[Solved] Local emails are marked as Spam

@fquivera
Hi,

Sorry to hear about your trouble.

And Thanks 🙏 for sharing the header to make the diagnosis easy.

I noticed that the required score to mark an email as SPAM is set to 3.2, and your received emails' score is 4.176

X-Spam-Status: Yes, score=4.176 required=3.2 tests=[ALL_TRUSTED=-1,

Posted by: @fquivera

↑

Also, the higher value among all is RCVD_IN_PBL=3.558,though your server IP is clean but your X-Originating-IP: [181.208.25.231] is listed in https://check.spamhaus.org/listed/?searchterm=181.208.25.231

For your better understanding, what is RCVD_IN_PBL?

RCVD_IN_PBL: This stands for "Received in Policy Block List." SpamAssassin uses various public DNS-based blocklists to assess whether incoming emails are likely to be spam. The Policy Block List (PBL) is one such list maintained by the Spamhaus Project. The PBL includes IP addresses that are not meant to send mail directly to mail servers but are typically assigned to end-user devices (e.g., residential broadband IP addresses).

SpamAssassin checks the IP address of the server or the originating IP from which the email was sent against various blocklists. If the IP address is found in the Spamhaus PBL, the RCVD_IN_PBL rule is triggered.

Fix this, and I hope things will get back to normal again 😊

I hope it helps.

Regards,

Sharif

@sharif 

Hi, Thank you very much for your quick help, I solved it using the following command:

# Prevent Carbonio from sending X-Originating-IP header
zmprov mcf zimbraSmtpSendAddOriginatingIP FALSE;

# Get current value:
zmprov gcf zimbraSmtpSendAddOriginatingIP;

Thanks 

hello, @fquivera, @sharif 

I ran the command suggested by @fquivera, however the emails are still marked as spam. Is there any other solution

# Prevent Carbonio from sending X-Originating-IP header
zmprov mcf zimbraSmtpSendAddOriginatingIP FALSE;

# Get current value:
zmprov gcf zimbraSmtpSendAddOriginatingIP;

@usercarb001 

We need to check the email header to find the cause only then we could decide how to fix it.

regards.

Hi @sharif 

Return-Path: <user@mydomain.com>
Received: from mail.mydomain.com (LHLO
mail.mydomain.com) (...) by mail.mydomain.com
with LMTP; Mon, 17 Mar 2025 07:45:04 -0600 (GALT)
Received: from localhost (localhost [127.0.0.1])
by mail.mydomain.com (Postfix) with ESMTP id 1A2B64402D
for <user@mydomain.com>; Mon, 17 Mar 2025 07:45:04 -0600 (-06)
X-Spam-Flag: YES
X-Spam-Score: 5.202
X-Spam-Level: *****
X-Spam-Status: Yes, score=5.202 required=3.2 tests=[ALL_TRUSTED=-1,
DKIM_INVALID=0.1, DKIM_SIGNED=0.1, DMARC_FAIL_QUAR=6, HTML_MESSAGE=0.001,
URIBL_DBL_BLOCKED_OPENDNS=0.001] autolearn=no autolearn_force=no
Authentication-Results: mail.mydomain.com (amavis); dkim=neutral
reason="invalid (public key: not available)" header.d=mydomain.com
Received: from mail.mydomain.com ([127.0.0.1])
by localhost (mail.mydomain.com [127.0.0.1]) (amavis, port 10032)
with ESMTP id fuT9kKF9D1kf for <user@mydomain.com>;

Regards.

@usercarb001 

Hi,

Your email got flagged as spam mainly due to High Spam Score (5.202) – It went over the allowed limit (3.2), so it got marked as spam. To get pass the allowed score DMARC_FAIL_QUAR=6 contributed more than anything else. Fix the DNS records and emails should be delivered in the intended folder.

regards,

Hi  @sharif  

I have this problem when users try to log in - the location  and the ip is the same

misc - Access from IP *.*.*.* suspended, for repeated failed login.

Hi

To avoid classifying emails from the internal network as spam, I used the command:

zmprov ms `zmhostname` zimbraAmavisOriginatingBypassSA TRUE

Can this command "zmprov ms `zmhostname` zimbraAmavisOriginatingBypassSA TRUE" restore the system to the original configuration?

In the first place, this setting is off? or on?

Hi, 

When I try to send emails from Microsoft 365 I get this error:
connect to domain.mail.protection.outlook.com[52.101.41.28]:25: no route to host

I can receive but not send, no errors detected in carbonio logs.

@usercarb001 

Hi,

Check followings:

• check proxy log at /opt/zextras/log/nginx.log while sending email.
• Make sure your server can resolve recipient server MTA
• Make sure the recipient server MTA IP is reachable from your host.

  # ping domain.mail.protection.outlook.com
  #
  # ping IP_ADDRESS
  #
  # telnet domain.mail.protection.outlook.com 25

regards,

Hi  @sharif  

This is part of the log: 

server: mail.mydomain.com, request: "GET /zx/login/v3/config HTTP/2.0", upstream: "http://127.78.0.1:20008/zx/login/v3/config", host: "mail.mydomain.com", referrer: "https://mail.mydomain.com/carbonio/"
2025/04/03 08:38:16 [error] 415832#415832: *30305 recv() failed (104: Connection reset by peer) while reading response header from upstream, client: 192.168.5.2, server: mail.mydomain.com, request: "GET /zx/login/v3/account HTTP/2.0", upstream: "http://127.78.0.1:20008/zx/login/v3/account", host: "mail.mydomain.com", referrer: "https://mail.mydomain.com/carbonio/"
2025/04/03 08:38:16 [error] 415832#415832: *30305 recv() failed (104: Connection reset by peer) while reading response header from upstream, client: 192.168.5.2, server: mail.mydomain.com, request: "GET /services/catalog/services HTTP/2.0", upstream: "http://127.78.0.1:20012/services", host: "mail.mydomain.com", referrer: "https://mail.mydomain.com/carbonio/"
2025/04/03 08:38:18 [error] 415832#415832: *30305 open() "/opt/zextras/web/iris/carbonio-shell-ui/906299a0e33fede4f4498b0bbbeb8a9b5871e019/tinymce/skins/content/default/content.css" failed (2: No such file or directory), client: 192.168.5.2, server: mail.mydomain.com, request: "GET /static/iris/carbonio-shell-ui/906299a0e33fede4f4498b0bbbeb8a9b5871e019//tinymce/skins/content/default/content.css HTTP/2.0", host: "mail.mydomain.com", referrer: "https://mail.mydomain.com/carbonio/mails/folder/2"
2025/04/03 08:38:19 [info] 415832#415832: *30323 client closed connection while SSL handshaking, client: 127.0.0.1, server: 0.0.0.0:443
2025/04/03 08:38:23 [warn] 415832#415832: *30305 a client request body is buffered to a temporary file /opt/zextras/data/tmp/nginx/client/0000000179, client: 192.168.5.2, server: mail.mydomain.com, request: "POST /service/upload?fmt=extended,raw&lbfums HTTP/2.0", host: "mail.mydomain.com", referrer: "https://mail.mydomain.com/carbonio/mails/folder/2"
2025/04/03 08:38:24 [info] 415832#415832: *30330 client closed connection while SSL handshaking, client: 127.0.0.1, server: 0.0.0.0:443
2025/04/03 08:38:29 [info] 415832#415832: *30336 client closed connection while SSL handshaking, client: 127.0.0.1, server: 0.0.0.0:443