[SOLVED] Local messages being marked as spam

[MobiusNZ]

Hi there,

I've got a problem where users are emailing each other but it is going straight to the spam. I think it's to do with the XBL lookup, but the server IP isn't in the database when I checked. Here's a copy of the headers of an affected message (I've just changed the email addresses)

Return-Path: liz@example.org.nz
Received: from zimbra.oxynet.co.nz (LHLO zimbra.oxynet.co.nz) (10.150.1.50)
 by zimbra.oxynet.co.nz with LMTP; Wed, 10 Mar 2010 14:05:42 +1300 (NZDT)
Received: from localhost (localhost [127.0.0.1])
	by zimbra.oxynet.co.nz (Postfix) with ESMTP id AC181300121
	for <sheree@example.org.nz>; Wed, 10 Mar 2010 14:05:42 +1300 (NZDT)
X-Virus-Scanned: amavisd-new at zimbra.oxynet.co.nz
X-Spam-Flag: YES
X-Spam-Score: 5.999
X-Spam-Level: *****
X-Spam-Status: Yes, score=5.999 tagged_above=-10 required=5 tests=[AWL=1.305,
	BAYES_00=-2.599, HTML_IMAGE_ONLY_32=1.778, HTML_MESSAGE=0.001,
	MISSING_SUBJECT=1.762, RCVD_IN_SORBS_WEB=0.619, RCVD_IN_XBL=3.033,
	RDNS_NONE=0.1] autolearn=no
Received: from zimbra.oxynet.co.nz ([127.0.0.1])
	by localhost (zimbra.oxynet.co.nz [127.0.0.1]) (amavisd-new, port 10024)
	with ESMTP id TXNKf4Qd557i for <sheree@example.org.nz>;
	Wed, 10 Mar 2010 14:05:38 +1300 (NZDT)
Received: from zimbra.oxynet.co.nz (zimbra.oxynet.co.nz [10.150.1.50])
	by zimbra.oxynet.co.nz (Postfix) with ESMTP id 82C5A300085
	for <sheree@example.org.nz>; Wed, 10 Mar 2010 14:05:38 +1300 (NZDT)
From: "Liz" <liz@example.org.nz>
To: <sheree@example.org.nz>
Subject: 
Date: Wed, 10 Mar 2010 14:05:38 +1300 (NZDT)
Message-ID: <A05171D046D347B1A69148366482C535@TRN>
MIME-Version: 1.0
Content-Type: multipart/related;
	boundary="----=_NextPart_000_0063_01CAC05A.198581D0"
X-Mailer: Microsoft Office Outlook 11
X-Mailer: Zimbra 6.0.1_GA_1816.UBUNTU8 (ZimbraConnectorForOutlook/6.0.5691.1)
Thread-Index: Acq/7SJElpeHjtPwSUSkqcIiEtejCw==
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5579
X-Originating-IP: [203.97.51.253]

What is causing the RCVD_IN_XBL result? Is it looking up the local (10.150.1.50 or 127.0.0.1) IP for some reason?

[uxbod]

No; it will be looking up

X-Originating-IP: [203.97.51.253]

which you can disable from being added within the Admin GUI.

[MobiusNZ]

Hi uxbod,

Thanks for that, but where do I find this in the admin GUI?

Seems a bit odd to be looking that up if the end user is connecting via the outlook connector and authenticating to the zimbra server. Surely this can't be by design?

[uxbod]

Global Settings -> MTA -> Add X-Originating-IP to messages

[MobiusNZ]

Thanks for that

[ewilen]

See also:

https://bugzilla.zimbra.com/show_bug.cgi?id=31333
https://bugzilla.zimbra.com/show_bug.cgi?id=12277
https://bugzilla.zimbra.com/show_bug.cgi?id=44384

Two cases here:

(1) SASL-authenticated users aren't being trusted. Solved by bug #12277 but only for GnR. Easily fixed if you have Franklin, though; just set smtpd_sasl_authenticated_header = yes in zmmta.cf

(2) Users of ZWC (and possibly Outlook with ZCO) aren't being trusted. This is bug #44384 and I suppose the only workaround currently is Uxbod's suggestion, which I'll add as a comment there.