User white/black lists & priority of them

[Jbrabander]

I see in ZCS 6 that user-based white and black lists have been implemented. Will those take priority over the regular built-in spam checkers? Say Zimbra flags something from bob@abc.com as spam, but the recipient has that particular address in their whitelist. Will that piece of mail be delivered?

[mmorse]

It's mapped to amavis[Whitelist/Blacklist]Sender lookup_tables/sender_maps so it should cover anything in Spamassassin or ClamAV. However if you have an RBL in the MTA (Postfix) that's going to drop it earlier.

~~~

RBL's are possible in both locations. Typically the directions we provide are to set a zimbraMtaRestriction attribute (to save across upgrades) which in turn gets fed into the MTA via postfix_recipient_restrictions.cf > smtpd_recipient_restrictions. Spamassisn can also do rbl checks if skip_rbl_checks is set to 0 (default).

Won't go on as it was discussed back in December:

Originally Posted by LMStone

Not exactly...

If you list an RBL in the Zimbra Postfix and a sending server is on the RBL, Postfix will drop the connection.

Whether you do that or not, SpamAssassin will check a number of RBLs, and a positive response from one or more RBLs will add to the email's spam score. If the score is high enough, the email will be blocked or marked as spam.

Spamassassin has no clue as to whether you are doing RBL lookups in Postfix or not.

And even if you are doing RBL lookups in Postfix, it's still a good idea to keep those same RBL lookups in SpamAssassin IMHO.

Another trick is not to use the Postfix RBL lookups at all, but instead do the RBL lookups on a dedicated Postfix box or firewall in front of your Zimbra box. Since a conservative RBL like Spamhaus's Zen list will catch 85% or more of all spam, doing hard RBL blocking before the entire email stream hits your Zimbra server will reduce the load on your Zimbra server by 85% or more.

You are right that if you do the hard RBL blocking in Postfix your statistics will show a pretty clean email stream overall, because the statistics collect only what Amavis does (SpamAssassin and ClamAV), and not what Postfix blocked outright before passing the email stream off to Amavis.

Hope that helps,
Mark

Where a solution to monitor zimbra.log for RBL blocks would be Configuring and Monitoring Postfix DNSBL - Zimbra :: Wiki