Problems with antispam

[fjla]

Hi, i have a problem. I have version 5 of Zimbra. The antispam system I have it off, and yet at times my customers are going to mail some spam mails, but not the label on the matter as spam, just move them, instead of being in the inbox, places them in spam. Does not usually happen much but it is a problem for some customers. I step log of one of these emails if you see something:


May 10 13:44:23 zimbra-cliente01 postfix/smtpd[12266]: 22593CA161: client=unknown[192.168.2.163]

May 10 13:44:23 zimbra-cliente01 postfix/cleanup[25569]: 22593CA161: message-id=<006901caf036$1f1f5dd0$0e00a8c0@syjjjm>

May 10 13:44:23 zimbra-cliente01 postfix/qmgr[19657]: 22593CA161: from=<jjmartin@quirogaelf.com>, size=26629, nrcpt=1 (queue active)

May 10 13:44:23 zimbra-cliente01 postfix/lmtp[24203]: 22593CA161: to=<fj_schmaeing@mertramar.com>, relay=zimbra-cliente01.iwansev[192.168.2.176]:7025, delay=0.19, delays=0.09/0/0/0.1, dsn=2.1.5, status=sent (250 2.1.5 OK)

May 10 13:44:23 zimbra-cliente01 postfix/qmgr[19657]: 22593CA161: removed

[uxbod]

Would you please show us the headers from one of the emails that went into the Junk folder.

[fjla]

I will try to pass that my client header. Well, since you can not get webmail, right?

[fjla]

Return-Path: jjmartin@quirogaelf.com
Received: from zimbra-cliente01.iwansev (LHLO smtp-out1.iwan21.net)
(192.168.2.176) by zimbra-cliente01.iwansev with LMTP; Mon, 10 May 2010
13:44:23 +0200 (CEST)
Received: from MFILTRO (unknown [192.168.2.163])
by smtp-out1.iwan21.net (Postfix) with ESMTP id 22593CA161
for <fj_schmaeing@mertramar.com>; Mon, 10 May 2010 13:44:23 +0200 (CEST)
Received: from llmf219.servidoresdns.net ([82.223.214.104])
by MFILTRO with bizsmtp
id FnkM1e0012Fj6le01nkNu7; Mon, 10 May 2010 13:44:22 +0200
X-VRSPAM-REASON: gggruggvucftvghtrhhoucdtuddrvdelvddrtdehucdoucgtlh grmhguucetggcurfhrohhfihhlvgemuceonhhonhgvqeenuceu rghilhhouhhtmecupfdsteenucesvcftvggtihhpihgvnhhtsh culddquddttddmnehtuhefgiculddqudehmd
X-VRSPAM-DESCRIPTION: legit
X-VRSPAM-SCORE: -115.00
Received: from localhost (localhost.localdomain [127.0.0.1])
by llmf219.servidoresdns.net (Postfix) with ESMTP id 4A21E4AF3F6;
Mon, 10 May 2010 13:44:20 +0200 (CEST)
X-Virus-Scanned: by amavisd-new
X-Spam-Flag: YES
X-Spam-Score: 7.617
X-Spam-Level: *******
X-Spam-Status: Yes, score=7.617 tagged_above=0.01 required=5
tests=[DOS_OE_TO_MX_IMAGE=3, EXTRA_MPART_TYPE=1, FUZZY_AMBIEN=0.962,
HTML_MESSAGE=0.001, MY_CID_AND_STYLE=0.71, PART_CID_STOCK=1.231,
PART_CID_STOCK_LESS=0.001, SHORT_HELO_AND_INLINE_IMAGE=0.702,
T_TVD_FW_GRAPHIC_ID1=0.01]
X-Spam-Tests: InternalSpamCheck
Received: from syjjjm (87.Red-217-125-56.staticIP.rima-tde.net [217.125.56.87])
by llmf219.servidoresdns.net (Postfix) with ESMTP id 5797C4ACFF3;
Mon, 10 May 2010 13:44:18 +0200 (CEST)
Message-ID: <006901caf036$1f1f5dd0$0e00a8c0@syjjjm>
From: =?iso-8859-1?Q?Juan_Jos=E9_Mart=EDn_Alvarez?= <jjmartin@quirogaelf.com>
To: "Francisco J Rico Sanchez" <francisco.rico@abdax.com>
Cc: "Sr. Schmaeing \( Marbella \)" <fj_schmaeing@mertramar.com>
References: <E3B2FA73-0E58-465A-8CB1-9AC87D4F1DD5@abdax.com>
Subject: Re: VEGASOL.acta_IS.PDF
Date: Mon, 10 May 2010 13:44:16 +0200
MIME-Version: 1.0
Content-Type: multipart/related;
type="multipart/alternative";
boundary="----=_NextPart_000_0065_01CAF046.E2203920"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.3598
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3350
X-Antivirus: avast! (VPS 100511-1, 11/05/2010), Inbound message
X-Antivirus-Status: Clean

[uxbod]

Hmmm .. what does the following report

su - zimbra
zmprov gs `zmhostname` zimbraServiceEnabled

[fjla]

zimbraServiceEnabled: logger
zimbraServiceEnabled: mailbox
zimbraServiceEnabled: mta
zimbraServiceEnabled: stats
zimbraServiceEnabled: snmp
zimbraServiceEnabled: ldap
zimbraServiceEnabled: spell

[uxbod]

Okay; so would you please check /opt/zimbra/postfix/conf/main.cf and look for a line like

content_filter = smtp-amavis:[127.0.0.1]:10024

If that exists would you please let me know what the permissions on that file are; and also on /opt/zimbra/conf/zmmta.cf please.

[fjla]

I don't have this line, the archive has:

content_filter =

Should I put the line who told me or are properly as I have it? empty?

[uxbod]

That is correct if AntiSpam is not being used. Those headers are not being inserted by your Zimbra server! They are being added by another system. The additional header

X-Spam-Tests: InternalSpamCheck

Is not something that Zimbra adds.

[fjla]

then, if Zimbra is not moving the mail to the spam folder, who can do it? part of the user's webmail. Do not understand how this could be happening.