zimbra custom spamassassin rules

How to prevent spam on zimbra. To use zimbra spamassassin filter. To backlist and whitelist all email from address or domain. To spam-check mail incoming email to system your email or To spam-check internal mail. To use zimbra 8.6 and later, The commands as below running on zimbra MTA. 
Links to below you maybe likes:

• zimbra custom spamassassin rules
• How to create auto Bcc for Recipient mails for Zimbra 8.6
• How to add spam filters on zimbra 8.6
• How to create auto Bcc for sender mails for Zimbra 8.6
• list accounts that has not logged in for the last x days in zimbra
  

zimbra custom spamassassin rules

Enabling SpamAssassin rule updates

su - zimbra
zmlocalconfig -e antispam_enable_rule_updates=true
zmlocalconfig -e antispam_enable_restarts=true
zmlocalconfig -e antispam_enable_rule_compilation=true
zmamavisdctl restart
zmmtactl restart

To check and configure zimbra Spam Subject Tag, zimbra Spam Tag Percent, zimbra Spam Kill Percent attribute.

zmprov gcf zimbraSpamSubjectTag
zmprov gcf zimbraSpamTagPercent
zmprov gcf zimbraSpamKillPercent

zmprov mcf zimbraSpamSubjectTag ***SPAM***
zmprov mcf zimbraSpamKillPercent 50
zmprov mcf zimbraSpamTagPercent 25

To configure spamassassin rule
To spamassassin rule on base subject filter "OH_YEAH"

vim /opt/zimbra/data/spamassassin/localrules/huupv.cf

The content for spamassassin rule as below

header HUUPV_SPAM Subject =~ /OH_YEAH/i
describe HUUPV_SPAM Subject contains OH_YEAH it is spam
score HUUPV_SPAM 40.0

How to check spam-check internal mail
To backup amavisd.conf.in file before it's changed

cp /opt/zimbra/conf/amavisd.conf.in /opt/zimbra/conf/amavisd.conf.in.bk

To edit amavisd.conf.in file

vim /opt/zimbra/conf/amavisd.conf.in

The content as below

$policy_bank{'ORIGINATING'} = {  # mail supposedly originating from our users
  originating => 1,  # declare that mail was submitted by our smtp client
  allow_disclaimers => %%binary VAR:zimbraDomainMandatoryMailSignatureEnabled%%,  # enables disclaimer insertion if available
  # notify administrator of locally originating malware
  virus_admin_maps => ['@@av_notify_user@@'],
  spam_admin_maps  => ['@@av_notify_user@@'],
  warnbadhsender   => 0,
  bypass_spam_checks_maps   => [0], # don't spam-check internal mail
  # forward to a smtpd service providing DKIM signing service
%%uncomment SERVICE:opendkim%%  forward_method => 'smtp:[%%zimbraLocalBindAddress%%]:10030',
  # force MTA conversion to 7-bit (e.g. before DKIM signing)
  smtpd_discard_ehlo_keywords => ['8BITMIME'],
  bypass_banned_checks_maps => [0],  # allow sending any file names and types
  terminate_dsn_on_notify_success => 0,  # don't remove NOTIFY=SUCCESS option
};

You changed bypass_spam_checks_maps   => [0] to spam-check internal mail.

For example, To prevent spam with url contains http or https in body

body    HUU_RULE    m{http(s)?://(?:[a-z]+[0-9]+\.)*}
describe    HUU_RULE    http and https contains as spam
score       HUU_RULE    40

Conclusion

Thought the article, to help you enable and configure "zimbra custom spamassassin rule".