Spam tag added

[muzzol]

Hi,

I know probably this isn't zextras related but it started right after a zextras update and I need to cross it out to be sure.

Several mails are being tagged with "Spam" string in subject. Is not consistent (at least I didn't find any correlation) and tagged messages DON'T go to user's spam folder. They just get this additional string at the begining of subject.

I've checked amavis without any luck.

Any hints?

[Cine]

Hello Muzzol!

I'm not familiar with this particular issue, but it has been reported to me a couple of times in the last weeks... By chance, did you recently update Zimbra? If so, to which version?

Have a nice day,
Cine
the ZeXtras Team


P.s.: I moved the thread to the Zimbra HowTo section, since this is not related with ZeXtras Suite...

[muzzol]

Hello Muzzol!

I'm not familiar with this particular issue, but it has been reported to me a couple of times in the last weeks... By chance, did you recently update Zimbra? If so, to which version?

no, Zimbra wasn't updated at all, just the zextras components.

can be related to some automated process from spamassassin?

I'm really lost here.


thanks for taking your time

[Cine]

Hello Muzzol!

The first step to take in order to find the cause of the issue is to analyze the headers of the affected messages, as the "X-Spam-Status" header contains a detailed list of the spam ratings given by the antispam system to the message. I'm positive that checking the "X-Spam-Status" header of just 10-20 legitimate emails which have been tagged as spam you'll be able to find a pattern (feel free to send me as many samples of this header as you wish, I'll be glad to have a look).

Sometimes a situation like this can be caused by the "X-Originating-From" header, which in case one or more sender/client IPs have been listed in RBLs can lead to massive spam marking, so check if this option is enabled and make sure that your IP address is not in any RBL (with a tool like this).

Have a nice day,
Cine
the ZeXtras Team

[muzzol]

Hello Muzzol!

The first step to take in order to find the cause of the issue is to analyze the headers of the affected messages, as the "X-Spam-Status" header contains a detailed list of the spam ratings given by the antispam system to the message. I'm positive that checking the "X-Spam-Status" header of just 10-20 legitimate emails which have been tagged as spam you'll be able to find a pattern (feel free to send me as many samples of this header as you wish, I'll be glad to have a look).

Sometimes a situation like this can be caused by the "X-Originating-From" header, which in case one or more sender/client IPs have been listed in RBLs can lead to massive spam marking, so check if this option is enabled and make sure that your IP address is not in any RBL (with a tool like this).

Have a nice day,
Cine
the ZeXtras Team

I've PM'd you with a message tagged on the subject.

[Cine]

Hello Muzzol!

I've had a look at the message you sent me, and it's not marked as spam by Zimbra:

X-Spam-Flag: NO
X-Spam-Score: 0.789
X-Spam-Level: 
X-Spam-Status: No, score=0.789 tagged_above=-10 required=6.6 tests=[BAYES_00=-1.9, DNS_FROM_AHBL_RHSBL=2.699, T_RP_MATCHES_RCVD=-0.01] autolearn=no

The IP in the X-Originating-From header is indeed in a couple of RBLs, but that alone is not enough to raise the score over the 6.6 points required to be marked as spam.
Is the user receiving this using a client such as Outlook or Thunderbird? In this case the culprit might be the anti-spam system of the client, so I'd suggest to have a look at that.

For the records, you can disable the inclusion of the X-Originating-From header in the Zimbra Admin Console: "Configure" -> "Global Settings" -> "MTA" -> "Messages".

Have a nice day,
Cine
the ZeXtras Team

[muzzol]

thanks for the response.

I don't think is related to anything on the spamassassin side because I even disabled antispam and antivirus services just for testing and subject is still tagged.

I'll send you another PM

[Cine]

Hello Muzzol!

I've seen the second message, and there are still some antispam and amavis-related headers, so I assume you are either running a multiserver infrastructure or have an antispam relay/appliance, but still nothing marking it as spam in Zimbra...

There are many possible causes, depending on your environment, setup and clients, but in any case, this issue does not seem to be strictly related to Zimbra (and least of all to ZeXtras Suite), so It's a bit hard for me to further help on this.

My top guess is still the client in use, if any, or the antivirus installed on the user's PC...

Have a nice day,
Cine
the ZeXtras Team

[Klug]

The problem is:

DNS_FROM_AHBL_RHSBL=2.699

See here: https://community.zimbra.com/collabo...1884/t/1137276

It is not linked to ZeXtras in any way.

[muzzol]

a quick follow up of this problem:

isn't related to AHBL problem described by Klug.

we found it was related to Amavis. even with spam/av services disabled mails don't go directly to postfix but get processed by Amavis (we just discovered this).

so we don't know the exact problem that makes Amavis trigger Spam tagging, but we did a quick-and-dirty workaround and disabled in amavis.conf.in this variable:

sa_spam_subject_tag

so instead of this: $sa_spam_subject_tag = '%%zimbraSpamSubjectTag%%';

it goes like this: $sa_spam_subject_tag = '';



I hope this can help someone in the future.