L. Mark Stone wrote:Any chance that your workstation/laptop from which you ssh'd in to Zimbra to make your password change has a keystroke logger compromise installed?

or a malicious wordpress plugin installed on your 446.it website?
Have you explicitly set the website ip address into zimbraMtaMynetworks?

cesko446 wrote:... i've setup a new password (64 chars) from ssh and restart ...

what exactly you restarted?

The first method sets a rule that refuses the connection if the sasl_username used to authenticate on your MTA differs from the MAIL FROM: line of the envelope. Basically if someone steals your credentials, can authenticate as you@yourdomain.com, and then send a lot oof spam to internal accounts as ...

IOwait is around 10% constantly.

there's a high probability that you have a disk issue. That means slow working mysql and mailboxd. That means general poor performances.

Give us some more info. You have the default domain "example.com", certificates for "mail.example.com" and access your webmail via "mail.example.com" url When you add a new domain "another.com", and you want to access it via "webmail.another.com" you...

Assuming that you have a list of account as dualboot said, you can use zmmailbox this way: for i in $(cat my_account_list); do zmmailbox -z -m $i gact > some_folder/$i.txt ; done BUT zmmailbox is really slow and resource-consuming, if used per-account and here we need a separate file for each accoun...

About the first issue, is an old problem between zimbra and policyd. I think it's caused by the double postfix pass (postfix-> amavis-> postfix). I've tested that in systems without the amavis module, it works correctly. For what concerns the second issue, in 8.7.11 looks working fine: ... track=SAS...

And restart MTAs, to kill active sessions, or previously authenticated users can continue to send even after a password change.

to see what account are compromised cat /var/log/zimbra.log | sed -n 's/.*sasl_username=//p' | sort | uniq -c | sort -n to change compromised account password zmprov sp user@domain.tld newpassword on EVERY mta kill postfix sessions, or spammers authenticated with old passwords will keep sending zmmt...

What is your domain's SPF record ?