[SOLVED] Question on RBL

[mtorres]

Have you restarted Zimbra?

[uxbod]

Have you restarted ZCS ? You could try increasing the debug lines in /opt/zimbra/conf/amavisd.conf.in and then restarting ZCS.

[GCamp]

I have restarted ZCS a couple of times. The line sa_debug=1 was commented out in amavisd.conf.in - I removed the comment. and restarted ZCS.

[GCamp]

Originally Posted by uxbod

Have you restarted ZCS ? You could try increasing the debug lines in /opt/zimbra/conf/amavisd.conf.in and then restarting ZCS.

What debug command are you referring to here?

[LMStone]

Originally Posted by GCamp

I have restarted ZCS a couple of times. The line sa_debug=1 was commented out in amavisd.conf.in - I removed the comment. and restarted ZCS.

OK, first, let's get a little more log file verbosity... In /opt/zimbra/amavisd.conf.in, find the line below, and change the log level value from 1 to 2, so the line reads:

$log_level = 2

Next, let's see if Zimbra's Postfix is configured correctly. Please run the following command as the root user and let us know if and where zen.spamhaus.org appears in the file.

# cat /opt/zimbra/postfix/conf/main.cf | grep zen

All the best,
Mark

[GCamp]

I have increased the loglevel to 2. I found the amavisd.conf.in in the /opt/zimbra/conf directory instead of /opt/zimbra/

# cat /opt/zimbra/postfix/conf/main.cf | grep zen

zen.spamhaus.org does show up using the command


A thought occurred to me - all of our email is forwarded from our ISP. Mail comes in to our ISP addressed to xxx@wmpress.org and is redirected to xxx@int.wmpress.org. Is it possible that I am not seeing any log entries because spamhaus is being sent the address of our ISP as the originator of the email?

[LMStone]

Originally Posted by GCamp

A thought occurred to me - all of our email is forwarded from our ISP. Mail comes in to our ISP addressed to xxx@wmpress.org and is redirected to xxx@int.wmpress.org. Is it possible that I am not seeing any log entries because spamhaus is being sent the address of our ISP as the originator of the email?

That would do it, yes.

In your case if your ISP is forwarding a lot of spam emails to you, improving the effectiveness of Zimbra's anti-spam system is the way to go.

You can change the cutoff thresholds in the Admin Console; a good first step to try.

If you still wind up with Inbox spam and start seeing "false positives" in users' junk folders (i.e. legitimate email incorrectly identified as spam), then you'll need to fine-tune the Zimbra anti-spam system.

One method is to install Rules du Jour, which adds another suite of spam checks to SpamAssassin, thereby increasing emails' cumulative spam score.

Others have reported success by turning on DSPAM.

There is no one "best" solution, because each has their strengths and weaknesses.

Not sure that's what you wanted to hear, but there you are...

Hope that helps,
Mark

[GCamp]

Mark

I have a couple of questions. From looking at the email headers there appears to be an IP address for every hop that the email made. How does the MTA know which IP address to send to spamhaus? Is there a logging level that will show just what is being sent to spamhaus?

Greg

[LMStone]

Originally Posted by GCamp

Mark

I have a couple of questions. From looking at the email headers there appears to be an IP address for every hop that the email made. How does the MTA know which IP address to send to spamhaus? Is there a logging level that will show just what is being sent to spamhaus?

Greg

MTAs manage email flows via the message "envelope", which we as mere mortals don't get to see. MTAs report what they have done by writing to the message header. There is some great documentation on the The Postfix Home Page website about this, but that may get you too much into the weeds than you really care to know.

All the RBLs are DNS lookups. Most systems generally don't log the system's DNS lookup to a foreign DNS server. You could run Wireshark and look at the packets flying by, and then you'd know for sure.

Hope that helps,
Mark