Untagged messages appearing in spam folder

[shawnlhood]

My organization has been having problems with messages that are untagged appearing in the spam folder. They are clearly not spam, and they're also not ham. What is causing messages such as those that follow to appear in the spam (junk) folder?

I have replaced personal data with placeholders.


=== SAMPLE 1 ===


Received: from localhost (localhost [127.0.0.1])
by mx.somedomain.net (Postfix) with ESMTP id C6F48227C024;
Wed, 31 Oct 2007 14:41:17 -0400 (EDT)
X-Quarantine-ID: <sr1a0YTFdEII>
X-Spam-Score: -2.194
X-Spam-Level:
X-Spam-Status: No, score=-2.194 tagged_above=-10 required=6.6
tests=[AWL=0.405, BAYES_00=-2.599]
Received: from mx.somedomain.net ([127.0.0.1])
by localhost (mx.somedomain.net [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id sr1a0YTFdEII; Wed, 31 Oct 2007 14:41:15 -0400 (EDT)
Received: from [2.2.2.2] (unknown [1.1.1.1])
by mx.somedomain.net (Postfix) with ESMTP id DD03A227C007;
Wed, 31 Oct 2007 14:41:14 -0400 (EDT)
Mime-Version: 1.0 (Apple Message framework v752.3)
Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed
Message-Id: <31A93CA3-5DC9-4F19-9551-F07D4C9CF348@somedomain.com>
Cc: First Last <first.last@somedomain.com>
Content-Transfer-Encoding: 7bit
From: First Last <first.last@somedomain.com>
Subject: SomeOrganization Halloween Pictures
Date: Wed, 31 Oct 2007 14:40:27 -0400
To: Office <office@somedomain.com>
X-Mailer: Apple Mail (2.752.3)

Sorry for the quality, I forgot my real camera and had to use my
iPhone camera.

http://url-omitted/

=== END OF SAMPLE 1 ===

=== SAMPLE 2 ===

Received: from localhost (localhost [127.0.0.1])
by mail.somedomain.com (Postfix) with ESMTP id 0E6EF227C004;
Fri, 19 Oct 2007 12:23:38 -0400 (EDT)
X-Spam-Score: -2.599
X-Spam-Level:
X-Spam-Status: No, score=-2.599 tagged_above=-10 required=6.6
tests=[BAYES_00=-2.599]
Received: from mail.somedomain.com ([127.0.0.1])
by localhost (la.coderyte.net [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id pQCLon+xST9z; Fri, 19 Oct 2007 12:23:35 -0400 (EDT)
Received: from [1.1.1.1]] (unknown [2.2.2.2])
by mail.somedomain.com (Postfix) with ESMTP id 8BC86227C01D
for <engineering@somedomain.com>; Fri, 19 Oct 2007 12:23:32 -0400 (EDT)
Subject: joining the @home croud
From: Dan Allen <dallen@somedomain.com>
To: engineering@somedomain.com
Content-Type: text/plain
Organization: SomeDomain
Date: Fri, 19 Oct 2007 12:23:27 -0400
Message-Id: <1192811007.17884.79.camel@saguaro>
Mime-Version: 1.0
X-Mailer: Evolution 2.10.1
Content-Transfer-Encoding: 7bit

Team,

I will also be at home today, the middle of last night accounting for
some of that time.

I was focused through must of yesterday and last night on getting the
read/write of the compress/uncompress columns on note_blobs working in
retro (and hence our new domain model). Thanks to Robert and a crash
course in two's complement numbers, I was able to unravel the compressed
data. I implemented a reusable solution using a Hibernate user type,
which makes the conversion transparent to the application. That has now
been deployed to QA (iatdev).

For those interested:
url omitted

There are a couple of annoyances left in retro that I need to clean up,
but there is no question that we are at the stage of buffing and
shining.

/dan

=== END OF SAMPLE 2 ===

[jbd]

Hey,
I ve the same Problem (4.5.9 OpenSource)

Its very sil...

Jan

[jbd]

nobody any idear???

[shawnlhood]

I'm going to open up a support request later today. This has become a serious problem at my organization. Not because it's moving several e-mails, but some very important e-mails. It is hard to train users to look in their junk folder every day.

Shawn

[shawnlhood]

I still have not opened a support request on this, but am stilling seeing the problem, and I know other people are as well. Is anyone aware of a bugzilla for this? If not, I'm going to have to open a support request. :/

Shawn

[mdeneen]

I don't have a solution for you, but I do have a few questions:

1. Are you using zimbra web ui?
2. Is the message marked as read or unread in the spam folder?

After we rolled out zimbra here, a few users were using the "Junk" button to delete their messages instead of the trash can.

Mark

[shawnlhood]

I've actually noticed this in my own mailbox. Many of us are using the Zimbra UI. They're showing up in the junk folder as unread, and I'm certainly not putting them there.

Shawn

[dwmtractor]

"Many of us are using the Zimbra UI." Are you using it exclusively? The most logical cause of this would be an IMAP client such as Thunderbird doing its own spam classification and moving things into the junk folder. . .that and users (not you obviously ) dragging messages to the junk folder using an IMAP client.

In theory either the "junk" button or dragging to the junk folder IN THE AJAX CLIENT should train the filters properly, but doing so in other programs will not.

I'd also wonder if perchance you have any other mail filters set up that might be moving messages into the junk folder. . .because if the spam engine itself were doing so, they'd have to have the "X-Spam Status: Yes" set, which your sample does not.

[mdeneen]

Good thought -- I was moving from the other direction. I think this is something you should be able to prove by looking at the log files.

Originally Posted by dwmtractor

"Many of us are using the Zimbra UI." Are you using it exclusively? The most logical cause of this would be an IMAP client such as Thunderbird doing its own spam classification and moving things into the junk folder. . .that and users (not you obviously ) dragging messages to the junk folder using an IMAP client.

In theory either the "junk" button or dragging to the junk folder IN THE AJAX CLIENT should train the filters properly, but doing so in other programs will not.

I'd also wonder if perchance you have any other mail filters set up that might be moving messages into the junk folder. . .because if the spam engine itself were doing so, they'd have to have the "X-Spam Status: Yes" set, which your sample does not.

[dwmtractor]

Originally Posted by mdeneen

Good thought -- I was moving from the other direction. I think this is something you should be able to prove by looking at the log files.

It's worth experimenting, but I'm not sure what logfile (if any) is going to record the IMAP client moving a message from one folder to another. It's not a postfix or amavisd operation, if my theory is correct, it's just an IMAP one. Try moving a message from one folder to another (say, inbox to drafts) and then tail your logfiles to see what, if anything is recorded. Wouldn't surprise me if the answer was "nothing."