Re: External AS/AV Integration

[Rich Graves <rgraves@carleton.edu>]

> 1) I tried having the IronPort add a "X-Spam-Flag: YES" flag, 
> but as I suspected amavisd just replaces the value

That approach will work if you use a header that doesn't start with X-Spam. You can leave SA enabled, but with all the memory/CPU-intensive checks bypassed.

Add an /opt/zimbra/conf/spamassassin/local-ironport.cf containing

ifplugin Mail::SpamAssassin::Plugin::Shortcircuit

header IRONPORT_HAM /^X-Ironport-Spam-Flag: NO/
priority IRONPORT_HAM -1000
shortcircuit IRONPORT_HAM ham
score IRONPORT_HAM -10

header IRONPORT_SPAM /^X-Ironport-Spam-Flag: YES/
priority IRONPORT_SPAM -1000
shortcircuit IRONPORT_SPAM spam
score IRONPORT_SPAM 10

endif

> 2) I initially considered just changing zimbraSpamIsNotSpamAccount
> & zimbraSpamIsSpamAccount values to match them, but now I'm wondering
> if just adding a forward rule to the system ham/spam accounts wouldn't
> be better since I can keep a local copy as a reference.

If you have the time, it can be useful to see who is using the "Junk" button as a "Trash" button; who decided to create Thunderbird filter rules moving all mailing lists to Junk; who should get a form letter about opting out of Facebook notifications; etc.
-- 
Rich Graves http://claimid.com/rcgraves
Carleton.edu Sr UNIX and Security Admin
CMC135: 507-222-7079 Cell: 952-292-6529