[SOLVED] Zimbra Spam Control v5

[zimadminnew]

Folks,

I've searched the forums and am still feeling a lil' stuck - any support or guidance would be much appreciated.

We host our own mail server (running zimbra Version 5.0.9_GA_2533.RHEL5_64.FOSS ) and I've noticed in the last 3 weeks our spam has increased.

Prior to being on version 4.5 we rarely had any spam and after upgrading to v5 - almost next to no spam was received. I assumed this was down to our spam filter / Spam training accounts.

Over the last few weeks pretty much all my users are getting lots of spam that seems not to get filtered out and almost immediately goes into the inbox.

i've checked the server status and monitor - running as normal (data is stale even after refresh). I've also checked the spam/ ham accounts (both have empty inboxes- im assuiming this is normal).

any guidance to isolate this issue and a starting point to find out where the issue may lie would be super appreciated!

many thanks in advance

[phoenix]

Have you tried changing the kill/tag percentages? Have you tried any of the suggestions in this wiki article (especially the reject_unlisted_recipients)? Do you have any RBLs in use? What type of spam are you seeing? Without sample headers it's hard to give you any advice on what's going on.

[padraig]

Found some good help here

[SOLVED] RBL -- updates

[zimadminnew]

i'm a lil new to this area of administration but will try out the above suggestions and get back to you.


as always thank you for the suggestions!

[Jbrabander]

I'd like to get ours trained better too, probably by tweaking the tag scores in the admin UI. But I'm not sure how to read the headers to know how it translates to the percentages used in the admin.
Here's what I'm looking at in one of the headers. I'd love for this one to end up at least in the junk folder on its own:

X-Spam-Flag: NO
X-Spam-Score: 4.241
X-Spam-Level: ****
X-Spam-Status: No, score=4.241 tagged_above=-10 required=6.6
tests=[AWL=-1.315, BAYES_99=3.5, HTML_MESSAGE=0.001, RDNS_DYNAMIC=0.1,
URIBL_BLACK=1.955]


All the crud from this "user" scores in the 4 to 4.5 range. Am I jsut stuck with getting it in the inbox?

[dwmtractor]

No, you aren't stuck with that at all. That's why Bill suggested you adjust the tag and kill percentages. Each of those operates on a percentage of a total score of 20. In other words, since your header says "required=6.6" I know that your Tag percentage (the score at which messages go to your Junk folder) is 33. Lower it to 20, for example, and the required score will be 4 (20% of 20 = 4). I keep mine at 15 for a tag of 3.

But seriously, spend some quality time with that wiki article that Bill referenced above, it's loaded with handy suggestions.

Improving Anti-spam system - Zimbra :: Wiki

I also recommend RBLs as a powerful tool to control the mess. You can learn more about these and other options by downloading the Zimbra manual and studying page 46 and following.

[Jbrabander]

Ah! May the Gods of IT shine on you! That's part of the puzzle I've been missing all along. I've never known how the "6.6" translates to the percentage shown in the admin UI. I think I'd seen the "20 is 100%" in the manual before, but it had never clicked.

[dwmtractor]

Originally Posted by Jbrabander

Ah! May the Gods of IT shine on you! That's part of the puzzle I've been missing all along. I've never known how the "6.6" translates to the percentage shown in the admin UI. I think I'd seen the "20 is 100%" in the manual before, but it had never clicked.

Glad to be of service! Based on your enthusiastic response, I believe I'll mark this thread solved, but do feel free to post back if you have any further issues.