Internal Spam Checks

[patrickwilson82]

I just had an issue where all messages from one internal user to another were being flagged as spam. I can't figure out why. As a workaround, I ran this command from the CLI https://wiki.zimbra.com/wiki/Prevent_in ... ed_as_spam to bypass the internal spam checks for everyone. However I see that as being only a temporary solution to what could end up being a bigger problem. Can anyone tell me how to fix this without allowing spoofed or compromised internal messages to come through? Thanks.

[DualBoot]

Hello,

maybe you check the source code of the mail (headers) to see where the antispam
put a high score ?
Regards,

[patrickwilson82]

Hello,

maybe you check the source code of the mail (headers) to see where the antispam
put a high score ?
Regards,

This is what I received in the alert that was sent to my admin account telling me that the message was not deilvered. I'm not really sure what I'm looking for.

Content type: Spam
Internal reference code for the message is 29391-19/9n1Abg2Eo3wB

First upstream SMTP client IP address: [127.0.0.1]:44488 localhost.localdomain

Received trace: ESMTPS /[127.0.0.1]:44488 < ESMTP /132.xxx.xxx.xx

Return-Path: <usera@mydomain.com>
From: User A <usera@mydomain.com>
Message-I <038201d48736$e9822030$bc866090$@mydomain.com>
X-Mailer: Microsoft Outlook 14.0
Subject: Test 11:24
Not quarantined.

The message WAS NOT relayed to:
<userb@controlledpower.com>:
250 2.7.0 ok, discarded, id=29391-19 - spam

Spam scanner report:
Return-Path: <usera@mydomain.com>
Receive from mail.mydomain.com (localhost.localdomain [127.0.0.1])
by mail.mydomain.com (Postfix) with ESMTPS id 8D9C42640090
for <userb@mydomain.com>; Wed, 28 Nov 2018 11:25:01 -0500 (EST)
Receive from zm01.my.domain (ZM01.my.domain [132.xxx.xxx.xx])
by mail.mydomain.com (Postfix) with ESMTP id 89B85264007B
for <userb@mydomain.com>; Wed, 28 Nov 2018 11:25:01 -0500 (EST)
From: User A <usera@mydomain.com>
To: "User B" <userb@mydomain.com>
Subject: Test 11:24
Thread-Topic: Test 11:24
Date: Wed, 28 Nov 2018 11:25:01 -0500 (EST)
Message-I <038201d48736$e9822030$bc866090$@mydomain.com>
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0383_01D4870D.00AC6650"
X-Mailer: Microsoft Outlook 14.0
X-Mailer: Zimbra 8.7.11_GA_1854 (Zimbra-ZCO/8.7.10.1711 (6.1.7601 SP1 en-US) P158c T1508 R8502)
Thread-Index: AdSHNuarl4xuZKcqSN2noDEBKmZjzQ==
Content-Language: en-us
X-Originating-IP: [132.xxx.xxx.xx]

[DualBoot]

Hello,

this is not the Zimbra Anti-Spam which has tagged the mail :

Code: Select all

Content type: Spam
Internal reference code for the message is 29391-19/9n1Abg2Eo3wB

Regards,

[patrickwilson82]

Hello,

this is not the Zimbra Anti-Spam which has tagged the mail :

Code: Select all

Content type: Spam
Internal reference code for the message is 29391-19/9n1Abg2Eo3wB

Regards,

What does that code mean then? All messages from User A to User B were being blocked. As soon as I ran this command, https://wiki.zimbra.com/wiki/Prevent_in ... ed_as_spam the message started coming through.