<div dir="ltr"><div>Following...</div><div><br></div><div>Would love to see those rules as well. I like that Zimbra has a MailScanner rule!<br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Sat, Nov 2, 2019 at 1:25 PM David Jones via MailScanner <<a href="mailto:mailscanner@lists.mailscanner.info">mailscanner@lists.mailscanner.info</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div lang="EN-US">
<div class="gmail-m_-9211402537398643658WordSection1">
<p class="MsoNormal">DMARC and BAYES blocked that email.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">It would be interesting to get/see the details of the “DMARC_” rules on the Zimbra server. Zimbra must have added DMARC support to Spamassassin. I wonder if they used opendmarc with custom SA rules to read the opendmarc headers.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Same for LOCAL_MAILSCANNER_SPAM. I would like to see that rule. In a Zimbra environment, you may want to use MailScanner to score only and not block to utilize the built-in Zimbra spam/ham handling.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<div style="border-color:rgb(181,196,223) currentcolor currentcolor;border-style:solid none none;border-width:1pt medium medium;padding:3pt 0in 0in">
<p class="MsoNormal"><b><span style="font-size:12pt;color:black">From: </span></b><span style="font-size:12pt;color:black">MailScanner <mailscanner-bounces+djones=<a href="mailto:ena.com@lists.mailscanner.info" target="_blank">ena.com@lists.mailscanner.info</a>> on behalf of Thomas Stephen Lee <<a href="mailto:lee.iitb@gmail.com" target="_blank">lee.iitb@gmail.com</a>><br>
<b>Reply-To: </b>MailScanner Discussion <<a href="mailto:mailscanner@lists.mailscanner.info" target="_blank">mailscanner@lists.mailscanner.info</a>><br>
<b>Date: </b>Saturday, November 2, 2019 at 4:12 AM<br>
<b>To: </b>MailScanner Discussion <<a href="mailto:mailscanner@lists.mailscanner.info" target="_blank">mailscanner@lists.mailscanner.info</a>><br>
<b>Subject: </b>Re: MailScanner and Zimbra<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<div>
<div>
<p class="MsoNormal"><span style="font-family:"Courier New"">Hi All,<br>
<br>
Thank you very much for all the suggestions.<br>
We will try out one by one.<br>
<br>
Given below is a partial output of a message Zimbra caught as spam.<br>
<br>
<br>
*----------------------------------------------------------------------------*<br>
<br>
Content analysis details: (16.2 points, 5.0 required)<br>
<br>
pts rule name description<br>
---- ---------------------- --------------------------------------------------<br>
-1.0 ALL_TRUSTED Passed through trusted hosts only via SMTP<br>
3.5 BAYES_99 BODY: Bayes spam probability is 99 to 100%<br>
[score: 1.0000]<br>
0.2 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%<br>
[score: 1.0000]<br>
1.0 HK_RANDOM_REPLYTO Reply-To username looks random<br>
4.1 LOCAL_MAILSCANNER_SPAM MailScanner marked SPAM<br>
1.0 HK_RANDOM_FROM From username looks random<br>
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider<br>
(hulsingcrm6[at]<a href="http://aliyun.com" target="_blank">aliyun.com</a>)<br>
0.2 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail<br>
domains are different<br>
0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record<br>
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit<br>
(hulsingcrm6[at]<a href="http://aliyun.com" target="_blank">aliyun.com</a>)<br>
0.0 HTML_MESSAGE BODY: HTML included in message<br>
0.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts<br>
6.0 DMARC_FAIL_QUAR DMARC validation failed and policy is quarantine<br>
0.0 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and EnvelopeFrom<br>
freemail headers are different<br>
0.8 RDNS_NONE Delivered to internal network by a host with no rDNS<br>
<br>
*----------------------------------------------------------------------------*<br>
<br>
<br>
thanks<br>
<br>
---<br>
Thomas Stephen Lee<u></u><u></u></span></p>
</div>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<p class="MsoNormal">On Fri, Nov 1, 2019 at 10:47 PM Mark Sapiro <<a href="mailto:mark@msapiro.net" target="_blank">mark@msapiro.net</a>> wrote:<u></u><u></u></p>
</div>
<blockquote style="border-color:currentcolor currentcolor currentcolor rgb(204,204,204);border-style:none none none solid;border-width:medium medium medium 1pt;padding:0in 0in 0in 6pt;margin-left:4.8pt;margin-right:0in">
<p class="MsoNormal" style="margin-bottom:12pt">On 11/1/19 6:05 AM, Shawn Iverson via MailScanner wrote:<br>
> +1<br>
> <br>
> We need to put this on the MailScanner website as "Things you can do to<br>
> enhance your MailScanner" :)<br>
<br>
+1<br>
<br>
The old web site used to have some tips. See<br>
<<a href="https://web.archive.org/web/20150315051129/http:/mailscanner.info/gettingthebest.html" target="_blank">https://web.archive.org/web/20150315051129/http://mailscanner.info/gettingthebest.html</a>>.<br>
Some of this is out of date, but we should have similar info on the<br>
current web site.<br>
<br>
<br>
-- <br>
Mark Sapiro <<a href="mailto:mark@msapiro.net" target="_blank">mark@msapiro.net</a>> The highway is for gamblers,<br>
San Francisco Bay Area, California better use your sense - B. Dylan<br>
<br>
<br>
-- <br>
MailScanner mailing list<br>
<a href="mailto:mailscanner@lists.mailscanner.info" target="_blank">mailscanner@lists.mailscanner.info</a><br>
<a href="http://lists.mailscanner.info/mailman/listinfo/mailscanner" target="_blank">http://lists.mailscanner.info/mailman/listinfo/mailscanner</a><u></u><u></u></p>
</blockquote>
</div>
</div>
</div>
<br>
<br>
-- <br>
MailScanner mailing list<br>
<a href="mailto:mailscanner@lists.mailscanner.info" target="_blank">mailscanner@lists.mailscanner.info</a><br>
<a href="http://lists.mailscanner.info/mailman/listinfo/mailscanner" rel="noreferrer" target="_blank">http://lists.mailscanner.info/mailman/listinfo/mailscanner</a><br>
<br>
</blockquote></div><br clear="all"><br>-- <br><div dir="ltr" class="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div dir="ltr"><div dir="ltr">Shawn Iverson, CETL<div></div><div>Rush County Schools</div><div></div><div><a href="mailto:iversons@rushville.k12.in.us" target="_blank">iversons@rushville.k12.in.us</a></div><div><br></div><div><img src="https://docs.google.com/uc?export=download&id=0Bw5iD0ToYvs_Zkh4eEs3R01yWXc&revid=0Bw5iD0ToYvs_QWpBK2Y2ajJtYjhOMDRFekZwK2xOamk5Q3Y0PQ" width="89" height="96"><img src="https://docs.google.com/uc?export=download&id=1aBrlQou4gjB04FY-twHN_0Dn3GHVNxqa&revid=0Bw5iD0ToYvs_RnQ0eDhHcm95WHBFdkNRbXhQRXpoYkR6SEEwPQ" style="font-size: 12.8px;"><img src="https://www.doe.in.gov/sites/default/files/cybersecurity/cybersecurity.png" alt="Cybersecurity" width="96" height="96"></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div>