Page 2 of 2 FirstFirst 12
Results 11 to 12 of 12

Thread: Spam Whitelist?

  1. #11
    Join Date
    Sep 2006
    Location
    477 Congress Street | Portland, ME 04101
    Posts
    1,374
    Rep Power
    11

    Default

    Quote Originally Posted by flyinraptr View Post
    Running v5.0.13 - open source on Ubuntu 8.04. Following the guide on this site adjusted the percentages for Spam reject and deletion to block out more spam - it is working satisfactorily as less spam is ending up in the inbox & junk folder, however, there are a couple sites that are now being deleted that I would like to receive without opening the whole thing back up. Haven't been able to find anything with regards to creating a "whitelist". Is this possible and could someone point me in the right direction on how to do it?

    Thanks
    FWIW, we don't like to whitelist any email address ever. Our reasoning is that the user's PC whose email address you are whitelisting may one day get infected, and then you have enabled their PC to send who-knows-how-many millions of spam emails, or emails containing malware through your Zimbra server.

    So, we prefer to "pre-score" certain email addresses instead.

    This mod won't stick between Zimbra upgrades, but it provides for a level control and adjustment that just out and out whitelisting doesn't.

    To do this, just find the section in /opt/zimbra/conf/amavisd.conf.in that starts with:

    Code:
    #  read_hash("/var/amavis/sender_scores_sitewide"),
    
       { # a hash-type lookup table (associative array)
         'nobody@cert.org'                        => -3.0,
         'cert-advisory@us-cert.gov'              => -3.0,
         'owner-alert@iss.net'                    => -3.0,
         'slashdot@slashdot.org'                  => -3.0,
         'securityfocus.com'                      => -3.0,
         'ntbugtraq@listserv.ntbugtraq.com'       => -3.0,
         'security-alerts@linuxsecurity.com'      => -3.0,
    Add the email addresses you wish to "whitelist" to this list.

    The way it works is that the "-3.0" Amavis tells Spamassassin is the "pre-score" for all emails from that email address.

    In the absence of a prescore, inbound emails have a score of zero before being screened by SpamAssassin. If the SpamAssassin test results generate a score above either threshold, the email is discarded or marked as spam and sent to the Junk folder.

    Say for example your users get emails from a less-than RFC-compliant configured email server, so all the emails from that server arrive with a score of 6.5 or so; your Zimbra users will likely not ever see those emails, and they will complain.

    So, if you prescore those senders with -3.0, then those emails which would otherwise have earned a 6.5 score will now get a 3.5 score and make it to your Zimbra users' Inboxes, ending the complaints.

    But, if the sender starts sending real junk/malware/viruses, that truly junk email will likely get a score well above 10.0. With a prescore of -3.0, the net score (7.0) will still be high enough to have that junk email filtered out by Zimbra, protecting your users.

    BTW, after you modify the /opt/zimbra/conf/amavisd.conf.in file, you'll need to run as the zimbra user zmamavisctl stop; zmamavisctl start.

    Hope that helps,
    Mark

  2. #12
    Join Date
    Sep 2010
    Posts
    3
    Rep Power
    5

    Default

    Mark, thanks for the useful info.

    I want to do something similar, except I want to soft-whitelist emails we receive to a particular address (not from).

    I'm assuming I can just edit a line in /opt/zimbra/conf/amavisd.conf.in like this...

    @score_sender_maps = ({ # a by-recipient hash lookup table,
    # results from all matching recipient tables are summed

    # ## per-recipient personal tables (NOTE: positive: black, negative: white)
    # 'user1@example.com' => [{'bla-mobile.press@example.com' => 10.0}],
    # 'user3@example.com' => [{'.ebay.com' => -3.0}],
    # 'user4@example.com' => [{'cleargreen@cleargreen.com' => -7.0,
    # '.cleargreen.com' => -5.0}],
    'username@mydomain.com' => '.' => -5.0}],
    Would this work?

    The reason I want to do this is that we have an address that receives important emails. We've found we've missed some emails because they've ended up in junk. We'd rather receive more spam on that address than risk missing emails.

    Thanks

    Al

Similar Threads

  1. Weird behaviors and LOTS of spam.
    By zwvpadmin in forum Administrators
    Replies: 7
    Last Post: 01-02-2009, 09:26 AM
  2. spam - ham training
    By Viking0 in forum Administrators
    Replies: 6
    Last Post: 12-02-2008, 12:07 PM
  3. Major SPAM to one account
    By CarputerTech in forum Administrators
    Replies: 4
    Last Post: 09-04-2008, 10:54 PM
  4. Trying to understand Zimbra's anti-spam system
    By TaskMaster in forum Users
    Replies: 11
    Last Post: 01-25-2008, 08:59 AM
  5. whitelist for postfix spam filters
    By pheonix1t in forum Administrators
    Replies: 11
    Last Post: 11-13-2006, 03:57 AM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •