Daily Mail Report Issue Help Please!

[nicola.daolio]

Hello everybody, first of all I just wanna say that Zimbra is aweseome I got an Ubuntu Srv 8.04 Box with Zimbra 6.0.2 and I've got a problem wich is driving me crazy. I cannot understand why I got so many delivered messages! Here's my daily mail report

Grand Totals
------------
messages

1159 received
21123 delivered
0 forwarded
343 deferred (22448 deferrals)
9163 bounced
211 rejected (0%)
0 reject warnings
0 held
0 discarded (0%)

58508k bytes received
90290k bytes delivered
152 senders
125 sending hosts/domains
17622 recipients
3474 recipient hosts/domains


Per-Hour Traffic Summary
time received delivered deferred bounced rejected
--------------------------------------------------------------------
0000-0100 7 7 0 0 0
0100-0200 7 7 0 0 0
0200-0300 6 6 0 0 2
0300-0400 9 17 0 0 7
0400-0500 6 6 0 0 2
0500-0600 9 10 0 0 2
0600-0700 8 8 0 0 5
0700-0800 7 7 0 0 2
0800-0900 18 18 0 0 5
0900-1000 39 39 1 0 1
1000-1100 54 53 3 0 2
1100-1200 45 50 7 3 6
1200-1300 29 29 3 0 28
1300-1400 32 28 3 1 21
1400-1500 26 25 5 2 6
1500-1600 27 29 5 1 2
1600-1700 28 31 2 0 0
1700-1800 24 25 4 0 8
1800-1900 15 15 1 1 19
1900-2000 6 6 2 0 14
2000-2100 4 4 2 0 4
2100-2200 127 3152 583 2008 6
2200-2300 367 10257 15697 3029 7
2300-2400 259 7294 6130 4118 62


As you can see, from 21 to 24 I'm getting more but i dont' get why I get so many delivered messages.. is that because of bouncing? I'm sure it's not a client cuz at that time nobody's connected. Sorry I'm quite a noob in reading these logs but I got listed in a bunch of rbl and I can't find out a solution.

Thanks in advance for your help.

[phoenix]

That number includes spam that's sent to your server, have you implemented this feature (if you haven't I'd suggest you do): Improving Anti-spam system - Zimbra :: Wiki

[nicola.daolio]

Originally Posted by phoenix

That number includes spam that's sent to your server, have you implemented this feature (if you haven't I'd suggest you do): Improving Anti-spam system - Zimbra :: Wiki

Thanks a lot for your quick and kind answer I'll try asap this conf, I actually have already configured zimbra for rejecting for example wrongaddress@correctdomain.com. So just to get a confirmation I have all of these messages sent:

Host/Domain Summary: Message Delivery (top 50)
sent cnt bytes defers avg dly max dly host/domain
-------- ------- ------- ------- ------- -----------
3927 5401k 1805 10.2 s 1.3 h aol.com
3275 4539k 12064 57.8 s 1.3 h yahoo.com
1696 2619k 0 4.0 s 22.0 s hotmail.com
800 1098k 0 5.2 s 6.5 s uga.edu
599 919k 0 4.1 s 23.0 s msn.com
541 841k 0 3.6 s 21.0 s gmail.com
396 603k 5 9.3 s 8.8 m verizon.net
394 26137k 0 5.9 s 4.3 m dentinrg.com
370 519482 0 5.5 s 8.8 s comcast.net
282 395928 0 5.5 s 9.4 s sbcglobal.net
217 304720 848 5.6 s 1.3 h bellsouth.net
187 262548 667 5.9 s 1.3 h cox.net
174 261156 0 5.0 s 16.0 s earthlink.net
132 185592 579 6.2 s 1.5 h cis.net
126 176926 0 7.2 s 9.4 s att.net
118 165718 17 8.0 s 13.0 s compuserve.com
117 164272 0 5.7 s 8.7 s charter.net
116 164187 21 25.3 s 1.3 h netscape.net
90 133619 0 13.2 s 37.0 s bigfoot.com
88 123552 0 5.6 s 8.5 s juno.com
69 97776 0 6.5 s 7.7 s mailcity.com
67 94202 286 6.6 s 1.3 h dell.com
65 91260 86 7.9 s 13.8 m cris.com
62 97716 59 8.7 m 55.6 m yahoo.co.uk
57 80028 233 5.3 s 1.4 h mysmtpmail.com
55 77220 217 5.6 s 1.3 h dotstandards.com
53 83959 0 3.9 s 7.9 s optonline.net
50 79725 0 5.7 s 15.0 s 236.net
50 70300 250 6.0 s 1.4 h kakinhelp.com
48 67392 0 8.5 s 8.7 s bet.com
46 65358 21 6.0 s 1.3 h cs.com
43 60372 176 5.6 s 1.3 h maildomination.com
42 66969 0 3.3 s 6.7 s hotmail.co.uk
42 65064 0 4.1 s 8.8 s hughes.net
40 63018 0 3.8 s 8.8 s tds.net
40 62260 0 4.3 s 7.5 s mac.com
40 58125 0 6.1 s 8.5 s lycos.com
39 59755 0 4.6 s 7.6 s mindspring.com
39 54766 140 5.7 s 1.3 h adelphia.net
33 46332 0 6.0 s 8.5 s netzero.net
32 51024 0 3.9 s 6.6 s tmail.com
30 44789 1 5.3 s 30.0 s netscape.com
29 40774 122 6.9 s 1.3 h angelfire.com
27 42099 0 4.3 s 8.3 s telus.net
27 37914 53 7.8 s 1.3 h best.com
26 39171 57 8.4 m 1.3 h yahoo.ca
26 36554 0 7.6 s 7.7 s lmco.com
26 36516 0 5.8 s 8.7 s excite.com
26 36504 0 5.7 s 8.3 s embarqmail.com
24 38272 6 3.1 m 36.2 m btinternet.com

because my server answers to the false sender?

[phoenix]

Originally Posted by nicola.daolio

because my server answers to the false sender?

If you already have the reject_unlisted_recipients set then you won't be accepting any mail for the 'unknown' recipients. You'll find that those numbers are the mail that gets sent to your server and not mail that's relayed - they get counted even if they are rejected or discarded.

[nicola.daolio]

the fact is that my deferred queue gets full of messages for lot of random recipients. I wanna know how to stop this cuz it's like I'm bouncing all the requests instead of just REJECTING them. I still have to apply your suggested configuration but, though that I have already implemented reject_unlisted_recipients, would that stop this deferral queue? I just want to be sure that i'm not spamming all over.

Thanks a lot for your help! I REALLY appreciate it!

[nicola.daolio]

I'm posting zimbra.lo with details about the "ghosts" mails that are sent when nobody's connected.

Jan 28 06:33:11 argentina postfix/qmgr[18341]: 7F90B88FC7: from=<messages@wachovia.net>, size=1785, nrcpt=50 (queue active)
Jan 28 06:33:11 argentina postfix/qmgr[18341]: C39CB8906B: from=<messages@wachovia.net>, size=1785, nrcpt=50 (queue active)
Jan 28 06:33:11 argentina postfix/qmgr[18341]: C616489007: from=<messages@wachovia.net>, size=1785, nrcpt=50 (queue active)
Jan 28 06:33:11 argentina postfix/error[28044]: 7F90B88FC7: to=<sempekfamily@cox.net>, relay=none, delay=30055, delays=30055/0.07/0/0.02, dsn=4.0.0, status=deferred
(delivery temporarily suspended: host mx.west.cox.net[68.6.19.3] refused to talk to me: 554 fed1rmimpi05.cox.net IMP THIS IS THE SERVER'S IP blocked.  Error Code: IPBL100 - Re
fer to Error Codes section at http://postmaster.cox.net for more information.)

We are sending with this account messages@wachovia.net to various msn and hotmail accounts...

could this be some deferred messagge that postfix automatically try to resend? every queue is clean looking at the admin interface. I deleted all the queue messages sometime. Help me out please this is really strange...

Thanks a lot.