[SOLVED] Mail originating from the server is being marked as spam

[jorge_s]

In one of my servers, some of the mails sent from one user to another are being marked as spam, even if it they are sent through the Web UI.

Local networks are in "trusted networks" option through web interface. I also modified the spamassassin/local.cf file and added them manually (the trusted_networks line was not in there although it is in th salocal.conf.in file) but it did not fix the problem.

Last thing I have done is whitelisting the domain into salocal.conf.in - whitelist from *@domain.com - like Improving Anti-Spam system wiki article suggested. This is to be tested tomorrow during the day.

What could be happening? I have several Zimbra installations and this is the first time I experience something like this. Any ideas?

thanks!

[xeon]

Please post the header information on the email marked as spam originating from the server. In the web client you can get this information by right clicking the message and clicking "Show Original."

[jorge_s]

Received: from domain.com (LHLO domain.com) (10.10.1.6) by
host.domain.com with LMTP; Tue, 26 Apr 2011 11:25:15 -0500 (PET)
Received: from localhost (localhost.localdomain [127.0.0.1])
by host.domain.com (Postfix) with ESMTP id 36339E00420F3
for <user@domain.com>; Tue, 26 Apr 2011 11:25:15 -0500 (PET)
X-Virus-Scanned: amavisd-new at domain.com
X-Spam-Flag: YES
X-Spam-Score: 10.181
X-Spam-Level: **********
X-Spam-Status: Yes, score=10.181 tagged_above=-10 required=6.6
tests=[BAYES_00=-1.9, HELO_NO_DOMAIN=0.001, HTML_MESSAGE=0.001,
RCVD_IN_BL_SPAMCOP_NET=1.347, RCVD_IN_BRBL_LASTEXT=1.449,
RCVD_IN_PBL=3.335, RCVD_IN_PSBL=2.7, RCVD_IN_RP_RNBL=1.31,
RCVD_IN_SORBS_WEB=0.77, RCVD_IN_XBL=0.375, RDNS_NONE=0.793]
autolearn=no

[phoenix]

Originally Posted by jorge_s

Received: from domain.com (LHLO domain.com) (10.10.1.6) by
host.domain.com with LMTP; Tue, 26 Apr 2011 11:25:15 -0500 (PET)
Received: from localhost (localhost.localdomain [127.0.0.1])
by host.domain.com (Postfix) with ESMTP id 36339E00420F3
for <user@domain.com>; Tue, 26 Apr 2011 11:25:15 -0500 (PET)
X-Virus-Scanned: amavisd-new at domain.com
X-Spam-Flag: YES
X-Spam-Score: 10.181
X-Spam-Level: **********
X-Spam-Status: Yes, score=10.181 tagged_above=-10 required=6.6
tests=[BAYES_00=-1.9, HELO_NO_DOMAIN=0.001, HTML_MESSAGE=0.001,
RCVD_IN_BL_SPAMCOP_NET=1.347, RCVD_IN_BRBL_LASTEXT=1.449,
RCVD_IN_PBL=3.335, RCVD_IN_PSBL=2.7, RCVD_IN_RP_RNBL=1.31,
RCVD_IN_SORBS_WEB=0.77, RCVD_IN_XBL=0.375, RDNS_NONE=0.793]
autolearn=no

These tests are most likely to get triggered if you have the "Add X-Originating-IP to messages" option enabled and the user is sending mail from outside your Trusted Network. You can disable it as a temporary measure (or permanent if you don't use it) and there's an RFE in bugzilla for this problem, IIRC.

[jorge_s]

Ok, I've checked it out and yes, that option was enabled. I have disabled it, I am going to revert the spamassassin modifications I did to see if everything works fine and report it back.

Just one thing, the mails where coming out from trusted networks.