How to handle spams that look genuine?

[bhwong]

Recently we have been receiving increasing number of spams that look genuine. Some even fake our colleagues emails. Is there anything we can do to reduce this?

Also, is there a way we can amend the spam filter at the server or domain side instead of individual account side to block emails from some domains or IP addresses?

Thanks,
Boon Hong.

[phoenix]

As usual, a search will find what you need for improving the anti-spam system: Search results for "spam" - Zimbra :: Wiki - there's also details in the forums if you search and you could even try hitting the Junk button for the email as it'll help train the ant-spam system

[uxbod]

Here are a few hints for searching:

SPF
SaneSecurity
FromNotReturnPath

[bhwong]

Look like there is no direct method to do this. Sad.

[uxbod]

Like any open source product you can tweak and tune to your hearts content. If you are able to supply some sample we would be able to help further. Spam always evolves so tuning is an unfortunate practice.

[phoenix]

Originally Posted by bhwong

Look like there is no direct method to do this. Sad.

You've actually provided no information about what the problem actually is other than a vague comment about "increasing number of spams that look genuine". If you want help on the forums you need to provide details of what exactly is in the spam (headers etc.) and what you've already done to improve you anti-spam system. Without that information the responses you get will also be somewhat vague. I mentioned earlier about hitting the Junk button, have you done that for some of this 'spam', what happened?

There are threads all over the forums for techniques on improving the ant-spam system in Zimbra, have you searched and looked at some of those solutions? Which of the techniques in the forums or the wiki articles have you tried? Any of them?

As Uxbod has said, combating spam is a continuing process and you need to adapt and modify your anti-spam techniques to combat the changing vector of the spammers attacks. I'd suggest you visit some of the mailing lists for the anti-spam products installed in Zimbra (and some of the many anti-spam sites on the web) and read up on the techniques they are using.

[Plurnay]

yeah copy paste the "show original" from a couple of your spam that fits your discription and I might able to help you...

I had that problem like a month ago and now they are pretty much all gone

[fathianf]

Hi, I have something similar to this problem. Recently lots of email (junk or not junk) is going into junk directory of our academic staff which has made them so angry. I have lots of virtual domains and even sometimes emails from one domain to other domain is going to junk. I checked this problem and found that some of emails that do'nt have subject or body are the case, but some others without any reason is going to junk. Even I have checked the MX record of other mail servers (from other official offices or internet) to see maybe MX is the problem but no result. Also We receive emails that looks like it is from admin and asking user and pass from users which has made me (as admin) in problem. Please help to manage real junk mails correctly. BTW, My zimbra is opensourse 6.0.2.
Thanks for your great help always

[phoenix]

Originally Posted by fathianf

Hi, I have something similar to this problem. Recently lots of email (junk or not junk) is going into junk directory of our academic staff which has made them so angry. I have lots of virtual domains and even sometimes emails from one domain to other domain is going to junk. I checked this problem and found that some of emails that do'nt have subject or body are the case, but some others without any reason is going to junk. Even I have checked the MX record of other mail servers (from other official offices or internet) to see maybe MX is the problem but no result. Also We receive emails that looks like it is from admin and asking user and pass from users which has made me (as admin) in problem. Please help to manage real junk mails correctly. BTW, My zimbra is opensourse 6.0.2.
Thanks for your great help always

Did you read the other posts in this thread (read my post in detail), you've given no other information other than 'we get spam'. Until you provide some details of what the problem then it's impossible to answer your post.