Daily Mail Report being marked SPAM once a month...

[natrixgli]

Hi,

For some reason my Daily Mail Report has been marked as SPAM twice now, once on Jan 22, then again on Feb 22.

In both cases they were tagged [SPAM] and placed in my Junk folder.

Is it coincidence that both occurrences were on the 22nd? Is there any way to reassure Zimbra that mail from itself is okay?

Obviously this isn't a huge deal but I couldn't help but be a little curious about it even with the sixty billion other things I should probably be more concerned about


Cheers,

-n8

[uxbod]

Right click on it and show original source so you can see what SA rules it hit on. Please then post those headers here so we can advice.

[natrixgli]

Originally Posted by uxbod

Right click on it and show original source so you can see what SA rules it hit on. Please then post those headers here so we can advice.

Here's the header as requested:

Return-Path: zimbra@myserver.mydomain.org
Received: from myserver.mydomain.org (LHLO myserver.mydomain.org)
 (168.xxx.xx.xxx) by myserver.mydomain.org with LMTP; Mon, 22 Feb 2010
 23:30:22 -0600 (CST)
Received: from localhost (localhost [127.0.0.1])
	by myserver.mydomain.org (Postfix) with ESMTP id ACC711498490;
	Mon, 22 Feb 2010 23:30:22 -0600 (CST)
X-Virus-Scanned: amavisd-new at myserver.mydomain.org
X-Spam-Flag: YES
X-Spam-Score: 4.929
X-Spam-Level: ****
X-Spam-Status: Yes, score=4.929 tagged_above=-10 required=4
	tests=[ALL_TRUSTED=-1.8, AWL=-7.511, BAYES_00=-2.599,
	DRUGS_ERECTILE=0.282, DRUG_ED_CAPS=0.322, FH_DATE_PAST_20XX=3.188,
	NORMAL_HTTP_TO_IP=0.001, NUMERIC_HTTP_ADDR=0.001, SPOOF_COM2COM=2.272,
	SPOOF_COM2OTH=2.044, URIBL_AB_SURBL=1.86, URIBL_JP_SURBL=1.501,
	URIBL_OB_SURBL=1.5, URIBL_SBL=1.499, URIBL_WS_SURBL=1.5,
	URI_HEX=0.368, URI_NOVOWEL=0.5, WEIRD_PORT=0.001] autolearn=no
Received: from myserver.mydomain.org ([127.0.0.1])
	by localhost (myserver.mydomain.org [127.0.0.1]) (amavisd-new, port 10024)
	with ESMTP id 6wv6NAMa+naY; Mon, 22 Feb 2010 23:30:16 -0600 (CST)
Received: from localhost.localdomain (myserver.mydomain.org [168.xxx.xx.xxx])
	by myserver.mydomain.org (Postfix) with ESMTP id CB32D149848F
	for <admin@myserver.mydomain.org>; Mon, 22 Feb 2010 23:30:16 -0600 (CST)
Subject: [SPAM]Daily mail report for 2010-02-22
X-Mailer: Mail::Mailer[v2.04] Net::SMTP[v2.31]
To: admin@myserver.mydomain.org
From: admin@myserver.mydomain.org
Message-Id: <20100223053016.CB32D149848F@myserver.mydomain.org>
Date: Mon, 22 Feb 2010 23:30:16 -0600 (CST)

[uxbod]

[SOLVED] FH_DATE_PAST_20XX - Spamassassin bug - incorrect tagging from Jan 1, 2010 on

You should also get yourself of those RBLs!

[natrixgli]

Originally Posted by uxbod

[SOLVED] FH_DATE_PAST_20XX - Spamassassin bug - incorrect tagging from Jan 1, 2010 on

You should also get yourself of those RBLs!

Thanks for the info!

As for the RBL's, I found that the data center where our mail server is located at pretty much has all of their IP's listed in dnswl.org, and I took measures to correct it with them.

-n8

[thunder04]

I just encountered this for the first time! I have the admin e-mail forward to my account, and last night's report ended up in my Junk folder.

Headers:

Return-Path: zimbra@cottontail.ourdomain.org
Received: from cottontail.ourdomain.org (LHLO cottontail.ourdomain.org) (10.1.1.37)
 by cottontail.ourdomain.org with LMTP; Thu, 25 Feb 2010 23:30:16 -0800 (PST)
Received: from localhost (localhost [127.0.0.1])
	by cottontail.ourdomain.org (Postfix) with ESMTP id 7FE6FCD000B;
	Thu, 25 Feb 2010 23:30:16 -0800 (PST)
X-Virus-Scanned: amavisd-new at cottontail.ourdomain.org
X-Spam-Flag: YES
X-Spam-Score: 4.164
X-Spam-Level: ****
X-Spam-Status: Yes, score=4.164 tagged_above=-10 required=4
	tests=[ALL_TRUSTED=-1.8, AWL=-5.663, BAYES_00=-2.599,
	IP_LINK_PLUS=0.001, NORMAL_HTTP_TO_IP=0.001, NUMERIC_HTTP_ADDR=0.001,
	SPOOF_COM2COM=2.272, SPOOF_COM2OTH=2.044, URIBL_BLACK=1.955,
	URIBL_JP_SURBL=1.501, URIBL_OB_SURBL=1.5, URIBL_RHS_DOB=1.083,
	URIBL_SBL=1.499, URIBL_WS_SURBL=1.5, URI_HEX=0.368, URI_NOVOWEL=0.5,
	WEIRD_PORT=0.001] autolearn=no
Received: from cottontail.ourdomain.org ([127.0.0.1])
	by localhost (cottontail.ourdomain.org [127.0.0.1]) (amavisd-new, port 10024)
	with ESMTP id rtq7PbdIdANv; Thu, 25 Feb 2010 23:30:08 -0800 (PST)
Received: from localhost.localdomain (cottontail.ourdomain.org [10.1.1.37])
	by cottontail.ourdomain.org (Postfix) with ESMTP id 2027ACD0005
	for <admin@ourdomain.org>; Thu, 25 Feb 2010 23:30:08 -0800 (PST)
Subject: Daily mail report for 2010-02-25
X-Mailer: Mail::Mailer[v2.04] Net::SMTP[v2.31]
To: admin@ourdomain.org
From: admin@ourdomain.org
Message-Id: <20100226073008.2027ACD0005@cottontail.ourdomain.org>
Date: Thu, 25 Feb 2010 23:30:08 -0800 (PST)

We're running ZCS 6.0.5_GA_2213.DEBIAN4.0.FOSS

Is there anything I can do to make the less likely to happen? I'm only curious.

Thanks!

[thunder04]

I may have answered my own question. I forgot about the whitelist/blacklist in amavisd.conf.in. I'm going to add our admin account to the whitelist with a -10 spam score and see what happens!

[ljramos]

uxbod ..
How about this SA rules for my "{SPAM}Daily mail report for 2011-03-26"X-Spam-Status: Yes, score=15.461 tagged_above=-10 required=6.6 tests=[BAYES_99=3.5, FSL_RU_URL=2.271, NORMAL_HTTP_TO_IP=0.001, NUMERIC_HTTP_ADDR=1.242, TO_EQ_FM_DIRECT_MX=1.136, T_RP_MATCHES_RCVD=-0.01, T_URIBL_BLACK_OVERLAP=0.01, URIBL_BLACK=1.725, URIBL_DBL_SPAM=1.7, URIBL_JP_SURBL=1.25, URIBL_RHS_DOB=1.514, URI_HEX=1.122] autolearn=no

[dwill]

I too was a little shocked when my admin reports first got tagged, then realized that the e-mail contained a big list of blacklisted IP's. Whitelist your admin address