Spam Filter in Zimbra 5

[pfefferc]

Will Zimbra 5 have a better spam filter?

[phoenix]

Originally Posted by pfefferc

Will Zimbra 5 have a better spam filter?

How can anyone answer that when we don't know what the basis of your question is? What's wrong with the current spam filters (I guess you're talking about spamassassin & DSPAM)? Perhaps if you outlined some of your concerns then people could answer your question.

The current set-up with spamassassin & DSPAM works fine on my server and that includes the current Beta of r5.

[pfefferc]

Well, I get about 100 spams a day with Zimbra. I have the kill at 90% and the tag at 85%.

[mmorse]

Actually the question might be what are your current usages and intended improvements? ie another product besides spamassassin?
Do you currently make use of any RBL's (real-time black-hole lists)?

Also, things are always tiny improvements check bugzilla under "Mail - MTA/Spam/Virus" and pmweb for planned 5.0 improvements

[mmorse]

Originally Posted by pfefferc

Well, I get about 100 spams a day with Zimbra. I have the kill at 90% and the tag at 85%.

Okay-examine the headers and if you want post a few here (please try to put them in an attached .txt instead of huge messages)

Are you making use of:
reject_invalid_hostname
reject_non_fqdn_hostname
reject_non_fqdn_sender
RBL's
reject_rbl_client dnsbl.njabl.org
reject_rbl_client cbl.abuseat.org
reject_rbl_client bl.spamcop.net
reject_rbl_client dnsbl.sorbs.net
reject_rbl_client sbl.spamhaus.org
reject_rbl_client relays.mail-abuse.org

check current settings:

zmprov gacf | grep zimbraMtaRestriction

zmprov mcf zimbraMtaRestriction reject_invalid_hostname zimbraMtaRestriction reject_non-fqdn_hostname zimbraMtaRestriction reject_non_fqdn_sender zimbraMtaRestriction “reject_rbl_client dnsbl.njabl.org” zimbraMtaRestriction “reject_rbl_client cbl.abuseat.org” zimbraMtaRestriction “reject_rbl_client bl.spamcop.net” zimbraMtaRestriction “reject_rbl_client dnsbl.sorbs.net” zimbraMtaRestriction “reject_rbl_client sbl.spamhaus.org” zimbraMtaRestriction “reject_rbl_client relays.mail-abuse.org”

[pfefferc]

Here is my results:

zmprov gacf | grep zimbraMtaRestriction
zimbraMtaRestriction: reject_invalid_hostname
zimbraMtaRestriction: reject_non_fqdn_sender

[phoenix]

Originally Posted by pfefferc

Well, I get about 100 spams a day with Zimbra. I have the kill at 90% and the tag at 85%.

I'm not surprised you get a lot of spam with those settings, have you actually tried reducing them to catch more spam? Why did you change the settings from the default?.

[mmorse]

Originally Posted by pfefferc

Well, I get about 100 spams a day with Zimbra. I have the kill at 90% and the tag at 85%.

Hence why I wanted to see your headers.
Your thinking in inverse; A high percentage raises the level of points needed to kill that spam.

default: (SpamAssassin score of 20points is considered 100%)
Tag percent at 33%. Mail that is scored at 33% is considered spam and is delivered to the Junk folder. (6.6points)
Kill percent at 75%. Mail that is scored at 75% is considered spam and is not delivered. (15points)

So you were only looking at stuff at 17points and higher
your tag: 20*.85=17points
your kill: 20*.90=18points

[LMStone]

Originally Posted by mmorse

Okay-examine the headers and if you want post a few here (please try to put them in an attached .txt instead of huge messages)

Are you making use of:
reject_invalid_hostname
reject_non_fqdn_hostname
reject_non_fqdn_sender
RBL's
reject_rbl_client dnsbl.njabl.org
reject_rbl_client cbl.abuseat.org
reject_rbl_client bl.spamcop.net
reject_rbl_client dnsbl.sorbs.net
reject_rbl_client sbl.spamhaus.org
reject_rbl_client relays.mail-abuse.org

check current settings:

I think you'll find Spamhaus suggesting most users use zen.spamhaus.org instead of just sbl, or instead of both sbl and pbl.

Hope that helps,
Mark

[mmorse]

Ya I didn't agree with some of the things included in the pbl but I may just use zen anyways.