Results 1 to 5 of 5

Thread: [SOLVED] Outgoing spam scanning. AWL giving high numbers

  1. #1
    Join Date
    May 2006
    Posts
    11
    Rep Power
    9

    Default [SOLVED] Outgoing spam scanning. AWL giving high numbers

    Hello all. I was having problems with spam so I followed the following guide:
    Improving Anti-spam system - Zimbra :: Wiki

    Unfortunately all of our outgoing messages are scanned by the anti-spam system now. Looking at the headers I see this:
    X-Spam-Flag: NO
    X-Spam-Score: 3.831
    X-Spam-Level: ***
    X-Spam-Status: No, score=3.831 tagged_above=-10 required=5 tests=[AWL=2.731,
    RDNS_DYNAMIC=0.1, SPF_FAIL=1]

    First of all, I don't want outgoing mail to be scanned. Second of all, why is auto white listing giving such a high score? Do I need to reset it?

  2. #2
    Join Date
    Jul 2007
    Location
    San Jose, CA
    Posts
    1,027
    Rep Power
    10

    Default

    OK, so there are a couple things you could do here that might be helpful.

    One, if you don't want your outgoing mail scanned at all, you can whitelist your own domain. This is accomplished by editing /opt/zimbra/conf/spamassassin/local.cf and adding the line
    Code:
    def_whitelist_from_rcvd   *@yourdomain.com
    (obviously substituting your own domain name). You could add this line to the file 60_whitelist.cf, but I prefer to make all my changes in local.cf so that it's easier to back them up. I say this because all your .cf files will be overwritten any time you upgrade Zimbra versions, and it's a whole lot easier to keep your changes in one place.

    However, I would not recommend you make this change at all just yet. First we should deal with your Automatic Whitelist (AWL) which is scoring you so high. I'm the wrong one to defend AWL--I found that I did not agree with its scoring too much of the time, so I just turned it off. I did this by inserting the following lines in local.cf:
    Code:
    # Turn off 'Auto-Whitelist'
    use_auto_whitelist 0
    I have never regretted doing this, but that's partly because in my case I have never had any trouble with false positives (good mail getting classified as junk), only false negatives (junk being classified as good mail). The purpose of AWL is to learn who normally sends junk, and who normally sends you good stuff, and essentially average out the scoring. You may or may not agree with this philosophy, but a vast oversimplification is that a routine spammer will get dinged even if he sends a "good" message, and a routine good sender will get some credit even if he sends a spammy one. As I said, in my case turning off AWL completely has not hurt our performance in the least. But you can read more about AWL here if you like.

    There is, of course, one other possibility. It could be that one or more of your users has sent some truly spammy stuff in the past (stuff that the OTHER filters in SpamAssassin have classified as junk) and that this is what trained AWL that your domain has a spam penalty to be assigned. As the thread I referenced above explains, AWL is really an average-scoring utility for both "good guys" AND "bad guys." You might want to review your users' performance and see if you've got a bad apple messing up the domain, because if this is true, in the future it won't be YOUR filters, but other people's, that ding your messages. After all, none of us want to enable true spamming. . .

    Cheers,

    Dan

  3. #3
    Join Date
    Jul 2007
    Location
    San Jose, CA
    Posts
    1,027
    Rep Power
    10

    Default

    Quote Originally Posted by sleepkreep View Post
    X-Spam-Status: No, score=3.831 tagged_above=-10 required=5 tests=[AWL=2.731,
    RDNS_DYNAMIC=0.1, SPF_FAIL=1]
    I should have added, I see you're getting one point of classification for SPF_FAIL. You might consider adding Sender Policy Framework standards to your DNS (read about it here) to save yourself that point as well.

    Dan

  4. #4
    Join Date
    May 2006
    Posts
    11
    Rep Power
    9

    Default

    Thanks for your help. Everything seems to be working great now.

  5. #5
    Join Date
    Jul 2007
    Location
    San Jose, CA
    Posts
    1,027
    Rep Power
    10

    Default

    Quote Originally Posted by sleepkreep View Post
    Thanks for your help. Everything seems to be working great now.
    Glad to be of service. Marking "Solved."

Similar Threads

  1. Outgoing messages marked as spam
    By jimramsey in forum Administrators
    Replies: 5
    Last Post: 01-10-2008, 03:18 PM
  2. Replies: 2
    Last Post: 10-22-2006, 11:49 AM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •