[SOLVED] How to tell Zimbra that mail from certain address is NOT junk

[Najtssob]

We have migrated from exchange/outlook to zimbra and got stucked by this problem about junk mail.
Mails from certain addresess (quite few of them) are beenig constantly thrown in to junk folder.
How to tell Zimbra not to do this. I tried with mail rules but it doesn't working.

We are using Zimbra 5.0.X.
Thanks for any help.

[king0770]

Best thing to do is look at which spamassassin rules are getting triggered. From the web-client, right-click on the false positive, and select 'show original'. Have a look at the 'X-Spam-Status' line.

[Najtssob]

X-Spam-Flag: YES
X-Spam-Score: 9.811
X-Spam-Level: *********
X-Spam-Status: Yes, score=9.811 tagged_above=-10 required=6.6
tests=[BAYES_99=3.5, DNS_FROM_OPENWHOIS=1.13, FH_DATE_PAST_20XX=3.188,
FRT_VALIUM1=1.59, FRT_VALIUM2=1.301, FUZZY_VLIUM=0.001,
HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-1, RDNS_NONE=0.1]

X-Spam-Flag: YES
X-Spam-Score: 7.326
X-Spam-Level: *******
X-Spam-Status: Yes, score=7.326 tagged_above=-10 required=6.6
tests=[AWL=-0.169, BAYES_60=1, DNS_FROM_OPENWHOIS=1.13,
FH_DATE_PAST_20XX=3.188, RDNS_NONE=0.1, SUBJ_ALL_CAPS=2.077]

This is from original message, can you please explain how to see which SA rule is effecting this.

Also i have set forwarding to alternate gmail address where i receive all mail and none gets into junk folder.
So I think Zimbra is to paranoic at least in version 5.0.X.

[phoenix]

Originally Posted by Najtssob

This is from original message, can you please explain how to see which SA rule is effecting this.

X-Spam-Flag: YES
X-Spam-Score: 9.811
X-Spam-Level: *********
X-Spam-Status: Yes, score=9.811 tagged_above=-10 required=6.6
tests=[BAYES_99=3.5, DNS_FROM_OPENWHOIS=1.13, FH_DATE_PAST_20XX=3.188,
FRT_VALIUM1=1.59, FRT_VALIUM2=1.301, FUZZY_VLIUM=0.001,
HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-1, RDNS_NONE=0.1]

That would be the ones with high scores, search the forums for the items highlighted above and you'll find answer to what the problem is with those scores - hint, it's nothing to do with ZImbra. If you want to find out what any specific rule does the just copy/paste it's name into a google search or go to the Apache (Spamassassin) web site and search.

Originally Posted by Najtssob

Also i have set forwarding to alternate gmail address where i receive all mail and none gets into junk folder.
So I think Zimbra is to paranoic at least in version 5.0.X.

Could it be the fact you're receiving more spam than you have in the past.

[Najtssob]

I receive NO spam, we sit behind ironport which does great job.

Mail that is thrown to junk folder in Zimbra is OK for gmail (i have enabled mail forwarding to my gmail account).

Is there option that i can tell Zimbra that mail fom certain address is OK and to leave it alone ?
Can these be done throug admin web interface ?

[phoenix]

Originally Posted by Najtssob

I receive NO spam, we sit behind ironport which does great job.

Then where are the headers from that you've posted above and why did you post the following statement?

Originally Posted by Najtssob

So I think Zimbra is to paranoic at least in version 5.0.X.

Originally Posted by Najtssob

Mail that is thrown to junk folder in Zimbra is OK for gmail (i have enabled mail forwarding to my gmail account).

I don't understand what you mean by this statement.

Originally Posted by Najtssob

Is there option that i can tell Zimbra that mail fom certain address is OK and to leave it alone ?

Yes, you can search the forums and the wiki for the word 'whitelist'. You could also use the Whitelist/Blacklist feature in the user Preferences or you could even use the 'Not Junk' button when you want an email to be trained as not junk.

Originally Posted by Najtssob

Can these be done throug admin web interface ?

No, it can't.

[Najtssob]

>>Then where are the headers from that you've posted above and why did you post the following statement?

Headers are from mail that gets throug ironport but end up in Zimbra junk folder. This mail is all legitimate buisness mail.

-----

>>I don't understand what you mean by this statement.

Preferences > Mail > Receiving Messages > Forward a copy to:
here I have entered my gmail address.
If i go to the gmail I see ALL mail in the inbox, but in Zimbra there is a lot of mail in the Junk folder insted of inbox.
Yes, mail that ends up in Junk folder in Zimbra is also forwarded to Gmail and NOT thrown to junk in Gmail.

-----

>>Yes, you can search the forums and the wiki for the word 'whitelist'. You could also use the Whitelist/Blacklist feature in the user Preferences or you could even use the 'Not Junk' button when you want an email to be trained as not junk.

I can't find Whitelist/Blacklist option under preferences, I am using Zimbra 5.
'Not Junk' button showed no effect in past few days.

-----

Thanks for all your help, Zimbra is great and so are you.

[phoenix]

Originally Posted by Najtssob

>>Then where are the headers from that you've posted above and why did you post the following statement?

Headers are from mail that gets throug ironport but end up in Zimbra junk folder. This mail is all legitimate buisness mail.

Yes, it may be 'legitimate' email but it fails some anti-spam tests in Spamassassin - I've already suggested that you search the forums for the highlighted tests and you'll find out why.

Originally Posted by Najtssob

>>I don't understand what you mean by this statement.

Preferences > Mail > Receiving Messages > Forward a copy to:
here I have entered my gmail address.
If i go to the gmail I see ALL mail in the inbox, but in Zimbra there is a lot of mail in the Junk folder insted of inbox.
Yes, mail that ends up in Junk folder in Zimbra is also forwarded to Gmail and NOT thrown to junk in Gmail.

See the answer above.

Originally Posted by Najtssob

>>Yes, you can search the forums and the wiki for the word 'whitelist'. You could also use the Whitelist/Blacklist feature in the user Preferences or you could even use the 'Not Junk' button when you want an email to be trained as not junk.

I can't find Whitelist/Blacklist option under preferences, I am using Zimbra 5.

That's a Zimbra 6 feature so I'd suggest you update your forum profile with the output of the following command:

zmcontrol -v

You can set whitelist/blacklist, have a search of the wiki (and the forums) for 'whitelist'.

[Najtssob]

>>You can set whitelist/blacklist, have a search of the wiki (and the forums) for 'whitelist'.

I did. Do I realy need to restart server for this ?


>>Yes, it may be 'legitimate' email but it fails some anti-spam tests in Spamassassin

Now I know this. I only wanted to point out that Zimbra is more paranoic about spam than gmail.


Thanks for all.

[king0770]

This is not a Zimbra problem per se, it was the rules SA rules Zimbra was using.

The workaround this issue is to modify the following files and remove or comment references to OPENWHOIS:

/opt/zimbra/conf/spamassassin/STATISTICS-set1.txt
/opt/zimbra/conf/spamassassin/STATISTICS-set3.txt
/opt/zimbra/conf/spamassassin/active.list
/opt/zimbra/conf/spamassassin/50_scores.cf
/opt/zimbra/conf/spamassassin/72_active.cf

Also, edit /opt/zimbra/conf/spamassassin/72_active.cf

Modify

##{ FH_DATE_PAST_20XX
header FH_DATE_PAST_20XX Date =~ /20[1-9][0-9]/ [if-unset: 2006]
describe FH_DATE_PAST_20XX The date is grossly in the future.
##} FH_DATE_PAST_20XX

To

##{ FH_DATE_PAST_20XX
header FH_DATE_PAST_20XX Date =~ /20[2-9][0-9]/ [if-unset: 2006]
describe FH_DATE_PAST_20XX The date is grossly in the future.
##} FH_DATE_PAST_20XX

Additional info:
Bug 45625 – remove OPENWHOIS references from spamassasin config
Bug 43766 – FH_DATE_PAST_20XX - Spamassassin incorrect tagging from today