This usually is because you have Spam List checking enabled in
MailScanner, and the IP address of the mail's sender is listed in an RBL
(usually spamcop.net or spamhaus.org). When you look at the message
details in MailWatch, under Spam Report it will say something like
"spam, spamcop.net" or "spam, SPAMHAUS".
You have a few choices for how to deal with this.
1. Get the senders to try sending through their ISP rather than directly through your server to see if that solves the problem
2. Remove the blacklist they are caught by from your spam lists in
MailScanner configuration (WHM > ConfigServer MailScanner FE >
MailScanner Configuration > Spam List = ) and maybe try some other
ones instead. You can find a list of valid spam lists in
/usr/mailscanner/etc/spam.lists.conf.
3. Disable spam list checking in MailScanner (change the "Spam List =" entry to a blank field) and rely on the other spam tests.
4. Whitelist their email address or domain. This can allow through
some spam if there is any spoofed spam email being sent with their email
address on it, so it is the least recommended solution.
5. Move RBL blocking from MailScanner to exim and whitelist their IP
address in WHM > Exim Configuration Editor > Standard Options
> RBLs > Whitelist. See
this FAQ for how to move RBL blocking from
MailScanner to exim.
