Zimbra Mail Flow

Guide for configuring and troubleshooting mail flow in Zimbra, including Postfix integration, content filtering, and queue management.

Architecture Overview

Zimbra uses Postfix as its MTA (Mail Transfer Agent):

Internet → Proxy (nginx) → Postfix → Content Filter → Postfix → Mailbox
                              ↓
                          amavisd-new
                              ↓
                        SpamAssassin/ClamAV

Components

• Postfix - SMTP server for sending and receiving mail
• amavisd-new - Content filter interface
• SpamAssassin - Spam detection
• ClamAV - Antivirus scanning
• policyd - Policy daemon for rate limiting

Postfix Configuration

Key Configuration Files

View/Modify Settings

# View current setting
postconf content_filter

# View all settings
postconf -n

# Modify setting (as zimbra user)
zmprov ms $(hostname) zimbraMtaContentFilter "smtp-amavis:[127.0.0.1]:10024"

# Direct postconf (may be overwritten by Zimbra)
postconf -e "content_filter = smtp-amavis:[127.0.0.1]:10024"

# Reload after changes
postfix reload

Common Settings via zmprov

# Content filter
zmprov ms mail.domain.com zimbraMtaContentFilter "smtp-amavis:[127.0.0.1]:10024"

# Relay host
zmprov ms mail.domain.com zimbraMtaRelayHost "smtp.relay.com:25"

# Message size limit (bytes)
zmprov ms mail.domain.com zimbraMtaMaxMessageSize 52428800

# SMTP authentication
zmprov ms mail.domain.com zimbraMtaSaslAuthEnable TRUE

Content Filtering

Default Flow

1. Mail arrives on port 25
2. Postfix sends to amavisd on port 10024
3. amavisd processes (spam/virus check)
4. Clean mail returns to Postfix on port 10025
5. Postfix delivers to mailbox

Custom Content Filter

To add a custom content filter (e.g., policy server):

# Check port availability FIRST
netstat -tlnp | grep 2525

# Add service to master.cf
postconf -Me "policy-filter/unix = policy-filter unix - n n - 10 smtp -o smtp_send_xforward_command=yes"

# Set content filter
zmprov ms $(hostname) zimbraMtaContentFilter "smtp:[127.0.0.1]:2525"

# Reload MTA
zmcontrol restart mta

Bypass Content Filter

For specific senders/recipients:

# Create transport map
echo "[email protected] :" >> /opt/zimbra/conf/transport

# Rebuild and reload
postmap /opt/zimbra/conf/transport
postfix reload

Queue Management

View Queue

# Queue summary
mailq

# Detailed queue listing
postqueue -p

# Count messages
mailq | tail -n 1

Manage Queue

# Flush queue (attempt redelivery)
postqueue -f

# Delete specific message
postsuper -d <queue-id>

# Delete all queued messages
postsuper -d ALL

# Hold message
postsuper -h <queue-id>

# Release held message
postsuper -H <queue-id>

# Requeue message
postsuper -r <queue-id>

View Message Content

# Find message in queue
find /opt/zimbra/data/postfix/spool -name "<queue-id>"

# View message headers
postcat -q <queue-id> | head -50

# View full message
postcat -q <queue-id>

Troubleshooting

Check MTA Status

# Service status
zmmtactl status

# Postfix status
postfix status

# Check listening ports
netstat -tlnp | grep -E "(25|465|587|10024|10025)"

Log Analysis

# Main mail log
tail -f /var/log/zimbra.log

# Postfix log
tail -f /opt/zimbra/log/zimbra.log | grep postfix

# Track message by ID
grep <message-id> /var/log/zimbra.log

Common Issues

Mail Stuck in Queue

# Check queue reason
postqueue -p | grep -A 2 <queue-id>

# Check DNS
host -t mx recipient-domain.com

# Check relay connectivity
telnet relay.host.com 25

Content Filter Not Working

# Verify amavisd running
zmamavisdctl status

# Check content_filter setting
postconf content_filter

# Verify ports
netstat -tlnp | grep 10024
netstat -tlnp | grep 10025

SMTP Authentication Failing

# Check SASL config
postconf smtpd_sasl_auth_enable

# Test auth
openssl s_client -connect mail.domain.com:465 -quiet
AUTH LOGIN

Relay Configuration

Outbound Relay

# Set relay host
zmprov ms $(hostname) zimbraMtaRelayHost "smtp.relay.com:25"

# With authentication
zmprov ms $(hostname) zimbraMtaRelayHost "[smtp.relay.com]:587"
zmprov ms $(hostname) zimbraMtaSaslAuthEnable TRUE

# Configure credentials in sasl_passwd
echo "[smtp.relay.com]:587 username:password" >> /opt/zimbra/conf/sasl_passwd
postmap /opt/zimbra/conf/sasl_passwd

Inbound Relay (Accept from specific hosts)

# Add to mynetworks
zmprov ms $(hostname) +zimbraMtaMyNetworks "192.168.1.0/24"

# Reload
postfix reload

Rate Limiting

Using cbpolicyd

# Check status
zmcbpolicydctl status

# View policies
sqlite3 /opt/zimbra/data/cbpolicyd/db/cbpolicyd.sqlitedb \
  "SELECT * FROM policies;"

# Common rate limit (via admin console or direct SQL)
# Limit 100 messages per hour per sender

Additional Resources

Reference Files

• references/postfix-settings.md - Complete Postfix parameter reference
• references/amavisd-config.md - amavisd configuration options

Example Files

• examples/custom-content-filter.sh - Setup custom filter
• examples/transport-map.sh - Configure transport routing