spam getting heavy negative from BAYES_00 -- related to users "ignoring" spam?

[shaver]

I've been noticing that a lot of spam is getting "helped through the system" by BAYES_00 of -2.5 or so. In a majority of these cases, the spam would actually be caught without that change, since they'd be above the 3.0 threshold I have set. (For the most common spam, I'm also seeing the automatic whitelist kick in and give the spam even more help.)

I suspect that the problem is because there's no way for IMAP-using users to indicate to Zimbra that something was spam, so it ends up on the AWL or in Bayes' ham data by default.

How are people dealing with this? If my mental model here is correct, it seems like this would plague all installations that are dominantly IMAP, so I hope I'm missing something easy. Resetting my bayesian database makes me quite nervous (would I need to tweak my tag/kill settings back to the originals and nudge them back down?), but I could entertain it.

I'm running 4.5.10 at the moment.

Mike

[peng1can]

I'm having the same problem under 5.0. I've reset both the bayes and AWL lists almost a dozen times, often priming the database with a collection of ham and spam. Within an hour or two I'm back to having obvious spam match on BAYES_00 and get through.

We had a very similar homebrew setup of Amavis/SA/Postfix back when we were running Cyrus and we didn't have this issue, so I don't think it has anything to do with how attentive users are or aren't. For me, the out-of-the-box zimbra defaults for spam have been useless. Email with a subject line "SEXUALLY-EXPLICIT" shoots right through with a score of 1.1, even with bayes scoring tweaked to 0. We've muddled by using our old install as a front end, but the whole point of an integrated solution was not to have to do that. :-(

[shaver]

Anything here? In an earlier thread, jholder recommended that people upgrade to 4.5.4, but that's clearly not going to be helpful when we're seeing it on 4.5.10 and 5.0.

Do I really need to put another spam control solution in front? That would be...an unfortunate architectural requirement. Would filing a bug be helpful?

[phoenix]

Your IMAP users can forward any spam to the spam mailbox as an attachment, it must go directly to the spam mailbox not the Junk folder. Theer are a couple of RFEs for improving this behaviour in IMAP clients if you'd like to check bugzilla.