SPAM: Create an Administrative Archive for all messages above "Kill Percent"

[kazooless]

More thinking out loud:

At work, we use an anti-spam product that archives any e-mail marked as spam that isn't sent to the user. Basically, any mail that Zimbra would mark as above the "Kill Percent."

If a user is expecting an e-mail and it didn't show up, we search the filter and it is usually there. We can then right-click on the message and choose to release it to the user.

Since I've searched and looked around for this on the Wiki and forum and don't see it, I'm going to assume that this isn't a feature available at all yet.

Am I incorrect? Is there a way to implement something similar? Is there an enhancement request like this already? (If so, point me to it and I'll add my vote).

Thoughts?

kazooless

[ewilen]

For virus, there is a quarantine in Zimbra, but it's not very user (or admin) friendly. See Bug 8454 - Quarantined email management functions and Bug 11061 - amavisd virus quarantine should be to a mailbox.

There's nothing like that for spam. In my experience, though, anything that exceeds the default Kill Percent is really egregious--it has to trigger quite a few positives. You can set the Kill Percent even higher than the default if you like.

If you absolutely don't want to kill anything at all, have a look at Bug 11063 - Need ability to specify just tag but don't kill spam and note the workaround mentioned in comment #5.

[kazooless]

Also interesting. However, I'm one that really HATES to see that junk. Based on other's recommendations here and tuning, I'm pretty happy with my settings. I've actually lowered my Kill Percent to 50%.

BUT, every once in a long while, usually when we're signing up for a new online purchase account, a verification e-mail will for some reason bounce instead of get marked as junk. So, for me the only thing that would work is a couple day archive that I would probably only look at a few times a year.

(I run my own open source server with a static IP at home for my family.)

kazooless

[ewilen]

Bounce or be killed?

A bounce is caused by the settings in global settings > mta > DNS checks and Protocol checks. Most often if you're using any RBLs. There's no way to quarantine the stuff that's affected by this.

The "kill" is done by SpamAssassin (amavisd-new, actually), and the designed functionality is that your Junk folder is your quarantine.

You may be able to store spam in a quarantine directory analogous to what happens with viruses by playing around with $spam_quarantine_to somewhere, but I couldn't say exactly where or how you'd want to set/modify this.

(FYI, messages that are caught by the antivirus system are are stored in /opt/zimbra/data/amavisd/quarantine.)

[kazooless]

You're right, "killed." I was sloppy in my wording. The bouncing of RBL stuff I don't want to change.

So, I'd rather have two quarantines. One for the lesser offending junk that goes to each user's box (like my kids). The higher offending stuff going to an administrative quarantine.

I wonder if it would be possible to use the setting you mention for only the higher tagged stuff.

kazooless

[ewilen]

Hm, looking in amavisd.conf, there's some lines in there that might be of interest

$sa_tag_level_deflt  = -10.0;  # add spam info headers if at, or above that level
$sa_tag2_level_deflt = 4.4; # add 'spam detected' headers at that level
$sa_kill_level_deflt = 15; # triggers spam evasive actions
$sa_dsn_cutoff_level = 15;    # spam level beyond which a DSN is not sent
$sa_quarantine_cutoff_level = 15;  # spam level beyond which quarantine is off

(Values taken from my install.)

Note $sa_quarantine_cutoff_level could take a different value from $sa_kill_level_deflt

I wouldn't really recommend messing with these, but if you're prepared to spend time researching how spamassassin, amavisd-new, and Zimbra interact with each other (or if you don't care too much what happens to your mail while you're experimenting) you might get somewhere.

But also note that amavisd.conf is rewritten whenever you restart Zimbra. The proper place to make changes is amavisd.conf.in. There, both variables are set equal to zimbraSpamKillPercent. So you'd need to make the change there, removing the reference to zimbraSpamKillPercent, to make it permanent.

[kazooless]

So the bottom line is that it looks like SA has this type of functionality available, but Zimbra hasn't taken advantage of it yet or integrated this granular of a functionality for it yet (or maybe ever).

It's good to know that it might just be possible to tweak separately though.

Thanks all,

kazoo