026 from 66.220.206.5
root@server:~# dpkg -l | grep dovecot
ii  dovecot-core                       1:2.3.16+dfsg1-3ubuntu2.9                        amd64        secure POP3/IMAP server - core files
ii  dovecot-imapd                      1:2.3.16+dfsg1-3ubuntu2.9                        amd64        secure POP3/IMAP server - IMAP daemon
ii  dovecot-pop3d                      1:2.3.16+dfsg1-3ubuntu2.9                        amd64        secure POP3/IMAP server - POP3 daemon
root@server:~#

Last login: Wed Jun  3 16:29:07 2026 from 66.220.206.5
root@server:~# dpkg -l | grep dovecot
ii  dovecot-core                       1:2.3.16+dfsg1-3ubuntu2.9                        amd64        secure POP3/IMAP server - core files
ii  dovecot-imapd                      1:2.3.16+dfsg1-3ubuntu2.9                        amd64        secure POP3/IMAP server - IMAP daemon
ii  dovecot-pop3d                      1:2.3.16+dfsg1-3ubuntu2.9                        amd64        secure POP3/IMAP server - POP3 daemon
root@server:~# Last login: Wed Jun  3 16:29:07 2026 from 66.220.206.5
root@server:~# dpkg -l | grep dovecot
ii  dovecot-core                       1:2.3.16+dfsg1-3ubuntu2.9                        amd64        secure POP3/IMAP server - core files
ii  dovecot-imapd                      1:2.3.16+dfsg1-3ubuntu2.9                        amd64        secure POP3/IMAP server - IMAP daemon
ii  dovecot-pop3d                      1:2.3.16+dfsg1-3ubuntu2.9                        amd64        secure POP3/IMAP server - POP3 daemon
root@server:~#
Command 'Last' not found, did you mean:
  command 'fast' from snap fast (0.0.4)
  command 'last' from deb util-linux (2.37.2-4ubuntu3.5)
  command 'nast' from deb nast (0.2.0-9)
See 'snap info <snapname>' for additional versions.
root@server:~#: command not found
Command 'ii' not found, but can be installed with:
apt install ii
Command 'ii' not found, but can be installed with:
apt install ii
Command 'ii' not found, but can be installed with:
apt install ii
root@server:~#: command not foun

Ok, you don’t have Sieve installed. Anyway, you don’t need Sieve to train Spamassassin. You need it if you want to use this:

And you can install it executing this script:

 /usr/local/hestia/install/upgrade/manual/install_sieve.sh

But as I said, you can still use this to train Spamassassin without Sieve.

Regarding the last message, I don’t know what are you trying to do.

I also use spamhaus Data Query Service and some manual filters in webmail. (and spam score to 30).

Also my respect to @sahsanu