[SOLVED] Is this a valid move: Milter server to mailarchiva

[alex_rhys-hurn]

Hello.

I am playing with ZIMBRA 7.0.0_GA_3077.UBUNTU10_64 UBUNTU10_64 FOSS edition and Mailarchiva.

If I use the milter server setting on the MTA page of the Server Icon in the webadmin, and add the IP address of my Mailarchiva server, Zimbra sends mails correctly to Mailarchiva, and to everywhere else they are supposed to go.

So, no problems there.

Here is my question: Is this a valid use of that feature? Does doing this mean that I am breaking something else in zimbra (i.e. bypassing some other anti-spam feature?)

What exactly is this feature in Zimbra supposed to be and what is it used for?

Thank you.

Alex

[lytledd]

Alex,

You'll want to review this thread

[SOLVED] Change default milter server bind port

Doug

[alex_rhys-hurn]

Hello Doug,

Thank you for replying.

I actually didnt bother fiddling with Zimbra to change milter port. I just changed mailarchiva to match the Zimbra requirement.

Everything is working for me. I have no problem.

My question is: Is this the real purpose of that function in zimbra? I.e. If I set another milter server ip address and direct the emails there, does this break the internal filtering?

Alex

[lytledd]

I _think_ milter is used for the spam filter and DKIM signing. Since we use ASSP for spam filtering, I have that portion of Zimbra disabled. Will it cause future issues for you, that I couldn't say.

Doug

[Labsy]

Hi,
I have the same question.
Since configuration of Postfix is to be altered with

milter_default_action = tempfail

I assume this HAS to do something with mail processing. It is not simply parallel connection to MailArchiva server, but sending mail to MailArchiva and waiting for confirmation from MailArchiva server, which might slow down mail in Zimbra.

Am I correct?

[heavyb]

I had a similar setup, with changes in Zimbra's postfix for ASSP -> Zimbra -> Mailarchiva. This was last year so please excuse me if I don't exactly recall how I had it setup.

The meaning of my post is to warn that after months of everything working great, Zimbra quit storing mail and we lost a day's worth of activity while I was out of town (of course!). Simply restoring the original miter settings fixed this, but my company had to call a consultant to dig into it and get it fixed.

I strongly recommend using ASSP's copy SPAM/HAM solution to Mailarchiva instead or know what you're doing. If ASSP's copy fails, the mail will still flow.

[Labsy]

Maybe it is the right moment to ask:
how does Zimbra milter actually work?

Inside ZCS I simply added milter server IP, which is public IP of my MailArchiva server, having ports matched on MailArchiva side, and everything works fine. Except of maybe paranoid observation, that mail sent to account on same Zimbra server does not appear instantly (as before), but it takes some additional seconds (MailArchiva is temporarily on a slow line).

So still wondering, if setting up milter server slows down any processing....and also if milter server fails, does it criple mail flow somehow?

[kaosmonk]

Yes, that would be interesting to know, as I spent months trying to associate more than one milter through zimbra configuration, but failed miserably. My idea was to have MailArchiva milter along with the dkim ones, but that setup doesn't work for some reason. I've also have found milter-manager that can gather many milters through its configuration, while presenting itself to the postfix, for example. But for some reason, if I set it to listen to specific port and than made changes within Zimbra and postfix, it wont bind to that port and I got error like:

2011-05-01 22:05:13,254 ERROR [main] [] milter - Unable to start milter server: system failure: Could not bind to port=11125 bindaddr= sl=false useChannels=true

where 11125 is port to which milter-manager listens to, as I'm able to telnet to it with success. The main idea I've had while setting milter-manager was to again have just one ip:port combination that I'll set within Zimbra postfix config, as I failed to set multiple ip:port sets for every and each milter I want to have with Zimbra.
It would be nice if someone could explain this in more detail or at least offer a solution to the problem.

[Labsy]

Kaosmonk, your question actually does not fit into this theme perfectly, because you have multiple milters setup problem, while original theme asks about milter principle usage eglibility.

As per documentation Postfix before-queue Milter support Zimbra uses SMTP-milter configuration. Instead of milter-manager you can add multiple milters in Postfix main.cf, which are then processed in order.

But regarding MAILARCHIVA and after I read some documentation, I doubt that milter is the correct way for integrating MailArchiva with Zimbra server for the main reasons which I question:
- if link to or mailarchiva server itself FAILS, what happens to mail? Does it still flow, or not?
- I assume Mailarchiva is "passive" milter, meaning it does not interfere with message as, for example, DKIM signing milter or spam filtering milter. But is it so or not?
- does integrating Mailarchiva via milter slow down mail processing?
- is link speed to Mailarchiva server influence overal speed of Zimbra processing?

And at last, I configured Mailarchiva without
milter_default_action = tempfail
Actually, I simply put MailArchiva server's IP into Zimbra Admin interface and at first sight all seems to work properly. But does it really?

[liveaverage]

I have to disagree... I've been using MailArchiva + Zimbra (since 4/5) for years (well before Zimbra's addition of the Milter Server field in Zimbra Admin), and milter in Postfix is actually the recommended way to implement MailArchiva using postfix (if you're postfix version supports milter). At least, that's what Mailarchiva's author recommends. The only other method is using always_bcc, which is also possible.

To answer some of your questions:

- if link to or mailarchiva server itself FAILS, what happens to mail? Does it still flow, or not?

* Yes, if the archiva server fails, mail does NOT get sent/received. Zimbra actually throws an error message for outgoing email. The only way around this is disabling the milter flag in Zimbra Administration. If you're using a spam relay OUTSIDE of Zimbra, incoming mail will remain queued on that until your mailarchiva server/connection has been restored. Outgoing email won't even GET processed or queued. It can be saved to the Drafts folder, but nothing else happens short of an error dialog from Zimbra web client.

- I assume Mailarchiva is "passive" milter, meaning it does not interfere with message as, for example, DKIM signing milter or spam filtering milter. But is it so or not?

* Not sure what you mean by this, but MailArchiva DOES modify the email header(s) with a tag: X-MailArchiva-Archive-Date: 20110524071636

- does integrating Mailarchiva via milter slow down mail processing?

* I suppose this depends on several factors (network connection, hardware, etc.), but my site doesn't notice much of a delay... Using my MailScanner spam relay creates more of a delay than the MailArchiva milter config.

- is link speed to Mailarchiva server influence overal speed of Zimbra processing?

* Absolutely. If you're hosting Mailarchiva at an offsite, slow-link location, you're going to notice more of a delay vs an onsite deployment.