<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">DMARC and BAYES blocked that email.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">It would be interesting to get/see the details of the “DMARC_” rules on the Zimbra server. Zimbra must have added DMARC support to Spamassassin. I wonder if they used opendmarc with custom SA rules to read the opendmarc headers.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Same for LOCAL_MAILSCANNER_SPAM. I would like to see that rule. In a Zimbra environment, you may want to use MailScanner to score only and not block to utilize the built-in Zimbra spam/ham handling.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:12.0pt;color:black">From: </span></b><span style="font-size:12.0pt;color:black">MailScanner <mailscanner-bounces+djones=ena.com@lists.mailscanner.info> on behalf of Thomas Stephen Lee <lee.iitb@gmail.com><br>
<b>Reply-To: </b>MailScanner Discussion <mailscanner@lists.mailscanner.info><br>
<b>Date: </b>Saturday, November 2, 2019 at 4:12 AM<br>
<b>To: </b>MailScanner Discussion <mailscanner@lists.mailscanner.info><br>
<b>Subject: </b>Re: MailScanner and Zimbra<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<div>
<div>
<p class="MsoNormal"><span style="font-family:"Courier New"">Hi All,<br>
<br>
Thank you very much for all the suggestions.<br>
We will try out one by one.<br>
<br>
Given below is a partial output of a message Zimbra caught as spam.<br>
<br>
<br>
*----------------------------------------------------------------------------*<br>
<br>
Content analysis details: (16.2 points, 5.0 required)<br>
<br>
pts rule name description<br>
---- ---------------------- --------------------------------------------------<br>
-1.0 ALL_TRUSTED Passed through trusted hosts only via SMTP<br>
3.5 BAYES_99 BODY: Bayes spam probability is 99 to 100%<br>
[score: 1.0000]<br>
0.2 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%<br>
[score: 1.0000]<br>
1.0 HK_RANDOM_REPLYTO Reply-To username looks random<br>
4.1 LOCAL_MAILSCANNER_SPAM MailScanner marked SPAM<br>
1.0 HK_RANDOM_FROM From username looks random<br>
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider<br>
(hulsingcrm6[at]<a href="http://aliyun.com">aliyun.com</a>)<br>
0.2 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail<br>
domains are different<br>
0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record<br>
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit<br>
(hulsingcrm6[at]<a href="http://aliyun.com">aliyun.com</a>)<br>
0.0 HTML_MESSAGE BODY: HTML included in message<br>
0.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts<br>
6.0 DMARC_FAIL_QUAR DMARC validation failed and policy is quarantine<br>
0.0 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and EnvelopeFrom<br>
freemail headers are different<br>
0.8 RDNS_NONE Delivered to internal network by a host with no rDNS<br>
<br>
*----------------------------------------------------------------------------*<br>
<br>
<br>
thanks<br>
<br>
---<br>
Thomas Stephen Lee<o:p></o:p></span></p>
</div>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Fri, Nov 1, 2019 at 10:47 PM Mark Sapiro <<a href="mailto:mark@msapiro.net">mark@msapiro.net</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<p class="MsoNormal" style="margin-bottom:12.0pt">On 11/1/19 6:05 AM, Shawn Iverson via MailScanner wrote:<br>
> +1<br>
> <br>
> We need to put this on the MailScanner website as "Things you can do to<br>
> enhance your MailScanner" :)<br>
<br>
+1<br>
<br>
The old web site used to have some tips. See<br>
<<a href="https://web.archive.org/web/20150315051129/http:/mailscanner.info/gettingthebest.html" target="_blank">https://web.archive.org/web/20150315051129/http://mailscanner.info/gettingthebest.html</a>>.<br>
Some of this is out of date, but we should have similar info on the<br>
current web site.<br>
<br>
<br>
-- <br>
Mark Sapiro <<a href="mailto:mark@msapiro.net" target="_blank">mark@msapiro.net</a>> The highway is for gamblers,<br>
San Francisco Bay Area, California better use your sense - B. Dylan<br>
<br>
<br>
-- <br>
MailScanner mailing list<br>
<a href="mailto:mailscanner@lists.mailscanner.info" target="_blank">mailscanner@lists.mailscanner.info</a><br>
<a href="http://lists.mailscanner.info/mailman/listinfo/mailscanner" target="_blank">http://lists.mailscanner.info/mailman/listinfo/mailscanner</a><o:p></o:p></p>
</blockquote>
</div>
</div>
</body>
</html>