• Download the ca.pem and sub.class1.server.ca.pem (the CA for the free class 1 validation) to /tmp/
• Cat the CA certs to form a single CA certificate chain file: cat ca.pem sub.class1.server.ca.pem > ca_bundle.crt
• Place server certificate in /tmp/ssl.crt.
• Place the private key in /opt/zimbra/ssl/zimbra/commercial/commercial.key
• Deploy the commercial certificate with zmcertmgr as the root user: /opt/zimbra/bin/zmcertmgr deploycrt comm /tmp/ssl.crt /tmp/ca_bundle.crt
• Restart zimbra: su zimbra, then zmcontrol stop && zmcontrol start

To fix it, you can install exim4, but configure this line in /etc/default/exim4:

QUEUERUNNER='queueonly'

Workaround:

cd /etc/rc0.d/
ln -s ../init.d/zimbra K01zimbra

I noticed that after an upgrade, the bootscript was gone again, so I made this cron task and put it in cron.daily:

#!/bin/bash
#
# Zimbra bug: no rc0 bootscript: http://bugzilla.zimbra.com/show_bug.cgi?id=54099
#
# The bootscript I put there gets removed upon upgrade, so I put this script in
# place which mails root if it is missing.
#
# The bug is fixed, but in 6.0.10 it still wasn't there, so I don't know when
# it will be included in the release.
#
# Install it in /etc/cron.daily.
 
if ! [ -e "/etc/rc0.d/K01zimbra" -a -e "/etc/rc6.d/K01zimbra" ]; then
  message="Kill zimbra bootscript not found in either rc0 (shutdown) or rc6 (reboot)."
  echo "$message"
  echo "$message" | mail -s "Zimbra bootscript error" root
fi

#!/bin/bash
# I, halfgaar, copied this script from /opt/zimbra/bin/mysql and adjusted to so that I can do mysqldump.
 
source /opt/zimbra/bin/zmshutil || exit 1
zmsetvars mysql_directory mysql_socket zimbra_mysql_user zimbra_mysql_password
 
exec ${mysql_directory}/bin/mysqldump -S ${mysql_socket} \
    -u ${zimbra_mysql_user} --password=${zimbra_mysql_password} "$@"

To disable this, do this as user zimbra:

zmprov mcf zimbraMessageIdDedupeCacheSize 0
zmmailboxdctl restart

Unfortunately, this has the annoying problem that conversations aren’t detected for duplicates of a message. See this forum thread for more info.

To amend this, I put this in /opt/zimbra/conf/spamassassin/local.cf:

score BAYES_99 2.500
score BAYES_95 2.000
score BAYES_90 1.500
score BAYES_85 1.000
score BAYES_80 0.500

poll server user "user" pass "secret" mda "formail -A 'X-Zimbra-To: user@domain.org'| /opt/zimbra/postfix/sbin/sendmail -i -t service@sicirec.org"

The -i tells sendmail to ignore a single dot on a line, because that would normally mean end of mail. The -t is “to” (not the header “To:“).

It is a bit unclear why postfix delivers locally to Zimbra, since doing mail user@ourdomain.org routes through an external SMTP server, which is configured in Zimbra to be used as MTA for outgoing mail. It is configured as ‘webmail MTA’.

I Changed the regex to match for 2020 or later, but that’s not really a fix. Even the spamassassin maintainers ‘fixed’ it that way.

What I have to look out for though, is that this file may get overwritten when I upgrade zimbra. sa-update doesn’t seem to work on zimbra, so I don’t really know what the best way of getting new rules is.

I have a zimbra server fooled into thinking it hosts a particular domain. Part of the fooling involves setting a different SMTP server than localhost for all outgoing mail. Luckily, Zimbra can do that.

The downside of that is that when you send mail to “root”, the other SMTP server qualifies it with its domain and the mail appears to be coming from the wrong server.

To fix it, specify this in the /opt/zimbra/postfix/conf/main.cf:

myorigin = example.com

This seems to work without caveats. However, I don’t know if zimbra overwrites this config file at some point.

As always, pick a domain that exists, otherwise a lot of mailservers won’t accept it. You don’t even need an MX record, A or CNAME if enough.