1

Mail Server: Zimbra 6.0.9 Spam-Firewall: Barracuda Spam Firewall 300 (Firmware v6.1.5.006)

All spam firewalls only work so well, and unfortunately some spam will come through. Incoming spam will often attempt to send messages to invalid addresses on a valid domain. Zimbra reacts by trying to send a Non Delivery Report to the malicious sender (who spoofs an invalid address/domain). Barracuda cannot establish a connection with this spoofed address, and leaves the NDR in the Outbound-Queue in a deferred state.

These failed NDRs are simple to delete from the Outbound-Queue, but can pile up if unattended, on occasion over the limit (100) which email alerts are sent. Can Barracuda automatically delete these messages more quickly than the default 48 hour purge period? It would be helpful if there is a way to do this without disabling NDRs, instead to delete them if they appear to be non-deliverable.

Spam should obviously be mitigated as much as possible to prevent this scenario. But as mentioned, some spam will (and does) always come through.

2 Answers 2

1
+50

You can try to reject emails to invalid recipients at the spam firewall level or at mta.

Barracuda spam firewall offeres Recipient Verification using different methods (LDAP Lookup, Explicit Users lists to Accept For).

And also: What methods of recipient verification are available on my Barracuda Spam Firewall? How do they work?

When recipient verification is configured, the Barracuda Spam Firewall will reject email addressed to users that do not exist at the addressed domain. This is an SMTP-level block that occurs before other, more resource-intensive defense layers that will increase both the effectiveness and efficiency of the Barracuda Spam Firewall, when enabled.

You may configure three different types of recipient verification on the Barracuda Spam Firewall:

  1. SMTP Verification
  2. LDAP/Active Directory Verification (models 300 and above)
  3. The Valid Recipients List (firmware versions 3.5.11 and above)

Zimbra also offers similar capability (which is based on postfix).

Details instructions here: Discarding Emails Sent to Invalid Addresses


As for changing the default value of 48 hours, in advanced configuration, there supposed to be a hidden expert variables tab which may allow you to set some special values. You may try to adjust it there. But be careful and better consult the technical support before changing anything.

Here is how to access the hidden tab: http://www.booches.nl/2009/05/secret-barracuda-spam-firewall-options/

  1. Open the Advanced tab.
  2. Add &expert=1 at the end of the url after the Advanced page is fully loaded and then press enter.
2
  • Missed the mark on the NDRs, since they're sent from Zimbra, but the tab revealed by &expert=1 has the 48 hour setting under Outbound Queue Max Message Lifetime (hours):. This answers the sub question asked originally, of how to change the queue deletion time.
    – root
    Feb 24, 2016 at 19:02
  • @root, yes missed that, but have updated my answer, have a look.
    – Diamond
    Feb 25, 2016 at 15:15
2

Rather than trying to clear the barracuda's queue, it would be better to have the barracuda not accept these messages in the first place.

Domains
Domain Manager
Manager Domain (of zimbra domain)
Users
LDAP Configuration
Exchange Accelerator/LDAP Verification: Yes
LDAP Server: <zmlocalconfig ldap_host>
LDAP Port: <zmlocalconfig ldap_port>
SSL/TLS Mode: StartTLS
LDAP Server Type: OpenLDAP
Bind DN (Username): uid=zmpostfix,cn=appaccts,cn=zimbra
Bind Password: <zmlocalconfig -s ldap_postfix_password>
Show Advanced Settings
LDAP Search Base: dc=example,dc=com
Blank LDAP Search Base: No
LDAP Filter: (mail=${recipient_email})

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .