[SOLVED] Spam delete over a certain score

[bjquinn]

How do I just delete spam over a certain score? Or is there a way to hide it from POP connections? In other words, I'm replacing an existing email server that deletes all spam over a 4.3 spamassassin score. So nobody's Outlook/Outlook Express/Thunderbird has any message rules set up to obey Spamassassin headers/subject tags, etc. I won't be able to change that, so I just need to delete those messages altogether. However, I wouldn't mind if the messages ended up in the junk folder on the Zimbra web interface, as long as a POP connection wouldn't download the message, even if the user never used the web interface. Does Zimbra automatically move junk messages to a "junk" IMAP folder even if the user doesn't ever use the web interface?

[mmorse]

That's the kill level, see the as/av tab in global settings.
zmprov mcf zimbraSpamKillPercent 50
(It's given in percentages-so that would kill anything with 10pts on the 20pt scale)

100% = 20pts
33% = 6.6pts
75% = 15pts
etc

You can change the action (discard vs bounce etc) in amavisd.conf.in (don't edit amavisd.conf directly, edit the .in and restart)
$final_spam_destiny=D_DISCARD;

You can also play with the dsn (delivery status notification) setting; so over a certain level you won't be responding 'I got your mail' to the spammers.
$sa_dsn_cutoff_level = 50;

To delete/not bother quarantining high scoring spam (therefore reducing the number of items in the quarantine) this setting allows you to discard quarantined spam above this level:
$sa_quarantine_cutoff_level = 90;
It is cleaned up every day though:
0 1 * * * find /opt/zimbra/amavisd/quarantine -type f -mtime +7 -exec rm -f {} \; > /dev/null 2>&1

Note: In that amavisd.conf.in file, wherever possible it's better to set the values with zmprov/admin console (ie: the tag & kill levels) so that it stays consistent across upgrades.

zmprov mcf zimbraSpamTagPercent 30
-would put everything above 6pts in the junk folder (and label with a custom **SPAM** in the subject line if you have that enabled) - I personally don't because it's already in the junk folder.

(It won't download via pop unless you point the pop at something other than the inbox, in some clients you can configure it like user@domain.com%folder)

[bjquinn]

Where do you get the 20 point scale from? In the headers it says max hits = 6.6...

-BJ

EDIT: I know where this comes from now, my zimbraSpamTagPercent defaults to 33. 33% of 20 is 6.6. Duh. At any rate, where did this 20 point scale come from anyway? I've used spamassassin for a while and never heard of this. Is this a Zimbra thing? And is that 20 point scale modifiable anywhere?

[bjquinn]

And if the spam is being put into the Junk folder anyway on the Zimbra web interface, does it automatically put it there when the web interface determines its spam score is too high, or does the server do that for you? Again, in other words, if I never used the web interface, would the spam still be put automatically in that IMAP junk folder, preventing a POP connection from downloading it.

[mmorse]

Think of 'tag' as the level it 'marks' spam (and moves to junk)

So in your case you have the default required=6.6 (33%) in the email headers -it's put there so that others can know what level of points qualified the yes is spam/no isn't spam X-Spam-Status.

Everything else is built around the '20' scale so if you changed it you'd have to modify the weighting of all the individual rules for it to be effective...

[bjquinn]

Ok I think I get it now. But does the server automatically move it to the IMAP junk folder or does it require logging on to the web interface to do so? I've already tested that if it's in the junk mail folder a POP3 client won't download it. Good. But will it go to the junk mail folder even if I never log in to the web interface?

Thanks for your help!

[mmorse]

Logging into the interface has nothing to do with the mails being moved to the junk folder
If you plan to never check that folder you should be sure the junk message lifetime is set (it's already set to 30 days by default).
-marking as solved

[bjquinn]

Yep, you solved it, thanks!

[mmorse]

no sweat-we must have been editing/posting around each other I must have just missed the 2nd post you made in a row (and I probably even marked the 2nd email notification as read because I had already replied)

Originally Posted by mmorse

(It won't download via pop unless you point the pop at something other than the inbox, in some clients you can configure it like user@domain.com%folder)

BTW if you we're curious - kinda cool & an update/correction to what I said earlier (I obviously haven't done it in a while-as IMAP is so much nicer)

-in the POP username blank (most clients will allow this, unless they want to specifically block characters or something)
you can put like: user{folder:junk}
or: user@domain.com{tag:something}
or combine them: user{folder:zimbra tag:followup}

& you get back emails just as if you had run a search-try some other queries! Search Tips - ZimbraWiki

[bjquinn]

Heh that's interesting, I'll have to try that out.

Yeah, I'm trying to convert everyone over to IMAP. I'm sure Zimbra's sleek web interface will convert a few. Outlook, especially 2003 or older, just behaves so poorly with IMAP, I have had to stick with POP3. Even 2007 puts those annoying strikethrough lines through a message when you delete it rather than just hiding the message until the folder is purged. Thunderbird handles that so much more nicely, but the big wigs want Outlook.

-BJ