non-spam messages going into Junk, despite disabled spam-checking

[lindsey]

We currently have a number of external relay servers that perform virus and spam checking for Zimbra. Zimbra receives messages with standard spamassassin markup and files them into /Junk if it's determined to be spam.

Our problem is that Zimbra seems to make its own determination as to whether or not a message is spam, despite the fact that anti-spam is disabled in Zimbra. If a message comes in with "X-Spam-Status: NO", Zimbra may still put it into the Junk folder.

$ zmprov gacf | egrep -i 'spamheader|spamcheck'
zimbraSpamCheckEnabled: FALSE
zimbraSpamHeader: X-Spam-Flag
zimbraSpamHeaderValue: YES

Yet a message with this header was placed into a user's /Junk folder by zmmailboxd:

X-Spam-Status: NO, hits=3.20 required=4.90

Here's the log entry (sanitized):

2010-05-26 11:13:32,515 INFO [LmtpServer-59120] [ip=141.142.2.xxx;] lmtp - Delivering message: size=59163 bytes, nrcpts=1, sender=xxxxxxx.news@example.com, msgid=<a7582679f5d4b4ef6ad9090500129e67@example.co m>
2010-05-26 11:13:32,517 INFO [LmtpServer-59120] [name=devnull@ncsa.uiuc.edu;mid=98;ip=141.142.2.xxx ;] mailop - Adding Message: id=258931, Message-ID=<a7582679f5d4b4ef6ad9090500129e67@example.com>, parentId=-1, folderId=4, folderName=Junk.

The message did *NOT* have an X-Spam-Flag: header (it's only added if the message is determined to be spam). There are no filters on the account that could put it into /Junk.

How can we tell Zimbra to not do any kind of local spam filtering and only put things in /Junk if a zimbraSpamHeader value is matched?

Thanks,

Chris

[phoenix]

Have you actually disabled the anti-spam services on your Zimbra server? You should post all the headers from an email that goes to the junk folder?

[lindsey]

Originally Posted by phoenix

Have you actually disabled the anti-spam services on your Zimbra server? You should post all the headers from an email that goes to the junk folder?

We thought we had disabled it (see the 'zimbraSpamCheckEnabled: FALSE' above), but it continues filtering some messages. We've had it set that way for several years now.

Here are the headers, sanitized. All IP addresses and hostnames in the original resolve without issue.

Return-Path: xxxxxxx.news@example.com
Received: from example.ncsa.uiuc.edu (LHLO example.ncsa.uiuc.edu)
(141.142.2.xxx) by example.ncsa.uiuc.edu with LMTP; Thu, 27 May 2010
07:14:19 -0500 (CDT)
Received: from example2.ncsa.uiuc.edu (example2.ncsa.uiuc.edu [141.142.2.xx])
by example.ncsa.uiuc.edu (Postfix) with ESMTP id CDD85E60C198
for <devnull@example.ncsa.uiuc.edu>; Thu, 27 May 2010 07:14:19 -0500 (CDT)
Received: (from devnull@localhost)
by example2.ncsa.uiuc.edu (8.11.7/8.11.7) id o4RCEEi00615
for devnull@example.ncsa.uiuc.edu; Thu, 27 May 2010 07:14:14 -0500
X-Envelope-From: xxxxxxx.news@example.com
X-Envelope-To: <devnull@ncsa.uiuc.edu>
Received: from example3.ncsa.uiuc.edu (example3.ncsa.uiuc.edu [141.142.2.xx])
by example2.ncsa.uiuc.edu (8.11.7/8.11.7) with ESMTP id o4RCEEs00568
for <devnull@ncsa.uiuc.edu>; Thu, 27 May 2010 07:14:14 -0500
Received: from 151735-9 (updates.example.com [xxx.xx.51.244])
by example3.ncsa.uiuc.edu (8.14.4/8.14.4) with SMTP id o4RCEDsN004392
for <devnull@ncsa.uiuc.edu>; Thu, 27 May 2010 07:14:13 -0500
Received: from 151735-9[127.0.0.1] by 151735-9[127.0.0.1]
(SMTPD32); Thu, 27 May 2010 08:14:12 -0400
Organization: xxxxxxx News
Reply-To: xxxxxxx.news@example.com
Message-ID: <3479a19df053c9b580c3eec7001317cd@example.com>
From: "xxxxxxx News" <xxxxxxx.news@example.com>
To: <devnull@ncsa.uiuc.edu>
Subject: Complimentary Subscription Offer
Date: Thu, 27 May 2010 08:13:25 -0400
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=SPLITOR00A_001_603481718D"
X-Null-Tag: e3c628e1ca388cc076d35e6971ec7ec9
X-Scanned-By: milter-spamc/1.15.388 (example3.ncsa.uiuc.edu [141.142.2.xxx]); Thu, 27 May 2010 07:14:14 -0500
X-Spam-Status: NO, hits=3.20 required=4.90
X-NCSA-MailScanner-Information: Please contact help@ncsa.uiuc.edu for more information, example3.ncsa.uiuc.edu
X-NCSA-MailScanner-ID: o4RCEDsN004392
X-NCSA-MailScanner: Found to be clean
X-Deliver-To: devnull
X-MD5SUMNW: 07a7b1fbf1cf923eff0f39ff9f90cf5e
X-NCSA-Forward: devnull@example.ncsa.uiuc.edu

[lindsey]

I found this thread while searching for my posts. This seemed to do the trick:

zmprov ma user@example.com +zimbraFeatureAntispamEnabled FALSE

Chris

[GWilliams]

Have you read:

Improving Anti-spam system - Zimbra :: Wiki

You can create spam_lovers or spam lovers or spamlovers lists. All the best.

Regards,