Forwarding after spam filtering

[mikelcu]

This seems to have been asked before but with no resolution:

Mail Forward and Spam

Is there any way to forward only "clean" mail, after both AV *and* AS have run? Currently, it seems that any type of forwarding, user-specified, admin-specified or forwarding with a mail filter, all result in *all* mail being forwarded without ever running through SA.

Forwarded mails have no "X-Spam-*" headers, although they do at least have "X-Virus-*". Because of this, mail filters that could forward (or not) based on "X-Spam-*" values don't work because these headers don't appear to exist when the forwarding occurs.

Any ideas?

-M

[brian]

Take a look at comments in Bug 23886 – Run spam test before user filters during message delivery

Keep in mind X-Spam-Flag headers are not added for messages sent from an address within zimbraMtaMyNetworks because they are considered trusted. Virus scanning is still performed.

[mikelcu]

Hm, I'm *not* getting X-Spam headers on forwarded mail, even when its comes randomly from the internet. The last mail server hop before our ZCS install is in a subnet listed in zimbraMtaMyNetworks, but we do get spam headers on mail delivered locally, just not on mail forwarded out. Does forwarded mail get any headers stripped out?


Bug 23886 is super close to addressing the problem, but I'm not sure it solves it completely. Problem is, if a user's mail filter *only* forwards, then the mail is forwarded but not delivered into their mailbox, even if there are more filters later. If a user's filter forwards *and* does "Keep in Inbox", then the mail is forwarded and then dropped into the Inbox, regardless of what later filters do, which basically breaks all subsequent filters that might move mail around.

What we need is a post-spam user-filter where we can forward then "Process Normally" ("send a copy", like an administrative forward does). Both methods of forwarding are nearly there... specifying a user or admin forward will forward then deliver normally, but skips the spam filter. Specifying a forward in a mail filter engages the spam filter, but prevents the other filters from working.

Am I missing anything about the way these features work?

-M

[mikelcu]

Ok, I found something. Turns out I'm half-wrong about mail not being processed after a forwarding filter. Tell me if this is a bug or not:

I set up a forward via filter and put it at the top of my filter list. Inbound mail forwards out to the external address, and if I have a filter later in the chain that matches the mail, that later filter *is* applied, and the mail is filed into a folder, tagged or whatever... it gets delivered as expected.

Here's the big "but". Any mail that does *not* match a later filter vanishes. This is why I thought that the forwarding filter broke local delivery, because I wasn't sending any test mails covered by a filter later in the chain. If I add a filter at the end of the chain that says "put everything in Inbox", I get the desired result. Inbound mail is spam-filtered, then forwarded, then has local delivery filters applied. If I disable this catch-all rule, then any mail not covered specifically by a filter *disappears*.

here's a portion of filters for user@domain.com:

"forward good mail" active all header "X-Spam-Flag" is "NO" redirect  "user@otherdomain.com"
"nagios" active any header "from" contains "nagios" fileinto "Notifications/Nagios" stop
"everything else" active any size over "1B" fileinto "Inbox" stop

If I remove the "everything else" filter, I get *no* mail in Inbox. <= this seems like the bug

The up side is that this looks like an effective, albeit clumsy, way to forward "clean" mail while still maintaining local delivery.

[brian]

make sure you take a look at your /opt/zimbra/log/mailboxd.log when you send a test message. The server will log where it is placing the messages (ie which folder or discard) based on filter rules. You may have a an inadvertent rule that is discarding messages.