Give us some log if you want some help.

@pub_sepa : can you provide me the link for the bug about double accounting ?
Thank you

Hello,

By default Zimbra (8.8.9) seems to auto white-list mail that passes a DKIM test so no other spamassassin rules are applied (where is this - can I remove it easily ?)

What are the elements which make you thinking that ?

Regards,

Hello,

you can use CBPolicyd module which is embedded with Zimbra.
Full doc is on Zimbra Wiki.

See You

Hello,

maybe you could provide the source of the email ?

Regards,

Hello,

did you read this first :
https://wiki.zimbra.com/wiki/How-to_for_cbpolicyd

Regards,

Hello,

if it is about DoSFilter, you should read this :
https://wiki.zimbra.com/wiki/DoSFilter

Regards,

Hello,

it looks like you have been brute forced. In this case not only SMTP authentification could have been targeted, so
you must look in the /opt/zimbra/log/audit.log to see if there are some trails.
You can use fail2ban to stop this kind of attack.

Regards,

Hello,

you can use filter or upgrade to 8.6 to get advantage of retention policy.

See you

Hello,

here some good practices to secure your mail service :
https://wiki.zimbra.com/wiki/Rejecting_ ... _and_above
https://wiki.zimbra.com/wiki/Enforcing_ ... ername_8.5

Regards,