Zimbra learning Spam

spamspamassassinzimbra

We are using a Zimbra intallation on the version 8.6.0 and have diffuclty with the Spam recognition. It's an installation all on one single server and we collected in the mean time over 1000 Spam mails.

Now we invested time to understand the way how Zimbra teachs Spamassassin new rules and there are two open questions in the process.

How does Zimbra create the new rules for the Spamassassin?
Where is the file saved with the rules?
Is there a way to check if the creation of the new rules worked as designed?
Is there an other possibilaty why Spamassassin do not learn from the mails which are marked as spam from the Users? They get send to the Zimbra Spam mailbox and get deleted as designed in the night after learning them.

The recognition of mails are very poor and even the same mail from the same adress can be tagged and after a few hours when it comes once more, it does not get marked from SA.

Thank you a lot for your time and help.

Best Answer

Zimbra uses most of the functionality of spamassassin. Only it is wrapped with some management tools from zimbra itself. For Zimbra 8.6+ (maybe older versions also) You can check if your system is configured for updates with:

zmlocalconfig antispam_enable_rule_updates

If it is false, you can enable it with:

zmlocalconfig -e antispam_enable_rule_updates=true
zmamavisdctl restart
zmmtactl restart

You can check if the configuration is correct by:

$ crontab -l | grep zmsa
45 0 * * * . /opt/zimbra/.bashrc; /opt/zimbra/libexec/zmsaupdate

And at last you can check for the latest updates in /opt/zimbra/data/spamassassin/state/ and subdirs in there

If you want to configure spamassassin you can create a file /opt/zimbra/data/spamassassin/localrules/sauser.cf with your own settings.

After looking into spamassassin, you also can try to use some RBL's that can be done in the admin interface in the MTA settings.

Related Solutions

Stop Outgoing Spam Already Tagged as Spam

You can delete emails with a particular tag in header.

See Postfix Header Checks Man page for details.

Example:

In "/etc/postfix/main.cf", add

header_checks = regexp:/etc/postfix/header_checks

In "/etc/postfix/header_checks", have

/^(Subject: \[SPAM\])(.+)$/ DISCARD

The above will discard all emails whose Subject starts with "[SPAM]".

EDIT: I only wish to delete the messages that are both spam AND being forwarded to other servers. I don't want to delete all mails marked as spam. Is there a way to distinguish between the two?

This could be done by running two instances within Postfix. The first instance will forward the email to second instance (instead of to Remote email server). The same can be achieved by specifying a local transport.

The second instance will have the above header_checks. This way only emails to remote server will have their SPAM deleted.

Some references:

Specifying Transport
You can run multiple instances of Postfix by specifying additional entries in master.cf file. Details here

External postfix forwarding to zimbra server

You can setup a transport lookup table to override the nexthop on mail delivery.

In /etc/postfix/main.cf

transport_maps =
       hash:/etc/postfix/mytransport_override

In /etc/postfix/mytransport_override you write

migrated_address1@yourdomain smtp:zimbra.yourserver
migrated_address2@yourdomain smtp:zimbra.yourserver
another__migrated@yourdomain smtp:[zimbra.yourserver]

Then postmap hash:/etc/postfix/mytransport_override

I see no issues with spam or being your mail messages treated as spam (as long as your dns entries like PTR records, A records, MX records are okay).

EDIT

Good point in the comments: if you want to avoid MX records lookup add brackets around the hostname. Example is in the last line. Generally it is a good practice to use brackets to avoid surprises.

Best Answer

Related Solutions

Stop Outgoing Spam Already Tagged as Spam

External postfix forwarding to zimbra server

Related Topic