local mail getting marked as spam?

matnor · Post by **matnor** » Tue Feb 02, 2010 3:55 am

Any body manage to resolve this issue? I'm having the same probelem now where some of our emails (send from our staff to our other staff using webclient) go to trash if sent from broadband link.
We're runing on Open source 6.0.4 on Centos5.4

phoenix · Post by **phoenix** » Tue Feb 02, 2010 4:55 am

[quote user="matnor"]Any body manage to resolve this issue? I'm having the same probelem now where some of our emails (send from our staff to our other staff using webclient) go to trash if sent from broadband link.[/QUOTE]No mail is sent to the Trash folder by Zimbra, I guess you mean the Junk folder? Without seeing any headers from the mail it's impossible for anyone to give you an answer, you should also post details of your kill/tag percentages.

matnor · Post by **matnor** » Thu Feb 04, 2010 10:35 pm

Yes, going to Junk folder..My kill/tag now is set to 66/25.

++++++++

Return-Path: xxx@u.my

Received: from yyy.u.my (LHLO yyyy.u.my)

(192.168.110.198) by yyyy.u.my with LMTP; Thu, 4 Feb 2010 01:01:21

+0800 (MYT)

Received: from localhost (localhost.localdomain [127.0.0.1])

by yyyy.u.my (Postfix) with ESMTP id DF21571B8045;

Thu, 4 Feb 2010 01:01:20 +0800 (MYT)

X-Virus-Scanned: amavisd-new at yyyy.u.my

X-Spam-Flag: YES

X-Spam-Score: 7.491

X-Spam-Level: *******

X-Spam-Status: Yes, score=7.491 tagged_above=-10 required=5 tests=[AWL=-4.116,

BAYES_50=0.001, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_PBL=0.905,

RCVD_IN_SORBS_WEB=0.619, RCVD_IN_XBL=3.033, RDNS_NONE=0.1,

SUBJ_ALL_CAPS=2.077, SUSPICIOUS_RECIPS=2.912] autolearn=no

Received: from yyyy.u.my ([127.0.0.1])

by localhost (yyyy.u.my [127.0.0.1]) (amavisd-new, port 10024)

with ESMTP id 5-kknmbIeQjH; Thu, 4 Feb 2010 01:01:19 +0800 (MYT)

Received: from yyyy.u.my (yyyy.u.my [192.168.110.198])

by yyyy.u.my (Postfix) with ESMTP id B989D71B8027;

Thu, 4 Feb 2010 01:01:19 +0800 (MYT)

Date: Thu, 4 Feb 2010 01:01:19 +0800 (MYT)

From: xxx

To: Matnor ,

Message-ID:

In-Reply-To:

Subject: EXTRACT OF UMC MEETING NO. 04/10

MIME-Version: 1.0

Content-Type: multipart/mixed;

boundary="----=_Part_95_1579302610.1265216479546"

X-Priority: 1

Importance: high

X-Originating-IP: [203.82.80.86]

+++++++ This was sent from a broadband connection++++++++++++

X-Mailer: Zimbra 6.0.4_GA_2038.RHEL5_64 (ZimbraWebClient - IE8 (Win)/6.0.4_GA_2038.RHEL5_64)

uxbod · Post by **uxbod** » Fri Feb 05, 2010 12:56 am

RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_PBL=0.905,

RCVD_IN_SORBS_WEB=0.619, RCVD_IN_XBL=3.033Blimey you appear to have got yourself onto a lot of RBLs

I would recommend you get that resolved ASAP.
Is 192.168.110.198 the IP of your Zimbra server or your DSL connection ?

matnor · Post by **matnor** » Fri Feb 05, 2010 3:38 am

The broadband wireless connection is "X-Originating-IP: [203.82.80.86]". The 192.168.110.198 is my Zimbra Ip address. I do not have any issue on DSL connection at home.

uxbod · Post by **uxbod** » Fri Feb 05, 2010 3:42 am

RBL/DNSBL Lookup (Blacklist Lookup) for Mailserver 203.82.80.86
You could write a Postfix rule to strip the X-Originating IP and then it would not be hit by SpamAssassin.

matnor · Post by **matnor** » Fri Feb 05, 2010 8:01 am

Thanks..that IP belong to one of the Telco running the broadband services..but the IP is not an IP of an email server..it's an IP given to a PC connected to the broadband network...so same issue as faced by the other people (bjquinn/ewilen etc) on this thread..I'll try some of the above suggestions..

ewilen · Post by **ewilen** » Fri Feb 05, 2010 9:01 am

I filed a bug related to this a while ago: https://bugzilla.zimbra.com/show_bug.cgi?id=44384

uxbod · Post by **uxbod** » Fri Feb 05, 2010 10:04 am

What would that do though ? if it is a authenticated SASL connection it just appends the domain name. I believe there are two approaches:
1) Strip the X-Originating IP (probably not a good idea)

2) Add a hash key as a extra header (some programming fun)
For the second one when Zimbra writes the X-Mailer headerX-Mailer: Zimbra 6.0.4_GA_2038.RHEL5 (ZimbraWebClient - FF3.0 (Linux)/6.0.4_GA_2038.RHEL5)it could include something likeX-Mailer: Zimbra 6.0.4_GA_2038.RHEL5 (ZimbraWebClient - 9ca74ee11848e041eef9320098beb48c - FF3.0 (Linux)/6.0.4_GA_2038.RHEL5)That checksum could be generated with a secret password and perhaps the servers hostname. This could then be checked either 1) by Zimbra 2) via a SpamAssassin Plugin.

13425Elon · Post by **13425Elon** » Thu Aug 12, 2010 7:38 am

Did anyone solve this? TVD_RCVD_SINGLE is annoying.