Quote Originally Posted by phoenix View Post
What you're seeing is known as backscatter or NDR spam, search the forums for the word 'backscatter' for some advice on reducing it.
Thank you for your information.
I have seach information about backscatter and found many URL.
And one important think is : Postfix-backscatter
so I know what is backscatter.

I have implement SPF on zimbra :
- /opt/zimbra/postfix/conf/master.cf.in
smtp inet n - n - - smtpd
#172.16.241.25:smtp inet n - n - - smtpd
-o content_filter=smtp-amavis:[127.0.0.1]:10024

- /opt/zimbra/conf/spamassassin/local.cf
score SPF_FAIL 10.000
score SPF_HELO_FAIL 10.000

And the result, every email scan with spf.
If someone send email using our domain spf will reject that email.

Aug 10 21:59:59 mailserver amavis[11205]: (11205-09) SPAM-TAG, <sam@36xxxx.com> -> <seger@my-domain.com>, No, score=-0.357 tagged_above=-10 required=6.6 tests=[BAYES_00=-2.599, DATE_IN_PAST_03_06=0.044, HTML_MESSAGE=0.001, MIME_HTML_ONLY=1.457, MIME_HTML_ONLY_MULTI=0.001, MONEY_BACK=0.001, MPART_ALT_DIFF=0.739, SPF_PASS=-0.001]