Setup blacklist and whitelist for SPAM filter

As root, edit the amavisd config at /opt/zimbra/conf/amavisd.conf.in, add 2 lines:

read_hash(\%whitelist_sender, '/opt/zimbra/conf/whitelist');
read_hash(\%blacklist_sender, '/opt/zimbra/conf/blacklist');

Create the list files:

cat <<EOT > /opt/zimbra/conf/whitelist
3open.org
EOT

cat <<EOT > /opt/zimbra/conf/blacklist
spammer@example.com
EOT

Then take effect by:

su - zimbra -c 'zmamavisdctl restart'

Edit the amavisd config at /opt/zimbra/conf/amavisd.conf.in, at section:

# ENVELOPE SENDER SOFT-WHITELISTING / SOFT-BLACKLISTING

@score_sender_maps = ({ # a by-recipient hash lookup table,
                        # results from all matching recipient tables are summed

# ## per-recipient personal tables  (NOTE: positive: black, negative: white)
# 'user1@example.com'  => [{'bla-mobile.press@example.com' => 10.0}],
# 'user3@example.com'  => [{'.ebay.com'                 => -3.0}],
# 'user4@example.com'  => [{'cleargreen@cleargreen.com' => -7.0,
#                           '.cleargreen.com'           => -5.0}],

  ## site-wide opinions about senders (the '.' matches any recipient)
  '.' => [  # the _first_ matching sender determines the score boost

   new_RE(  # regexp-type lookup table, just happens to be all soft-blacklist
    [qr'^(bulkmail|offers|cheapbenefits|earnmoney|foryou)@'i         => 5.0],
    [qr'^(greatcasino|investments|lose_weight_today|market\.alert)@'i=> 5.0],
    [qr'^(money2you|MyGreenCard|new\.tld\.registry|opt-out|opt-in)@'i=> 5.0],
    [qr'^(optin|saveonlsmoking2002k|specialoffer|specialoffers)@'i   => 5.0],
    [qr'^(stockalert|stopsnoring|wantsome|workathome|yesitsfree)@'i  => 5.0],
    [qr'^(your_friend|greatoffers)@'i                                => 5.0],
    [qr'^(inkjetplanet|marketopt|MakeMoney)\d*@'i                    => 5.0],
   ),

#  read_hash("/var/amavis/sender_scores_sitewide"),

   { # a hash-type lookup table (associative array)
...

###
### Add custom black / white list here :
### 

# blacklisting:
     'promote@somedomain.com'  => 10.0,
     'spammer.com'             => 10.0,     

# whitelisting:
     'mycustomer.com'          => -100.0,

...

And run restart aamvisd to take effect:

zmamavisdctl stop && zmamavisdctl start 

http://wiki.zimbra.com/wiki/Improving_Anti-spam_system