Please explain kam_dmarc_quarantine(1.5)

D

daolt

Member
Feb 8, 2020
18
2
8
47
Hi experts
I'm using zimbra 8.8.12 and proxmox 6.1-8, when i send email kam_dmarc_quarantine index always is 1.5. So email alway listed spam/junk mail. Please explain kam_dmarc_quarantine and how to fix it.

1588171488666.png

Thanks so much!
 
the rule is quite well describen in KAM.cf (see [0] or /usr/share/spamassassin-extra/KAM.cf on your installation):
Code: 
describe KAM_DMARC_QUARANTINE DKIM has Failed or SPF has failed on the message and the domain has a DMARC quarantine policy

* is this an internal e-mail you sent out through PMG?
* Do you have a configured DMARC policy for the domain the mail is coming from?

In any case the problem is that DKIM_INVALID is hitting - thus making the DMARC-policy fail.

how large is the mail where this fails? - make sure to configure the Spam Detector 'Max Spam Size' to a value which is large enough ( GUI->Configuration->Spam Detector -> Options)

I hope this helps!
 
  • Like
Reactions: daolt
Stoiko Ivanov said:
the rule is quite well describen in KAM.cf (see [0] or /usr/share/spamassassin-extra/KAM.cf on your installation):
Code: 
describe KAM_DMARC_QUARANTINE DKIM has Failed or SPF has failed on the message and the domain has a DMARC quarantine policy

* is this an internal e-mail you sent out through PMG?
* Do you have a configured DMARC policy for the domain the mail is coming from?

In any case the problem is that DKIM_INVALID is hitting - thus making the DMARC-policy fail.

how large is the mail where this fails? - make sure to configure the Spam Detector 'Max Spam Size' to a value which is large enough ( GUI->Configuration->Spam Detector -> Options)

I hope this helps!
Click to expand...

Hi Stoiko Ivanov
Thanks form replying
is this an internal e-mail you sent out through PMG? -> Yes, I config to send out through PMG
Do you have a configured DMARC policy for the domain the mail is coming from? -> Yes I do
On zimbra serrver I was remove DKIM, i do not use dkim on zimbra and dns dkim record
how large is the mail where this fails? -> Very small size
what must i do to fix it?
Best regards,
 
this explains the problem - you have a DMARC policy set, but when the mails arrive at PMG they violate it (because they are not yet DKIM signed):
* either sign them on the zimbra
* or just lower the score of the rule KAM_DMARC_QUARANTINE to 0 in the GUI (see 4.6.3 at https://pmg.proxmox.com/pmg-docs/pmg-admin-guide.html#pmgconfig_spamdetector)
* or configure your internal DNS to not answer with the public DMARC policy for your domain
 
  • Like
Reactions: daolt
Stoiko Ivanov said:
this explains the problem - you have a DMARC policy set, but when the mails arrive at PMG they violate it (because they are not yet DKIM signed):
* either sign them on the zimbra
* or just lower the score of the rule KAM_DMARC_QUARANTINE to 0 in the GUI (see 4.6.3 at https://pmg.proxmox.com/pmg-docs/pmg-admin-guide.html#pmgconfig_spamdetector)
* or configure your internal DNS to not answer with the public DMARC policy for your domain
Click to expand...

Stoiko Ivanov
Thank you for replying
You mean set Hueristic Score = 0

1588758717807.png

I have just adjusted Score but It still does not work

1588759004733.png
 
no - it's configured in the tab 'Custom Scores' - check the reference documentation I posted (point 4.6.3)
 
  • Like
Reactions: daolt
Hi Stoiko Ivanov
I monitor on server mail to see that the email out of RCVD_IN_SORBS_WEB is very high, but there are other emails with low or no RCVD_IN_SORBS_WEB? What's happened with my server?
 
just google for the rule:
Code: 
describe RCVD_IN_SORBS_WEB      SORBS: sender is an abusable web server

- then check the IP listed in the headers as sender - and see if it's listed in sorbs (e.g. at http://www.anti-abuse.org/multi-rbl-check/)

then see whether this is an actual problem on the server
 
  • Like
Reactions: daolt
Stoiko Ivanov said:
just google for the rule:
Code: 
describe RCVD_IN_SORBS_WEB      SORBS: sender is an abusable web server

- then check the IP listed in the headers as sender - and see if it's listed in sorbs (e.g. at http://www.anti-abuse.org/multi-rbl-check/)

then see whether this is an actual problem on the server
Click to expand...

Stoiko Ivanov

Thank you for responding
Before posting, I also checked the IP address on https://mxtoolbox.com/blacklists.aspx, resulting in the IP not being blacklisted. I have also checked the ip address on http://www.anti-abuse.org and the ip address is not blacklisted either.
 
daolt said:
Before posting, I also checked the IP address
Click to expand...
which ip address?

if PMG has a hit with RCVD_IN_SORBS_WEB that means that the server that sent the e-mail to PMG is listed
 
  • Like
Reactions: daolt
I think 103.88.112.58 is the IP of your PMG?

but the problematic IP, which triggers the hit on RCVD_IN_SORBS_WEB is the ip that sends _to_ your PMG

-> check the logs - /var/log/mail.log
 
  • Like
Reactions: daolt
as said - it is the server which sends to PMG that is blacklisted
 
  • Like
Reactions: daolt
not 103.88.112.58 (your PMG), but the other ip that sends to your pmg / 103.88.1112.58
 
  • Like
Reactions: daolt
That seems odd - then check the headers of a mail where this hit occured and the mail.log of your PMG (the rule hit should show you which mails are affected) - maybe the IP was blacklisted but got removed from the blacklist
 
  • Like
Reactions: daolt
Stoiko Ivanov said:
That seems odd - then check the headers of a mail where this hit occured and the mail.log of your PMG (the rule hit should show you which mails are affected) - maybe the IP was blacklisted but got removed from the blacklist
Click to expand...

Stoiko Ivanov

The strange thing is that there are some emails sent out not to be blacklisted, while there are some emails that get blacklisted?
 
You must log in or register to reply here.
Top Bottom