Backscattering

Hi All,

I'm using Zimbra in my company but the system receive very high level of spam backscatterer.

Actually, this is the Antispam configuration in admin panel of Zimbra : 20% tags SPAM and 90% delete SPAM.

And, this is the restriction enabled on the MTA :

zimbra@mail01:/root$ zmprov gacf | grep zimbraMtaRestriction
zimbraMtaRestriction: reject_non_fqdn_sender
zimbraMtaRestriction: check_policy_service unix:private/policy
zimbraMtaRestriction: reject_invalid_hostname
zimbraMtaRestriction: reject_non_fqdn_hostname
zimbraMtaRestriction: reject_rbl_client bl.spamcop.net
zimbraMtaRestriction: reject_rbl_client dnsbl.sorbs.net
zimbraMtaRestriction: reject_rbl_client sbl.spamhaus.org

But I've a question, what is the perfect solution to delete this backscatterer spam in Zimbra 8 ? If anyone have an howto for Zimbra v8, please ?

Why Zimbra doesn't made default configuration to delete this spam ?

Thank you in advance for your help. :)

Quote:

---

Originally Posted by Gimly

Actually, this is the Antispam configuration in admin panel of Zimbra : 20% tags SPAM and 90% delete SPAM.

---

You've modified those settings to make the spam worse, I suggest you search the forums to find out what the Kill & Tag percentages actually do.

Quote:

---

Originally Posted by Gimly

But I've a question, what is the perfect solution to delete this backscatterer spam in Zimbra 8 ?

---

There is no such thing as a 'perfect solutions' against spam.

Quote:

---

Originally Posted by Gimly

If anyone have an howto for Zimbra v8, please ?

---

Search the wiki and forums for details.

Quote:

---

Originally Posted by Gimly

Why Zimbra doesn't made default configuration to delete this spam ?

---

It does and you've changed the configuration to make it worse, I see very little spam on my server even with the default installation of ZCS. If you really have a backscatter problem then I'd suggest you search the forums (and the internet) for the words "backscatter" & "NDR".

When you post a problem/question you should always give the exact release and version of ZCS that you're using (and update your forum profile) by giving the output of:

Code:

---

zmcontrol -v

---

Hi all,

My Zimbra version

Quote:

---

Release 8.0.2.GA.5569.UBUNTU10.64 UBUNTU10_64 FOSS edition.

---

I open a new topic with backscatter problem because I want to know if I forgot setting on my Zimbra configuration.
Currently, in my Zimbra server, few mailboxes receive NDR spam (over 20000 email by day on one mailbox). I made many different configuration to stop this return but without success.

My antispam configuration in admin panel of Zimbra is :

Quote:

---

% Tags SPAM : 24
% Delete SPAM : 66

---

This is all my zimbra setting to prevent it :

Quote:

---

zimbra@myserver:~$ zmprov gacf | grep zimbraMtaRe
zimbraMtaRestriction: reject_non_fqdn_hostname
zimbraMtaRestriction: reject_non_fqdn_sender
zimbraMtaRestriction: check_policy_service unix:private/policy
zimbraMtaRestriction: reject_rbl_client bl.spamcop.net
zimbraMtaRestriction: reject_rbl_client dnsbl.sorbs.net
zimbraMtaRestriction: reject_rbl_client ips.backscatterer.org
zimbraMtaRestriction: reject_non_fqdn_recipient
zimbraMtaRestriction: reject_unknown_sender_domain
zimbraMtaRestriction: reject_unknown_recipient_domain
zimbraMtaRestriction: reject_unauth_pipelining
zimbraMtaRestriction: reject_unauth_destination
zimbraMtaRestriction: reject_unverified_recipient
zimbraMtaRestriction: reject_rbl_client sbl-xbl.spamhaus.org

---

Or with postconf :

Quote:

---

zimbra@myserver:~$ postconf smtpd_recipient_restrictions
smtpd_recipient_restrictions = reject_non_fqdn_recipient, reject_unlisted_recipient, reject_non_fqdn_sender, reject_unknown_sender_domain, reject_rbl_client bl.spamcop.net reject_rbl_client dnsbl.sorbs.net reject_rbl_client ips.backscatterer.org reject_rbl_client sbl-xbl.spamhaus.org, check_policy_service unix:private/policy, permit

---

In /opt/zimbra/conf/zmconfigd, I change "POSTCONF smtpd_reject_unlisted_recipient" from "no" to "yes"

I generate DomainKey for my domain and add public key in my DNS server.
I create very restrictive SPF record :

Quote:

---

mydomain.fr. 10000 IN TXT "v=spf1 a ptr mx:mx01.mydomain.fr mx:mx02.mydomain.fr ip4:80.245.x.y -all"

---

Is there any other setting to add in Zimbra (cli/webui/etc ...) to prevent this spam ?

Thank you for your help.

Any idea, on how-to block this spam ?

Quote:

---

Originally Posted by Gimly

Any idea, on how-to block this spam ?

---

You only waited three hours to bump this thread, did you read any of the forum threads or wiki articles on this subject (as I suggested in my last post to you in your other thread of December 2012, which you did bother to give a reply)? Have you actually tried any of the solutions suggested in those threads/articles? In future do not start new threads when you already have one open on the same topic - I'll merge this with your other thread.

Ok, sorry Bill.

Yes, I've search on the forums and on the wiki. In many threads, the solution is "search with backscatter or NDR spam" without real solution in Zimbra Forums.
So, I read wiki and I apply all the setting for spam, but the backscatter spam continue. I don't understand why ?

I know my Zimbra server doesn't verify complete email address to drop mail, when the address is not valid. Only verify domain. When I search on the forum, I don't find the setting.

I apply setting that I add in my previous post and I follow this solution :

- Backscatterer.org powered by UCEPROTECT
- http://en.linuxreviews.org/HOWTO_Sto..._using_Postfix
- Postfix Backscatter Howto

I have no catchall-box. I don't have any other idea, I just wish that you provide me a track, if is it possible.

Thank you for your help.

Up !

Any ideas please ?

Thanks !