Junk Folder messages

[Lewisvee]

Dear all

I am a newbie into Zimbra and administering awaiting for version 6 upgrade..
We are receiving some spam mails and I have moved them to the Junk Folder.
How can i know if Zimbra spam check is working?
What happens to the mails moved to Junk folder? will it be removed by default or user has to clean the folder as i have the mails which were moved to Junk Folder nearly a month back.
Kindly help me out ...

[phoenix]

It might be an idea to search the forums first, most questions asked here have already been answered. Messages in the Junk folder are used to train the anti-spam system (via a scheduled cron job) and are retained for a period of time (so the user can check for false positives) and are then removed - you can set the message lifetime via the Admin UI.

[Lewisvee]

The spam folder lifetime is sset to 20 days and i have mails that has beenmoved to junk for more than that period..
How do i confirm the spam train is working fine? & sleep purge is active or not?

[ewilen]

You can confirm spam training is working by looking in /opt/zimbra/log/spamtrain.log

Also you can look at the scores of spam (right-click>view original) to see if the Bayesian scoring has gotten more accurate. (Compare two spams with substantially the same text.) Note that Bayes maxes out at 3.5 unless you tweak your system.

I can't answer why the spam folder lifetime setting hasn't taken effect. Possibly you could try stopping/starting Zimbra. There are a number of settings that require this, including, I believe, some that are set in the admin GUI.

[Lewisvee]

Require help..
Kindly find below :
Return-Path: info@web.com
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: 3.5
X-Spam-Level: ***
X-Spam-Status: No, score=3.5 tagged_above=-10 required=6.6
tests=[BAYES_99=3.5]Received: from mta ([127.0.0.1])
by localhost (mta [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id T-esGYBuIlNw for <account>;
Sun, 9 Aug 2009 02:04:17 +0300 (AST)
Received: from relay1.mevershosting.nl (relay1.mevershosting.nl [85.17.107.31])
by mta (Postfix) with ESMTP id 987A113057A
for <account >; Sun, 9 Aug 2009 02:04:17 +0300 (AST)
Received: from mail16.mevershosting.nl (mail16.mevershosting.nl [85.17.107.226])
by relay1.mevershosting.nl (8.14.3/8.13.8) with ESMTP id n78N31r6026709;
Sun, 9 Aug 2009 01:03:01 +0200
Received: from HTML REDIRECT (localhost [127.0.0.1])
by mail16.mevershosting.nl (8.13.1/8.13.1) with ESMTP id n78Mn78Y025217;
Sun, 9 Aug 2009 00:49:07 +0200
From: "Web Mail Team" <info@web.com>
Reply-To: web-service@w.cn
Subject: Dear Webmail Owner
Date: Sun, 9 Aug 2009 00:49:07 +0200
Message-Id: <20090808224933.M57386@web.com>
X-Mailer: OpenWebMail 2.52 20060502
X-OriginatingIP: 41.220.75.3 (demo)
MIME-Version: 1.0
Content-Type: text/plain;
charset=iso-8859-1
X-Mevershosting.nl-Information: Helpdesk@mevershosting.nl
X-MailScanner-ID: n78N31r6026709
X-Mevershosting.nl-MailScan: Clean
X-Mevershosting.nl-SpamScan: not spam, SpamAssassin (cached, score=1.581,
required 50, autolearn=disabled, MISSING_HEADERS 1.58)
X-Mevershosting.nl-SpamScore: 1
X-Mevershosting.nl-From: info@web.com

[phoenix]

All you have shown there is the headers from an email that is shown as not being spam, what exactly is supposed to be the problem with it?

[Lewisvee]

This message is actually a spam mail which is asking users to enter their ids and passwords inorder to have their accounts safe fom being CLosed down..

Please guide

[phoenix]

Then highlight the message and hit the Junk button (and additionally report it as a web forgery).

[Lewisvee]

Originally Posted by phoenix

Then highlight the message and hit the Junk button (and additionally report it as a web forgery).

Then highlight the message and hit the Junk button (and additionally report it as a web forgery).
Can you please explain a bit on how to repot webforgery?

[phoenix]

Originally Posted by Lewisvee

Can you please explain a bit on how to repot webforgery?

Offhand I don't know how to do this in IE (I assume it's possible) but in Firefox just click on any links you've got in the email and when you get to the web page you'll either see that it's already been reported or if you see the 'fake' page then click on Help/Report Web Forgery - that's all there is to it.