Results 1 to 4 of 4

Thread: [SOLVED] clarification on spam

  1. #1
    Join Date
    Jan 2008
    Location
    Michigan
    Posts
    174
    Rep Power
    7

    Default [SOLVED] clarification on spam

    I am getting ready to bring my test box online at the private school I have been helping. Once spam is trained will it reject spam or let it go thru to the users junk folder? Or, how can I get it to just reject obvious spam without the user even seeing it in the junk folder? I think the staff in the parish office is getting tired of hearing how they can increase the size of their "members"
    thanks for any help you can provide.
    Bill B

  2. #2
    Join Date
    May 2006
    Location
    USA
    Posts
    6,242
    Rep Power
    21

    Default

    It's all dependent on score:
    -Over the kill level & spam is removed.
    -Over the tag level and it's put in the junk folder.

    Right click an email in your junk folder > 'show original' >look at the spam header.

    su - zimbra
    zmprov gacf | grep Precent

    Set by:
    zmprov mcf zimbraSpamKillPercent 75
    zmprov mcf zimbraSpamTagPercent 33
    (defaults)
    You can set this in your admin console gui > global settings > as/av tab.

    In ZCS 5.0.1 and earlier, user filters were run before the spam filter check was run. This meant that if the user filtered mail into a folder, spam would not be identified and sent to the Junk folder. Beginning with 5.0.2, spam check is completed first and messages identified as spam are moved to the Junk folder. With this change, users cannot write a filter to move false positive spam out of the Junk folder. You can create a spam white list for individual accounts that allows an account to identify email addresses that should not be marked as spam. To do this, type zmprov ma user@domain.com +amavisWhiteListSender persontowhitelist@otherdomain.com +amavisWhiteListSender persontowhitelist@otherdomain.com

    Note: If you prefer ZCS 5.0.2 or later to use the spam filter function as it works for 5.0.1 and earlier, you can set the zimbraSpamApplyUserFilters option to True. This can be done by COS or for individual accounts.

    (It's given in percentages on the 20pt scale)
    100% = 20pts
    75% = 15pts
    50% - 10pts
    33% = 6.6pts

    Over kill xpts the mail does not get delivered to the users (unless you set final_spam_destiny to D_PASS - values are D_PASS, D_BOUNCE, D_REJECT and D_DISCARD -search the postfix documentation for descriptions)

    You can change the action (discard vs bounce etc) in amavisd.conf.in (don't edit amavisd.conf directly, edit the .in and restart)
    Note: In that amavisd.conf.in file, wherever possible it's better to set the values with zmprov/admin console (ie: the tag & kill levels) so that it stays consistent across upgrades.

    # $final_virus_destiny = D_DISCARD;
    # $final_banned_destiny = D_BOUNCE;
    $final_spam_destiny = D_DISCARD;
    # $final_bad_header_destiny = D_PASS;

    You can also play with the dsn (delivery status notification) setting; so over a certain points level you won't be responding 'I got your mail' to the spammers.
    $sa_dsn_cutoff_level = 30;

    To delete/not bother quarantining high scoring spam (therefore reducing the number of items in the quarantine) this setting allows you to discard quarantined spam above this level:
    $sa_quarantine_cutoff_level = 35;
    It is cleaned up every day though:
    0 1 * * * find /opt/zimbra/amavisd/quarantine -type f -mtime +7 -exec rm -f {} \; > /dev/null 2>&1

    BUT in newer versions
    your /opt/zimbra/conf/amavisd.conf.in is already mapped to these values (wasn't before):
    $sa_dsn_cutoff_level = %%range VAR:zimbraSpamKillPercent 0 20%%; # spam level beyond which a DSN is not sent
    $sa_quarantine_cutoff_level = %%range VAR:zimbraSpamKillPercent 0 20%%; # spam level beyond which quarantine is off

    I'm a fan of changing the entry in zmmta.cf for smtpd_reject_unlisted_recipients to 'yes', save the file and restart postfix. (postfix reload)
    -This rejects the request when the RCPT TO address is not listed in the list of valid recipients for its domain class. (ie: there's no such user account on the server; aka reduce email to accounts that you don't even have.)

    Some more tips/methods for reducing spam:
    Improving Anti-spam system - Zimbra :: Wiki
    Configuring and Monitoring Postfix DNSBL - Zimbra :: Wiki
    Last edited by mmorse; 07-31-2009 at 11:00 PM.

  3. #3
    phoenix is offline Zimbra Consultant & Moderator
    Join Date
    Sep 2005
    Location
    Vannes, France
    Posts
    23,587
    Rep Power
    58

    Default

    Quote Originally Posted by bbarrons View Post
    IOnce spam is trained will it reject spam or let it go thru to the users junk folder? Or, how can I get it to just reject obvious spam without the user even seeing it in the junk folder?
    Make sure that any change you make is only to Reject messages (the default Discard is the best option), if you bounce spam you will only contribute to the problem as the headers will be forged and some poor user will see lots of backscatter spam.
    Regards


    Bill


    Acompli: A new adventure for Co-Founder KevinH.

  4. #4
    Join Date
    Jan 2008
    Location
    Michigan
    Posts
    174
    Rep Power
    7

    Default

    thanks Bill for the quick reply. that helps alot. it is exactly the info I needed
    Bill

Similar Threads

  1. Spam/Ham training under Outlook/Thunderbird/etc.
    By chuckm in forum Administrators
    Replies: 23
    Last Post: 03-18-2009, 11:01 AM
  2. Trying to understand Zimbra's anti-spam system
    By TaskMaster in forum Users
    Replies: 11
    Last Post: 01-25-2008, 08:59 AM
  3. Spam being scored with BAYES_00
    By flyerguybham in forum Administrators
    Replies: 6
    Last Post: 04-24-2007, 12:07 PM
  4. Spam Training clarification
    By moniker in forum Administrators
    Replies: 2
    Last Post: 11-29-2006, 04:21 PM
  5. Training spam and ham
    By Justin in forum Developers
    Replies: 2
    Last Post: 10-31-2006, 02:39 PM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •