This post contains our current Zimbra Fail2Ban Best Practices and will show you how to configure Fail2Ban optimally on your Zimbra servers. Bad actors, overly aggressive marketing companies and others clog up our Inboxes with unwanted emails, and increase the load on our Zimbra servers. While Fail2Ban will effectively block …

MariaDB is the single most common bottleneck we see when doing performance tuning on customers’ Zimbra servers.  This Zimbra-specific MariaDB performance tuning guide will help your mailbox servers run faster and web client users to see noticeable speed improvements in the user interface’s responsiveness. Zimbra MariaDB Level Set Zimbra uses …

Zimbra 10 Daffodil is the first majorly innovative release from Zimbra in a number of years.  Daffodil has been General Availability since March 2023 and as we’ve been answering pretty much the same set of questions from customers consistently for months, albeit with a few recent changes, we thought it …

Zimbra servers make a lot of DNS requests, so having a locally available caching DNS server system for Zimbra to use is important. In helping customers with very active Zimbra servers, we have found that deploying BIND9 gets the job done when dnsmasq, Zimbra’s Unbound or even local Active Directory …

Zimbra mailbox servers on Ubuntu 18/20 can benefit from Linux kernel tuning to reduce swap file usage.  This post will show you how. Note: this article is based in large part on information kindly provided by John Holder of Zimbra a week before his untimely passing.  Over the years John …

We know that deploying MTA-STS better secures inbound email and can prevent MITM and downgrade attacks. But you need a public web server to host the ~/.well-known/mta-sts.txt file.  Not everyone has access to a web server they can use for this purpose, and even if they did, securing, patching, monitoring …

Historically, Zimbra firewalling has focused on regulating only Inbound traffic, but we can better protect our Zimbra systems if we also regulate Outbound traffic by using a Stateful Firewall. What Is a Stateful Firewall? Stateful firewalls, which now account for the majority of SMB and enterprise grade firewalls, can track …

Sometimes we want to block specific domains from sending email to any of our users.  If you followed the instructions to prevent nested address spoofing, the mechanism to perform system-wide sender domain blocking is already in place.  If you haven’t yet deployed nested address spoofing, please go ahead and do …

The Zimbra Network Edition NG module enables a Zimbra Global Admin to create Domain Admins right from the Admin Console. But suppose you want to create a more limited or customized delegated admin account, say, to perform password resets only? To do that, we need to go to the command …

Zimbra’s Distribution Lists are widely deployed on account of their powerful productivity-enhancing features, but in a default Zimbra installation, anyone anywhere can send email to any of your distribution lists — lists like “everyone@mycompany.com” are particularly ripe for exploitation by bad actors.  This post will show you how to secure your …