[SOLVED] clarification on spam

[bbarrons]

I am getting ready to bring my test box online at the private school I have been helping. Once spam is trained will it reject spam or let it go thru to the users junk folder? Or, how can I get it to just reject obvious spam without the user even seeing it in the junk folder? I think the staff in the parish office is getting tired of hearing how they can increase the size of their "members"
thanks for any help you can provide.
Bill B

[mmorse]

It's all dependent on score:
-Over the kill level & spam is removed.
-Over the tag level and it's put in the junk folder.

Right click an email in your junk folder > 'show original' >look at the spam header.

su - zimbra
zmprov gacf | grep Precent

Set by:
zmprov mcf zimbraSpamKillPercent 75
zmprov mcf zimbraSpamTagPercent 33
(defaults)
You can set this in your admin console gui > global settings > as/av tab.

In ZCS 5.0.1 and earlier, user filters were run before the spam filter check was run. This meant that if the user filtered mail into a folder, spam would not be identified and sent to the Junk folder. Beginning with 5.0.2, spam check is completed first and messages identified as spam are moved to the Junk folder. With this change, users cannot write a filter to move false positive spam out of the Junk folder. You can create a spam white list for individual accounts that allows an account to identify email addresses that should not be marked as spam. To do this, type zmprov ma user@domain.com +amavisWhiteListSender persontowhitelist@otherdomain.com +amavisWhiteListSender persontowhitelist@otherdomain.com

Note: If you prefer ZCS 5.0.2 or later to use the spam filter function as it works for 5.0.1 and earlier, you can set the zimbraSpamApplyUserFilters option to True. This can be done by COS or for individual accounts.

(It's given in percentages on the 20pt scale)
100% = 20pts
75% = 15pts
50% - 10pts
33% = 6.6pts

Over kill xpts the mail does not get delivered to the users (unless you set final_spam_destiny to D_PASS - values are D_PASS, D_BOUNCE, D_REJECT and D_DISCARD -search the postfix documentation for descriptions)

You can change the action (discard vs bounce etc) in amavisd.conf.in (don't edit amavisd.conf directly, edit the .in and restart)
Note: In that amavisd.conf.in file, wherever possible it's better to set the values with zmprov/admin console (ie: the tag & kill levels) so that it stays consistent across upgrades.

# $final_virus_destiny = D_DISCARD;
# $final_banned_destiny = D_BOUNCE;
$final_spam_destiny = D_DISCARD;
# $final_bad_header_destiny = D_PASS;

You can also play with the dsn (delivery status notification) setting; so over a certain points level you won't be responding 'I got your mail' to the spammers.
$sa_dsn_cutoff_level = 30;

To delete/not bother quarantining high scoring spam (therefore reducing the number of items in the quarantine) this setting allows you to discard quarantined spam above this level:
$sa_quarantine_cutoff_level = 35;
It is cleaned up every day though:
0 1 * * * find /opt/zimbra/amavisd/quarantine -type f -mtime +7 -exec rm -f {} \; > /dev/null 2>&1

BUT in newer versions your /opt/zimbra/conf/amavisd.conf.in is already mapped to these values (wasn't before):
$sa_dsn_cutoff_level = %%range VAR:zimbraSpamKillPercent 0 20%%; # spam level beyond which a DSN is not sent
$sa_quarantine_cutoff_level = %%range VAR:zimbraSpamKillPercent 0 20%%; # spam level beyond which quarantine is off

I'm a fan of changing the entry in zmmta.cf for smtpd_reject_unlisted_recipients to 'yes', save the file and restart postfix. (postfix reload)
-This rejects the request when the RCPT TO address is not listed in the list of valid recipients for its domain class. (ie: there's no such user account on the server; aka reduce email to accounts that you don't even have.)

Some more tips/methods for reducing spam:
Improving Anti-spam system - Zimbra :: Wiki
Configuring and Monitoring Postfix DNSBL - Zimbra :: Wiki

[phoenix]

Originally Posted by bbarrons

IOnce spam is trained will it reject spam or let it go thru to the users junk folder? Or, how can I get it to just reject obvious spam without the user even seeing it in the junk folder?

Make sure that any change you make is only to Reject messages (the default Discard is the best option), if you bounce spam you will only contribute to the problem as the headers will be forged and some poor user will see lots of backscatter spam.

[bbarrons]

thanks Bill for the quick reply. that helps alot. it is exactly the info I needed
Bill