Spam tag added
Results 1 to 10 of 10

Thread: Spam tag added

  1. #1
    Senior Member
    Join Date
    Sep 2012
    Posts
    89

    Question Spam tag added

    Hi,

    I know probably this isn't zextras related but it started right after a zextras update and I need to cross it out to be sure.

    Several mails are being tagged with "Spam" string in subject. Is not consistent (at least I didn't find any correlation) and tagged messages DON'T go to user's spam folder. They just get this additional string at the begining of subject.

    I've checked amavis without any luck.

    Any hints?
    Zimbra: Release 7.2.1_GA_2790.UBUNTU10_64 UBUNTU10_64 FOSS edition.
    ZeXtras: 1.8.3

  2. #2
    ZeXtras Community Manager ZeXtras Employee Cine's Avatar
    Join Date
    Apr 2011
    Posts
    2,356
    Hello Muzzol!

    I'm not familiar with this particular issue, but it has been reported to me a couple of times in the last weeks... By chance, did you recently update Zimbra? If so, to which version?

    Have a nice day,
    Cine
    the ZeXtras Team


    P.s.: I moved the thread to the Zimbra HowTo section, since this is not related with ZeXtras Suite...

  3. #3
    Senior Member
    Join Date
    Sep 2012
    Posts
    89
    Quote Originally Posted by Cine View Post
    Hello Muzzol!

    I'm not familiar with this particular issue, but it has been reported to me a couple of times in the last weeks... By chance, did you recently update Zimbra? If so, to which version?

    no, Zimbra wasn't updated at all, just the zextras components.

    can be related to some automated process from spamassassin?

    I'm really lost here.


    thanks for taking your time
    Zimbra: Release 7.2.1_GA_2790.UBUNTU10_64 UBUNTU10_64 FOSS edition.
    ZeXtras: 1.8.3

  4. #4
    ZeXtras Community Manager ZeXtras Employee Cine's Avatar
    Join Date
    Apr 2011
    Posts
    2,356
    Hello Muzzol!

    The first step to take in order to find the cause of the issue is to analyze the headers of the affected messages, as the "X-Spam-Status" header contains a detailed list of the spam ratings given by the antispam system to the message. I'm positive that checking the "X-Spam-Status" header of just 10-20 legitimate emails which have been tagged as spam you'll be able to find a pattern (feel free to send me as many samples of this header as you wish, I'll be glad to have a look).

    Sometimes a situation like this can be caused by the "X-Originating-From" header, which in case one or more sender/client IPs have been listed in RBLs can lead to massive spam marking, so check if this option is enabled and make sure that your IP address is not in any RBL (with a tool like this).

    Have a nice day,
    Cine
    the ZeXtras Team

  5. #5
    Senior Member
    Join Date
    Sep 2012
    Posts
    89
    Quote Originally Posted by Cine View Post
    Hello Muzzol!

    The first step to take in order to find the cause of the issue is to analyze the headers of the affected messages, as the "X-Spam-Status" header contains a detailed list of the spam ratings given by the antispam system to the message. I'm positive that checking the "X-Spam-Status" header of just 10-20 legitimate emails which have been tagged as spam you'll be able to find a pattern (feel free to send me as many samples of this header as you wish, I'll be glad to have a look).

    Sometimes a situation like this can be caused by the "X-Originating-From" header, which in case one or more sender/client IPs have been listed in RBLs can lead to massive spam marking, so check if this option is enabled and make sure that your IP address is not in any RBL (with a tool like this).

    Have a nice day,
    Cine
    the ZeXtras Team

    I've PM'd you with a message tagged on the subject.
    Zimbra: Release 7.2.1_GA_2790.UBUNTU10_64 UBUNTU10_64 FOSS edition.
    ZeXtras: 1.8.3

  6. #6
    ZeXtras Community Manager ZeXtras Employee Cine's Avatar
    Join Date
    Apr 2011
    Posts
    2,356
    Hello Muzzol!

    I've had a look at the message you sent me, and it's not marked as spam by Zimbra:

    Code:
    X-Spam-Flag: NO
    X-Spam-Score: 0.789
    X-Spam-Level: 
    X-Spam-Status: No, score=0.789 tagged_above=-10 required=6.6 tests=[BAYES_00=-1.9, DNS_FROM_AHBL_RHSBL=2.699, T_RP_MATCHES_RCVD=-0.01] autolearn=no
    The IP in the X-Originating-From header is indeed in a couple of RBLs, but that alone is not enough to raise the score over the 6.6 points required to be marked as spam.
    Is the user receiving this using a client such as Outlook or Thunderbird? In this case the culprit might be the anti-spam system of the client, so I'd suggest to have a look at that.

    For the records, you can disable the inclusion of the X-Originating-From header in the Zimbra Admin Console: "Configure" -> "Global Settings" -> "MTA" -> "Messages".

    Have a nice day,
    Cine
    the ZeXtras Team

  7. #7
    Senior Member
    Join Date
    Sep 2012
    Posts
    89
    thanks for the response.

    I don't think is related to anything on the spamassassin side because I even disabled antispam and antivirus services just for testing and subject is still tagged.

    I'll send you another PM
    Zimbra: Release 7.2.1_GA_2790.UBUNTU10_64 UBUNTU10_64 FOSS edition.
    ZeXtras: 1.8.3

  8. #8
    ZeXtras Community Manager ZeXtras Employee Cine's Avatar
    Join Date
    Apr 2011
    Posts
    2,356
    Hello Muzzol!

    I've seen the second message, and there are still some antispam and amavis-related headers, so I assume you are either running a multiserver infrastructure or have an antispam relay/appliance, but still nothing marking it as spam in Zimbra...

    There are many possible causes, depending on your environment, setup and clients, but in any case, this issue does not seem to be strictly related to Zimbra (and least of all to ZeXtras Suite), so It's a bit hard for me to further help on this.

    My top guess is still the client in use, if any, or the antivirus installed on the user's PC...

    Have a nice day,
    Cine
    the ZeXtras Team

  9. #9
    Senior Member Known ZeXtras Reseller
    Join Date
    Jul 2011
    Posts
    70
    The problem is:
    Code:
    DNS_FROM_AHBL_RHSBL=2.699
    See here: https://community.zimbra.com/collabo...1884/t/1137276

    It is not linked to ZeXtras in any way.
    Last edited by Klug; 01-27-2015 at 10:14 AM.

  10. #10
    Senior Member
    Join Date
    Sep 2012
    Posts
    89
    a quick follow up of this problem:

    isn't related to AHBL problem described by Klug.

    we found it was related to Amavis. even with spam/av services disabled mails don't go directly to postfix but get processed by Amavis (we just discovered this).

    so we don't know the exact problem that makes Amavis trigger Spam tagging, but we did a quick-and-dirty workaround and disabled in amavis.conf.in this variable:

    Code:
    sa_spam_subject_tag
    so instead of this: $sa_spam_subject_tag = '%%zimbraSpamSubjectTag%%';

    it goes like this: $sa_spam_subject_tag = '';



    I hope this can help someone in the future.
    Zimbra: Release 7.2.1_GA_2790.UBUNTU10_64 UBUNTU10_64 FOSS edition.
    ZeXtras: 1.8.3

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •