Results 1 to 4 of 4

Thread: Antispam for Russian users

Hybrid View

  1. #1
    Join Date
    Nov 2009
    Posts
    2
    Rep Power
    6

    Question Antispam for Russian users

    Hello.

    How to check if my antispam filter is learning?

    I'm using ZCS 5.0.12. All my users receives mails in russian. We always send spam to the Junk and false positive we mark as not spam. But I guess the filter is not learning. Every day i receive the same spam mails and mark them as Junk, but the next day I found new one in my Inbox (with the same message body).

    Spamassasin is turned on, there are a lot of mails marked as spam every day. The ratio of true positive (spam marked as spam) to true negative (spam not marked as spam) is about 6:1 which is not good IHMO.

    How do I improve the filter? We have spam and ham accounts, so it should be learning. May this be because of russian text in messages? May be SA can not analyse russian messages, just their headers?

  2. #2
    phoenix is offline Zimbra Consultant & Moderator
    Join Date
    Sep 2005
    Location
    Vannes, France
    Posts
    23,587
    Rep Power
    58

    Default

    Check the details in this thread: http://www.zimbra.com/forums/adminis...ckscatter.html I would suggest you try and determine why you appear to be receiving the same spam before making any modifications to the ant-spam system. Does the email have any spam scores? What are your kill & tag percentages? What do the headers look like for some of the email? Do you have DSPAM enabled?
    Regards


    Bill


    Acompli: A new adventure for Co-Founder KevinH.

  3. #3
    Join Date
    Nov 2009
    Posts
    2
    Rep Power
    6

    Default

    I've read the thread you suggested and I'm not sure it is relevant to me. The spam I receive is not a reply of the some server to a message that is supposed to be from me. I don't have this type of spam. I've simple messages comming from different non-existing mailboxes.

    My kill/tag percentages are 75/33 (as by default). I'm not sure I've DSPAM enabled. How to know it?

    # mysql dspam
    ERROR 1049 (42000): Unknown database 'dspam'

    Does this mean that DSPAM is not installed?

    Which of these do you recomend to enable (here is my config)?
    reject_invalid_hostname (enabled)
    reject_non_fqdn_hostname (off)
    reject_non_fqdn_sender (enabled)
    reject_unknown_client (off)
    reject_unknown_hostname (off)
    reject_unknown_sender_domain (off)

  4. #4
    phoenix is offline Zimbra Consultant & Moderator
    Join Date
    Sep 2005
    Location
    Vannes, France
    Posts
    23,587
    Rep Power
    58

    Default

    Quote Originally Posted by PoltoS View Post
    I've read the thread you suggested and I'm not sure it is relevant to me. The spam I receive is not a reply of the some server to a message that is supposed to be from me. I don't have this type of spam. I've simple messages comming from different non-existing mailboxes.
    There are details in that thread on how to reject 'foreign language' spam.

    Quote Originally Posted by PoltoS View Post
    My kill/tag percentages are 75/33 (as by default).
    Try reducing the to 66/25 and see if that improves anything.

    Quote Originally Posted by PoltoS View Post
    I'm not sure I've DSPAM enabled. How to know it?
    Run the following command or look in the log files at startup to see if dspam is enabled:
    Code:
    zmlocalconfig | grep dspam
    Quote Originally Posted by PoltoS View Post
    # mysql dspam
    ERROR 1049 (42000): Unknown database 'dspam'

    Does this mean that DSPAM is not installed?
    No, it doesn't.

    Quote Originally Posted by PoltoS View Post
    Which of these do you recomend to enable (here is my config)?
    reject_invalid_hostname (enabled)
    reject_non_fqdn_hostname (off)
    reject_non_fqdn_sender (enabled)
    reject_unknown_client (off)
    reject_unknown_hostname (off)
    reject_unknown_sender_domain (off)
    I only use reject_invalid_hostname and some additional RBLs, what RBLs have you got set?

    Code:
    zmprov gacf | grep zimbraMtaRestriction
    Are you discarding emails sent to invalid addresses?

    Do you actually have the ham/spam accounts set-up correctly?

    Code:
    zmprov gacf | grep SpamAccount
    See if they match the names in your Admin UI accounts list, if not set them with:

    Code:
    zmprov mcf zimbraSpamIsSpamAccount spam@domain.com
    zmprov mcf zimbraSpamIsNotSpamAccount ham@domain.com
    obviously put the correct account and domain name in there.
    Regards


    Bill


    Acompli: A new adventure for Co-Founder KevinH.

Similar Threads

  1. Active Directory Script to import users to Zimbra
    By egrueda in forum Administrators
    Replies: 35
    Last Post: 08-29-2012, 11:54 AM
  2. Replies: 1
    Last Post: 11-02-2008, 12:52 AM
  3. Login showing wrong users email
    By gfdos.sys in forum Administrators
    Replies: 10
    Last Post: 04-08-2008, 09:13 AM
  4. Replies: 0
    Last Post: 11-29-2007, 12:57 PM
  5. need advice on configuring zimbra to work with fax server
    By pheonix1t in forum Administrators
    Replies: 0
    Last Post: 07-11-2007, 08:46 PM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •