Please explain kam_dmarc_quarantine(1.5)

[Stoiko Ivanov]

The strange thing is that there are some emails sent out not to be blacklisted, while there are some emails that get blacklisted?

do the mails come from the same IP address? - you need to read and understand the logs

 

[daolt]

do the mails come from the same IP address? - you need to read and understand the logs

Stoiko Ivanov
As I discussed above, I am having trouble sending out emails, not incoming emails. There are emails sent out to the blacklist, some emails are not

 

[DerDanilo]

this explains the problem - you have a DMARC policy set, but when the mails arrive at PMG they violate it (because they are not yet DKIM signed):
* either sign them on the zimbra
* or just lower the score of the rule KAM_DMARC_QUARANTINE to 0 in the GUI (see 4.6.3 at https://pmg.proxmox.com/pmg-docs/pmg-admin-guide.html#pmgconfig_spamdetector)
* or configure your internal DNS to not answer with the public DMARC policy for your domain

@Stoiko Ivanov

- why would one sign domains in mail systems that are supposed to send mails through the PMGs who then sign mails with DKIM themself. Having PMGs doing DKIM signing removes the need to sign on mail systems before.
- Problem with lowering the score is that it disables the DMARC filter rule(s) for incoming and outgoing mails. Right?
- Setting up DNS overrides for hundred or thousand domains isn't something that makes sense because every domain then needs two sets of DNS configuration.

So outgoing spam filtering doesn't really work. What might work is allowing to configure custom scores for incoming and outgoing mails. Which on the other hand might require another spamd (any service required to allow that) to handle in and outgoing mails differently.

What do you think about that?
Disabling filters completely is not really something we want to do, do we?