Zimbra forwarding infected messages

[jwilke]

Hello all,

A number of my users have set up automatic forwards to their mobile devices accounts, and I notice in my logs that our relaying server is rejecting some of those messages due to virus infection.

This happens only on the messages that are forwarded to mobile devices. and these messages never get delivered to the user's zimbra email box, so I presume zimbra's AV system is catching them.

Are these forwarded messages being sent out without going through the AV system ?

[uxbod]

If they are being forwarded what is the source of the email ? Is it coming in via SMTP or IMAP/POP3 ?

[jwilke]

The email is being sent from a fake user at a valid domain, to a zimbra distribution list.

what I see is postfix breaking up the DL into its seperate users for local delivery and immediately also sending the message to the user set up forward addresses.

The forwards get bounced by our relay server, due to virus infection

Local users receive an email from content filter stating that the message is infected.

received through smtp.