Webmail Client Email Being Tagged as SPAM

[the_griz]

I have users who are using the webmail client from home. However, many of them send email from the web client to others in the company and those emails get filed to JUNK.

We run ZCS 7.0 here.

Here's the SPAM test results of an example email.

X-Spam-Status: Yes, score=3.62 tagged_above=-10 required=1
tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_PBL3.335,
RCVD_IN_SORBS_DUL=0.001, RDNS_NONE=0.793,
SHORT_HELO_AND_INLINE_IMAGE=1.39]

Our SPAM filter is set to 1 and we whitelist aggressively. This has been great at capturing SPAM but I am confused why our webmail is getting tagged as SPAM. RCVD_IN_PBL is the culprit but SpamHaus' PBL does not have us listed at all. Why is this so high and how can I fix that?

Thanks!
Tom

[John Siu]

In web admin interface
-->Configuration
-->Server Settings
-->MTA
-->Trusted Network

You should have:

127.0.0.0/8, <Your Machine IP>/32

[gvillari]

Hi,

maybe the following wiki can help you to solve your issue:

Increase in Spam Score After Upgrading to Version 6.0.7 - Zimbra :: Wiki

Regards

[phoenix]

Originally Posted by gvillari

maybe the following wiki can help you to solve your issue

This is part of the problem:

Originally Posted by the_griz

Our SPAM filter is set to 1 and we whitelist aggressively.

Originally Posted by the_griz

X-Spam-Status: Yes, score=3.62 tagged_above=-10 required=1
tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_PBL3.335,
RCVD_IN_SORBS_DUL=0.001, RDNS_NONE=0.793,
SHORT_HELO_AND_INLINE_IMAGE=1.39]

Our SPAM filter is set to 1 and we whitelist aggressively. This has been great at capturing SPAM but I am confused why our webmail is getting tagged as SPAM. RCVD_IN_PBL is the culprit but SpamHaus' PBL does not have us listed at all. Why is this so high and how can I fix that?

It's not 'you' that's the problem, it's the fact that you (probably) have the "Add X-Originating-IP to messages" option enabled and the person submitting the email is on the PBL - if you check the PBL you'll see the reason a users would be on it. Also, IMO, the 'required=1' is too restrictive and you'll end up with too many false positives because of it.

[the_griz]

Thanks for the responses.

I have shut-off the "Add X-Originating-IP to messages" and we'll see how that works. It makes sense that that was the main issue.

My server's IP was already included in the MTA Trusted networks so I don't think that was the issue.

As far as "1" being too restrictive.... Prior to that change, I had 75% of my users routinely complaining about the SPAM volume coming through Zimbra. I have gone back and forth on the forums and my own research to mitigate it, but it just was not working. By going to "1" and whitelisting aggressively, I can now reduce SPAM volume to a 97% catch rate. My users still cruise their Junk and email me domains that should be permitted, but life is much better.

I know my situation is not similar to most, but at least here, we find the setting and our subsequent efforts to be far more successful.

Thanks for the help!
Tom