Mail going to Junk folder

czguy · Post by **czguy** » Mon Aug 25, 2014 5:02 pm

zmcontrol -v

Release 8.0.6.GA.5922.UBUNTU12.64 UBUNTU12_64 FOSS edition.
I have a specific user on our domain that is getting the majority of his email marked as junk (both internal and external). Even sending a test from his account to himself delivers the message to the Junk folder. Marking all of the messages as Not Spam moves them to the inbox, but several minutes later they are all back in his Junk folder.
Here is a sample header from a message I sent from his account to his own account via the Zimbra Web Interface:
Return-Path: chrisbush@hcems.com

Received: from mail.hcems.com (LHLO mail.hcems.com) (72.14.179.224) by

mail.hcems.com with LMTP; Mon, 25 Aug 2014 16:35:08 -0500 (CDT)

Received: from localhost (localhost [127.0.0.1])

by mail.hcems.com (Postfix) with ESMTP id 7F0AA6B255

for ; Mon, 25 Aug 2014 16:35:08 -0500 (CDT)

X-Spam-Flag: NO

X-Spam-Score: -2.108

X-Spam-Level:

X-Spam-Status: No, score=-2.108 tagged_above=-10 required=6.6

tests=[ALL_TRUSTED=-1, BAYES_00=-1.9, RDNS_NONE=0.793,

RP_MATCHES_RCVD=-0.001] autolearn=no

Received: from mail.hcems.com ([127.0.0.1])

by localhost (mail.hcems.com [127.0.0.1]) (amavisd-new, port 10032)

with ESMTP id 0F_zEd7Q0tvP for ;

Mon, 25 Aug 2014 16:35:08 -0500 (CDT)

Received: from localhost (localhost [127.0.0.1])

by mail.hcems.com (Postfix) with ESMTP id 392056B257

for ; Mon, 25 Aug 2014 16:35:08 -0500 (CDT)

X-Virus-Scanned: amavisd-new at hcems.com

Received: from mail.hcems.com ([127.0.0.1])

by localhost (mail.hcems.com [127.0.0.1]) (amavisd-new, port 10026)

with ESMTP id xBNDqjKG2g8L for ;

Mon, 25 Aug 2014 16:35:08 -0500 (CDT)

Received: from mail.hcems.com (mail.hcems.com [72.14.179.224])

by mail.hcems.com (Postfix) with ESMTP id 196716B255

for ; Mon, 25 Aug 2014 16:35:08 -0500 (CDT)

Date: Mon, 25 Aug 2014 16:35:08 -0500 (CDT)

From: Chris Bush

To: chrisbush

Message-ID:

Subject: Testing Junk x 3 Disregard

MIME-Version: 1.0

Content-Type: text/plain; charset=utf-8

Content-Transfer-Encoding: 7bit

X-Originating-IP: [67.212.234.181]

X-Mailer: Zimbra 8.0.6_GA_5922 (ZimbraWebClient - GC36 (Mac)/8.0.6_GA_5922)

Thread-Topic: Testing Junk x 3 Disregard

Thread-Index: tGdrIumala0MqU9Ve9Oy0CqZZDShCg==

He has an account on our main domain hcems.com with an alias chrisbush@harriscountyems.com pointing to chrisbush@hcems.com. We recently changed the domain on all of our accounts to hcems.com and aliased each account for harriscountyems.com. Not sure if this has anything to do with it, but figured I'd make mention of it. It should be noted, that out of all 100+ accounts we have this particular account is the only one displaying this behavior.
I'm having a bit of a hard time understanding the scoring in the header so any help is greatly appreciated.

Klug · Post by **Klug** » Tue Aug 26, 2014 8:10 am

Did you check both the filters for this user and the "whitelist/blacklist" fields in the preferences?

czguy · Post by **czguy** » Tue Aug 26, 2014 8:48 am

[quote user="8141Klug"]Did you check both the filters for this user and the "whitelist/blacklist" fields in the preferences?[/QUOTE]
Yes sir, he has several filters in place and all of them work properly but would not interfere with proper delivery of messages or divert new messages to the Junk Folder. I've even tried removing all of his filters and the problem still occurs. His whitelist/blacklist fields are blank. He said this problem started shortly after we changed our domain name and created aliases for the old domain. The funny thing is out of all of the accounts on the server (and I've checked each one) this is the only account that has the problem.
What's interesting is that as of this morning I checked his account and he's receiving new messages into his Inbox and they aren't going to Junk. I also marked all of his junk mail as Not Spam and so far it's been an hour and it hasn't moved back to the Junk Folder. All I did last night was restart amavisd and the zimbra server. I'm not sure if that did anything to correct the problem, but I'd really like to figure out why this is happening.
I'm puzzled to say the least.

czguy · Post by **czguy** » Tue Aug 26, 2014 12:09 pm

[quote user="czguy"]Yes sir, he has several filters in place and all of them work properly but would not interfere with proper delivery of messages or divert new messages to the Junk Folder. I've even tried removing all of his filters and the problem still occurs. His whitelist/blacklist fields are blank. He said this problem started shortly after we changed our domain name and created aliases for the old domain. The funny thing is out of all of the accounts on the server (and I've checked each one) this is the only account that has the problem.
What's interesting is that as of this morning I checked his account and he's receiving new messages into his Inbox and they aren't going to Junk. I also marked all of his junk mail as Not Spam and so far it's been an hour and it hasn't moved back to the Junk Folder. All I did last night was restart amavisd and the zimbra server. I'm not sure if that did anything to correct the problem, but I'd really like to figure out why this is happening.
I'm puzzled to say the least.[/QUOTE]
I just checked the account again and the emails that he received were moved into the junk folder again. I'm not sure why this is happening. Any thoughts on this?

czguy · Post by **czguy** » Tue Aug 26, 2014 1:57 pm

I just tried disabling spam checks with this command, restarted the server, and the user's mail still goes to the junk folder.
zmprov ma chrisbush@hcems.com +amavisSpamLover TRUE +amavisBypassSpamChecks TRUE
I'm pulling out my hair here.

Klug · Post by **Klug** » Wed Aug 27, 2014 7:03 am

What is in the mailbox.log file about the messages going to the Junk folder?

czguy · Post by **czguy** » Wed Aug 27, 2014 7:19 am

[quote user="8141Klug"]What is in the mailbox.log file about the messages going to the Junk folder?[/QUOTE]
I can look, what string should I be parsing for? There's a lot of information in the mailbox.log.
Thanks!

phoenix · Post by **phoenix** » Wed Aug 27, 2014 7:31 am

[quote user="czguy"]I can look, what string should I be parsing for? There's a lot of information in the mailbox.log.[/quote]Search for a specific message ID.

czguy · Post by **czguy** » Wed Aug 27, 2014 7:42 am

[quote user="10330phoenix"]Search for a specific message ID.[/QUOTE]
Here is a log excerpt from mailbox.log with a message ID of a message that looks to be delivered into the inbox but is actually diverted to the Junk folder.
2014-08-25 19:27:42,785 INFO [qtp1917006373-1075:http://72.14.179.224:80/service/soap/Se ... MsgRequest] [name=jgadus@hcems.com;mid=134;ip=76.4.62.16;ua=ZimbraWebClient - SAF7 (Mac)/8.0.6_GA_5922;] mailop - Adding Message: id=1123, Message-ID=, parentId=1121, folderId=5, folderName=Sent.

2014-08-25 19:27:42,792 INFO [qtp1917006373-1075:http://72.14.179.224:80/service/soap/Se ... MsgRequest] [name=jgadus@hcems.com;mid=134;ip=76.4.62.16;ua=ZimbraWebClient - SAF7 (Mac)/8.0.6_GA_5922;] smtp - Sending message to MTA at mail.hcems.com: Message-ID=, origMsgId=af080d99-4fc4-4784-afad-acf61729e73b:1117, replyType=r

2014-08-25 19:27:45,263 INFO [LmtpServer-26] [ip=72.14.179.224;] lmtp - Delivering message: size=8823 bytes, nrcpts=1, sender=jgadus@hcems.com, msgid=

2014-08-25 19:27:45,275 INFO [LmtpServer-27] [ip=72.14.179.224;] lmtp - Delivering message: size=9120 bytes, nrcpts=1, sender=jgadus@hcems.com, msgid=

2014-08-25 19:27:45,282 INFO [LmtpServer-27] [name=jjelinek@hcems.com;mid=58;ip=72.14.179.224;] mailop - Adding Message: id=43104, Message-ID=, parentId=-1, folderId=2, folderName=Inbox.

2014-08-25 19:27:45,282 INFO [LmtpServer-26] [name=chrisbush@hcems.com;mid=32;ip=72.14.179.224;] mailop - Adding Message: id=72562, Message-ID=, parentId=-1, folderId=2, folderName=Inbox.

czguy · Post by **czguy** » Thu Aug 28, 2014 6:35 am

Here's another messageid from the mailbox.log that went into the inbox then was moved to junk automatically.
2014-08-27 11:43:47,070 INFO [LmtpServer-97] [ip=72.14.179.224;] lmtp - Delivering message: size=1558 bytes, nrcpts=1, sender=noreply@hcems.com, msgid=

2014-08-27 11:43:47,077 INFO [LmtpServer-97] [name=chrisbush@hcems.com;mid=32;ip=72.14.179.224;] mailop - Adding Message: id=73428, Message-ID=, parentId=-1, folderId=2, folderName=Inbox.