Everything you need to know about SecZim 3.4
Install SecZim with your license key:
curl -fsSL https://get.seczim.com/install.sh | sudo bash -s -- YOUR-LICENSE-KEYYOUR_LICENSE_KEY with your actual license key from the purchase confirmation email.
After successful installation, you'll see:
✅ SecZim installed successfully!
📊 Web Interface: https://your-server-ip:8880
(self-signed certificate: your browser will warn once)
📧 Policy Server: 127.0.0.1:10035
Next steps:
1. Access the web interface at port 8880
2. Configure your mail server integration
3. Set up your security policiesCheck that all services are running:
sudo systemctl status seczim
sudo systemctl status seczim-apihttps://your-server:8880sudo journalctl -u seczim -n 50sudo ss -tlnp | grep -E '8880|10035'sudo systemctl restart seczim seczim-apiKeep your SecZim installation up to date with the latest features and security patches.
To upgrade an existing SecZim installation to the latest version, use the --upgrade flag:
curl -fsSL https://get.seczim.com/install.sh | sudo bash -s -- --upgrade--upgrade flag does not require a license key - it automatically reads your existing installation's license.
/opt/seczim/backup-<date>/ if anything fails--agent have nothing to upgrade: they only hold a pointer to the central. Upgrade the central and they follow.
The upgrade process applies database migrations that are:
CREATE TABLE IF NOT EXISTS and conditional column additionsFor troubleshooting upgrade issues, use verbose mode:
curl -fsSL https://get.seczim.com/install.sh | sudo bash -s -- --verbose --upgradeFor major version updates or if you need to completely refresh your installation:
curl -fsSL https://get.seczim.com/install.sh | sudo bash -s -- YOUR-LICENSE-KEYThis will update all components while preserving your database and configuration.
--verbose flag to see detailed outputsudo journalctl -u seczim -n 50sudo systemctl restart seczim seczim-apiGet SecZim up and running in 5 minutes.
curl -fsSL https://get.seczim.com/install.sh | sudo bash -s -- YOUR-LICENSE-KEYOpen your browser and navigate to https://your-server-ip:8880
You'll see the SecZim dashboard with real-time statistics and policy management.
The installer automatically configures your mail server. Test the integration:
# Test policy server
echo -e "request=smtpd_access_policy\nprotocol_state=RCPT\nclient_address=1.2.3.4\nsender=test@example.com\nrecipient=user@yourdomain.com\n\n" | nc localhost 10035In the web interface:
The dashboard shows real-time statistics:
Go to Access Control → Whitelist and add trusted domains or email addresses.
Go to Quotas section and set daily sending limits per domain or user.
sudo journalctl -u seczim -fWhen you run the installer with your license key, activation is automatic:
curl -fsSL https://get.seczim.com/install.sh | sudo bash -s -- YOUR-LICENSE-KEYCheck your license status via API:
curl https://localhost:8880/api/v1/license/statusOr view it in the web interface under Settings → License.
Your license renews automatically. If renewal fails:
sudo systemctl restart seczim seczim-apiSecZim integrates seamlessly with Zimbra 8.8.x, 9.x, and 10.x.
The installer automatically configures Zimbra integration. To verify:
su - zimbra -c "postconf | grep check_policy_service"You should see: check_policy_service inet:127.0.0.1:10035
If needed, configure manually:
Zimbra regenerates main.cf every minute from a template, so the change must go into the template. SecZim's line goes right before permit_sasl_authenticated. Run as root:
sed -i '/^permit_sasl_authenticated$/i check_policy_service inet:127.0.0.1:10035' \
/opt/zimbra/conf/zmconfigd/smtpd_recipient_restrictions.cfIf SecZim is ever unreachable, accept mail unfiltered instead of deferring it. zmconfigd leaves this key alone, so it persists:
su - zimbra -c "postconf -e 'smtpd_policy_service_default_action = DUNNO'"su - zimbra -c "zmmtactl reload"su - zimbra -c "postconf | grep smtpd_recipient_restrictions"Should include: check_policy_service inet:127.0.0.1:10035
Check the SecZim logs while sending a test email:
sudo journalctl -u seczim -fA Zimbra upgrade can replace the template file. Afterwards, verify SecZim's line is still there:
su - zimbra -c "postconf -h smtpd_recipient_restrictions"If check_policy_service inet:127.0.0.1:10035 is gone, repeat Step 1 or re-run the installer with --upgrade.
sudo systemctl status seczimsu - zimbra -c "postconf | grep policy"sudo journalctl -u seczim | tail -20If Zimbra can't connect to SecZim (port 10035):
sudo systemctl status seczimsudo ss -tlnp | grep 10035SecZim integrates with Postfix 3.5.x through 3.8.x using the policy delegation protocol.
The installer automatically configures Postfix. To verify:
postconf | grep check_policy_servicesudo cp /etc/postfix/main.cf /etc/postfix/main.cf.backupSecZim goes first in smtpd_recipient_restrictions, keeping your existing entries:
sudo postconf -e "smtpd_recipient_restrictions = check_policy_service inet:127.0.0.1:10035, $(postconf -h smtpd_recipient_restrictions)"reject_unauth_destination your server becomes an open relay. If you had no restrictions at all, use: check_policy_service inet:127.0.0.1:10035, permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination
If SecZim is ever unreachable, accept mail unfiltered instead of deferring it (Postfix's default is a 451 for every recipient):
sudo postconf -e "smtpd_policy_service_default_action = DUNNO"sudo postfix reloadpostconf | grep smtpd_recipient_restrictionsRestrictions are evaluated in order and stop at the first permit or reject. SecZim must come before permit_mynetworks and permit_sasl_authenticated, otherwise it never sees local or authenticated mail, and before reject_unauth_destination, otherwise it never sees relay attempts:
smtpd_recipient_restrictions =
check_policy_service inet:127.0.0.1:10035,
permit_mynetworks,
permit_sasl_authenticated,
reject_unauth_destinationFor an MTA that consults a central SecZim, replace 127.0.0.1:10035 with the central's address (see Multiple Mail Servers).
# Test policy server directly
telnet localhost 10035
# Monitor logs while sending test email
sudo journalctl -u seczim -fThese are the values the installer sets; they keep the connection to SecZim open between queries:
sudo postconf -e "smtpd_policy_service_max_idle=300s"
sudo postconf -e "smtpd_policy_service_max_ttl=1000s"sudo systemctl status seczimnc -zv localhost 10035sudo journalctl -u seczim -n 50SecZim includes a comprehensive Security Intelligence System that provides real-time threat detection, automated response, and security analytics.
Navigate to https://your-server:8880 and click on Intelligence in the navigation menu.
The Intelligence Dashboard shows:
# Dashboard summary
GET https://localhost:8880/api/v1/intelligence/dashboard
# Alerts
GET https://localhost:8880/api/v1/alerts
GET https://localhost:8880/api/v1/alerts/rules
# IP Reputation
GET https://localhost:8880/api/v1/ip-reputation
GET https://localhost:8880/api/v1/ip-reputation/config
# Anomalies
GET https://localhost:8880/api/v1/anomalies
GET https://localhost:8880/api/v1/anomalies/config
# Auto-Blacklist
GET https://localhost:8880/api/v1/auto-blacklist
GET https://localhost:8880/api/v1/auto-blacklist/rulesThe Alert System monitors your email infrastructure and generates alerts based on configurable rules.
| Rule | Description | Severity |
|---|---|---|
| Quota Warning 80% | Alert when user reaches 80% of quota | Warning |
| Quota Exceeded | Alert when quota is exceeded | High |
| IP Rejection Spike | Unusual rejection patterns from an IP | High |
| Compromised Account | Potential account compromise detected | Critical |
| High Rejection Rate | Sender with high rejection rate | Warning |
In the web interface, go to Intelligence → Alerts to:
# Get recent alerts
curl https://localhost:8880/api/v1/alerts?limit=10
# Get alert rules
curl https://localhost:8880/api/v1/alerts/rules
# Update alert status
curl -X PUT https://localhost:8880/api/v1/alerts/123/status \
-H "Content-Type: application/json" \
-d '{"status": "acknowledged"}'SecZim tracks the reputation of every IP that interacts with your mail server using a dynamic scoring system.
| Action | Score Change |
|---|---|
| Initial Score | 50 (neutral) |
| Email Accepted | +1 point |
| Email Rejected | -5 points |
| Email Deferred | -2 points |
In the web interface under Intelligence → IP Reputation:
# Get all IP reputations
curl https://localhost:8880/api/v1/ip-reputation
# Get specific IP
curl https://localhost:8880/api/v1/ip-reputation/192.168.1.100
# Whitelist an IP
curl -X PUT https://localhost:8880/api/v1/ip-reputation/192.168.1.100/whitelist
# Blacklist an IP
curl -X PUT https://localhost:8880/api/v1/ip-reputation/192.168.1.100/blacklistSecZim uses machine learning-based detection to identify unusual sender behavior that may indicate compromised accounts or spam attacks.
| Type | Description | Trigger |
|---|---|---|
| Volume Spike | Sender volume exceeds baseline | 3x normal volume |
| New Recipients Spike | Sending to many new recipients | 50+ new recipients |
| Out of Hours | Sending outside typical hours | Based on sender pattern |
Enable automatic blocking for critical anomalies:
# Get recent anomalies
curl https://localhost:8880/api/v1/anomalies
# Get anomaly detection config
curl https://localhost:8880/api/v1/anomalies/config
# Update config
curl -X PUT https://localhost:8880/api/v1/anomalies/config \
-H "Content-Type: application/json" \
-d '{"auto_block_enabled": true}'Automated IP blocking based on malicious behavior patterns.
| Rule | Trigger | Block Duration |
|---|---|---|
| High Rejection Rate | 100+ rejections in 1 hour | 24 hours |
| RBL Hits | 10+ RBL hits per day | 7 days |
| SPF Failures | 50+ SPF failures in 1 hour | 12 hours |
| Geo Block Attempts | 20+ geo-blocked attempts in 1 hour | 24 hours |
In the web interface under Intelligence → Auto-Blacklist:
# Get blacklisted IPs
curl https://localhost:8880/api/v1/auto-blacklist
# Get auto-blacklist rules
curl https://localhost:8880/api/v1/auto-blacklist/rules
# Release an IP
curl -X DELETE https://localhost:8880/api/v1/auto-blacklist/192.168.1.100
# Make permanent
curl -X PUT https://localhost:8880/api/v1/auto-blacklist/192.168.1.100/permanentMulti-channel alerting when threats are detected.
Go to Intelligence → Settings in the web interface to configure notification channels.
# Test email notification
curl -X POST https://localhost:8880/api/v1/notifications/test/email
# Test webhook
curl -X POST https://localhost:8880/api/v1/notifications/test/webhook
# Test Slack
curl -X POST https://localhost:8880/api/v1/notifications/test/slack{
"alert_id": 123,
"type": "ip_spike",
"severity": "high",
"title": "IP Rejection Spike Detected",
"message": "IP 192.168.1.100 has 150 rejections in the last hour",
"details": {...},
"timestamp": "2025-11-30T23:00:00Z"
}Greylisting temporarily defers emails from unknown senders, exploiting the fact that spammers rarely retry delivery.
In the web interface under Policies → Greylisting:
IPs with high reputation scores (≥80) automatically skip greylisting.
Whitelist specific domains or IPs that should never be greylisted:
# Via API
curl -X POST https://localhost:8880/api/v1/greylisting/whitelist \
-H "Content-Type: application/json" \
-d '{"type": "domain", "value": "trusted-company.com"}'curl https://localhost:8880/api/v1/greylisting/statsControl email sending limits per user, domain, or globally.
In the web interface under Policies → Quotas:
# Check all quota usage
curl https://localhost:8880/api/v1/quotas/usage
# Check specific sender
curl "https://localhost:8880/api/v1/quotas/usage?sender=user@domain.com"The Alert System monitors quotas and generates alerts at:
Manage whitelists and blacklists for senders and domains.
Emails from whitelisted senders/domains bypass all checks:
# Add to whitelist
curl -X POST https://localhost:8880/api/v1/acl/whitelist \
-H "Content-Type: application/json" \
-d '{"type": "email", "value": "ceo@partner-company.com"}'
# Add domain to whitelist
curl -X POST https://localhost:8880/api/v1/acl/whitelist \
-H "Content-Type: application/json" \
-d '{"type": "domain", "value": "trusted-company.com"}'Emails from blacklisted senders/domains are always rejected:
# Add to blacklist
curl -X POST https://localhost:8880/api/v1/acl/blacklist \
-H "Content-Type: application/json" \
-d '{"type": "domain", "value": "spam-domain.com"}'curl https://localhost:8880/api/v1/acl/whitelist
curl https://localhost:8880/api/v1/acl/blacklistUse wildcards for flexible matching:
*@domain.com - All users from domainuser@* - User from any domain*.subdomain.com - All subdomainsSecZim includes comprehensive RBL checking to block emails from known spam sources. RBLs are DNS-based blacklists that maintain databases of IP addresses known to send spam or malicious content.
When an email arrives, SecZim:
1.2.3.4 becomes 4.3.2.1)127.0.0.x), the IP is blacklistedFor IP 192.168.1.100 checking against zen.spamhaus.org:
Query: 100.1.168.192.zen.spamhaus.org
Response: 127.0.0.2 (listed) or NXDOMAIN (not listed)| Name | Host | Description |
|---|---|---|
| Spamhaus ZEN | zen.spamhaus.org |
The most comprehensive Spamhaus list. Combines SBL (known spam sources), XBL (exploited systems/proxies), and PBL (policy block list for dynamic IPs). Recommended as primary RBL. |
| Barracuda | b.barracudacentral.org |
Maintained by Barracuda Networks. Covers spam sources, known bad actors, and compromised systems. High accuracy with low false positives. |
| Name | Host | Description |
|---|---|---|
| Spamhaus SBL | sbl.spamhaus.org |
Spamhaus Block List - contains IP addresses of verified spam sources and spam operations. Very accurate but covered by ZEN. |
| Spamhaus XBL | xbl.spamhaus.org |
Exploits Block List - lists IP addresses of hijacked computers, open proxies, and other compromised systems. Also covered by ZEN. |
| SpamCop | bl.spamcop.net |
Community-driven RBL based on user spam reports. Good for catching recent spam campaigns. |
| SORBS | dnsbl.sorbs.net |
Spam and Open Relay Blocking System - comprehensive list covering spam, relays, and exploited systems. |
| UCEPROTECT Level 1 | dnsbl-1.uceprotect.net |
Lists individual IP addresses that have sent spam. Most precise UCEPROTECT level. |
| UCEPROTECT Level 2 | dnsbl-2.uceprotect.net |
Lists entire /24 IP ranges when multiple IPs from the range are spamming. More aggressive than L1. |
| UCEPROTECT Level 3 | dnsbl-3.uceprotect.net |
Lists entire ASNs (Autonomous System Numbers) with poor reputation. Most aggressive - use with caution. |
| Invaluement | dnsbl.invaluement.com |
Anti-spam DNSBL focused on detecting snowshoe spam and botnet operations. |
| PSBL | psbl.surriel.com |
Passive Spam Block List - automatically lists IPs that send spam to honeypots. |
| Mailspike | bl.mailspike.net |
Reputation-based RBL maintained by Mailspike with IP reputation scoring. |
Keep Spamhaus ZEN and Barracuda enabled (default). These provide excellent protection with minimal false positives.
Consider enabling additional RBLs:
For maximum spam blocking (may have more false positives):
In the web interface under RBL:
To manually check if an IP is listed:
# For IP 181.111.252.219 against Spamhaus ZEN
dig 219.252.111.181.zen.spamhaus.org +short
# Response 127.0.0.2 = Listed
# No response = Not listedgrep "RBL" /var/log/seczim-daemon.logBlock or allow emails based on the geographic location of the sending IP.
In the web interface under Policies → Geo-Blocking:
SecZim uses the MaxMind GeoLite2 database for IP geolocation. The database is updated automatically.
The SecZim dashboard provides real-time visibility into your email security.
Open your browser and navigate to https://your-server:8880
SecZim provides a REST API for programmatic access. The API runs on port 8880.
https://localhost:8880/api/v1| Endpoint | Method | Description |
|---|---|---|
| /stats | GET | Get server statistics |
| /mtas | GET | Mail servers that queried SecZim in the last 7 days, with last query time and volume (3.4+) |
| /license/status | GET | Check license status |
| /policies | GET | List all policies |
| Endpoint | Method | Description |
|---|---|---|
| /greylisting/config | GET | Get greylisting config |
| /greylisting/stats | GET | Get greylisting statistics |
| /greylisting/whitelist | GET/POST | Manage whitelist |
| Endpoint | Method | Description |
|---|---|---|
| /intelligence/dashboard | GET | Dashboard summary |
| /alerts | GET | List alerts |
| /alerts/rules | GET | List alert rules |
| /ip-reputation | GET | List IP reputations |
| /anomalies | GET | List anomalies |
| /auto-blacklist | GET | List blacklisted IPs |
| Endpoint | Method | Description |
|---|---|---|
| /acl/whitelist | GET/POST | Manage whitelist |
| /acl/blacklist | GET/POST | Manage blacklist |
| Endpoint | Method | Description |
|---|---|---|
| /quotas | GET/POST | Manage quotas |
| /quotas/usage | GET | Check usage |
Check the logs:
sudo journalctl -u seczim -n 50
sudo journalctl -u seczim-api -n 50Common causes:
sudo systemctl status seczim-apisudo ss -tlnp | grep 8880sudo firewall-cmd --list-portssudo systemctl status seczimsudo ss -tlnp | grep 10035nc -zv localhost 10035ps aux | grep seczimIf the installation was interrupted, truncated, or failed midway, you may need to manually clean up before reinstalling. Run these commands:
# Stop services
sudo systemctl stop seczim seczim-api 2>/dev/null
sudo systemctl disable seczim seczim-api 2>/dev/null
# Stop and remove Docker containers
cd /opt/seczim && sudo docker compose down -v 2>/dev/null
# Remove systemd services
sudo rm -f /etc/systemd/system/seczim.service
sudo rm -f /etc/systemd/system/seczim-api.service
sudo systemctl daemon-reload
# Remove all SecZim directories
sudo rm -rf /opt/seczim
sudo rm -rf /etc/seczim
sudo rm -rf /var/log/seczim
sudo rm -rf /var/lib/seczim
# Remove uninstall script
sudo rm -f /usr/local/bin/seczim-uninstall
sudo rm -f /sbin/seczim-uninstallAfter running these commands, you can reinstall SecZim with a fresh installation.
If the installer reports port 10035 is in use:
sudo ss -tlnp | grep 10035sudo seczim-uninstallsudo systemctl status seczim
sudo systemctl status seczim-apisudo ss -tlnp | grep -E '8880|10035'Expected output:
curl https://localhost:8880/api/v1/stats# Daemon logs
sudo journalctl -u seczim -f
# API logs
sudo journalctl -u seczim-api -fsudo systemctl restart seczim seczim-apiContact us at support@seczim.com
When contacting support, please include:
curl https://localhost:8880/api/v1/version# Export recent logs
sudo journalctl -u seczim --since "1 hour ago" > seczim-daemon.log
sudo journalctl -u seczim-api --since "1 hour ago" > seczim-api.logSecZim uses a priority-based policy system to evaluate incoming emails.
Policies are evaluated in order of priority (highest first):
In the web interface under Policies:
# Get all policies
curl https://localhost:8880/api/v1/policies
# Update policy
curl -X PUT https://localhost:8880/api/v1/policies/greylisting \
-H "Content-Type: application/json" \
-d '{"enabled": true, "defer_time": 300}'Go to the web interface at https://your-server:8880 and click Settings.
Main configuration is stored in:
/etc/seczim/seczim.yamlMost settings take effect immediately. For config file changes:
sudo systemctl restart seczim seczim-apiSecZim generates detailed logs for monitoring, troubleshooting, and auditing email security decisions. This guide covers all log file locations and how to use them effectively.
| Log File | Description | Location |
|---|---|---|
| Daemon Log | Policy daemon processing, module decisions | /var/log/seczim-daemon.log |
| API Log | REST API requests, dashboard activity | /var/log/seczim-api.log |
| Log File | Description | Location |
|---|---|---|
| Postfix Mail Log | General mail delivery and SMTP activity | /var/log/mail.log or /var/log/maillog |
| Zimbra Mail Log | Zimbra-specific mail activity | /var/log/zimbra.log |
| System Journal | Systemd service logs | journalctl -u seczim |
Location: /var/log/seczim-daemon.log
This is the most important log for understanding email security decisions.
TIMESTAMP LEVEL MODULE: MESSAGE2024-12-04 10:23:45 INFO SPF: PASS for sender@example.com from 192.168.1.100
2024-12-04 10:23:46 INFO RBL: IP 10.20.30.40 is listed in Spamhaus ZEN: 127.0.0.2
2024-12-04 10:23:46 WARN Greylisting: first attempt from unknown@spam.com -> user@domain.com (delay: 300s)
2024-12-04 10:23:47 DEBUG GeoIP: IP 203.0.113.50 -> Country: CN (blocked)| Level | Description |
|---|---|
| DEBUG | Detailed information for troubleshooting |
| INFO | Normal operational messages |
| WARN | Potential issues or blocked items |
| ERROR | Errors that need attention |
Location: /var/log/seczim-api.log
Contains logs from the web dashboard and REST API.
2024-12-04 10:30:00 INFO API: GET /api/v1/health -> 200
2024-12-04 10:30:15 INFO API: POST /api/v1/settings -> 200
2024-12-04 10:30:20 INFO Auth: Login successful for admin
2024-12-04 10:31:00 INFO Worker: IP reputation decay completed# Watch daemon log in real-time
sudo tail -f /var/log/seczim-daemon.log
# Watch API log in real-time
sudo tail -f /var/log/seczim-api.log
# Watch both logs simultaneously
sudo tail -f /var/log/seczim-daemon.log /var/log/seczim-api.log# Last 100 lines of daemon log
sudo tail -100 /var/log/seczim-daemon.log
# Last 50 lines of API log
sudo tail -50 /var/log/seczim-api.log# Find all RBL blocks
sudo grep "RBL:" /var/log/seczim-daemon.log | grep "listed"
# Find all rejected emails
sudo grep "REJECT" /var/log/seczim-daemon.log
# Find specific IP address
sudo grep "192.168.1.100" /var/log/seczim-daemon.log
# Find SPF failures
sudo grep "SPF: FAIL" /var/log/seczim-daemon.log
# Find greylisting events
sudo grep "Greylisting:" /var/log/seczim-daemon.log# View daemon service logs
sudo journalctl -u seczim -f
# View API service logs
sudo journalctl -u seczim-api -f
# View logs since last hour
sudo journalctl -u seczim --since "1 hour ago"
# View logs with errors only
sudo journalctl -u seczim -p errCheck what module blocked it:
sudo grep "REJECT\|DEFER" /var/log/seczim-daemon.log | tail -50Check RBL activity:
sudo grep "RBL:" /var/log/seczim-daemon.log | tail -20Monitor greylisting decisions:
sudo grep "Greylisting:" /var/log/seczim-daemon.logCheck SPF results:
sudo grep "SPF:" /var/log/seczim-daemon.log | tail -30Check API errors:
sudo grep "ERROR" /var/log/seczim-api.logCheck systemd logs:
sudo journalctl -u seczim -n 50 --no-pager
sudo journalctl -u seczim-api -n 50 --no-pager| File | Purpose | Check When |
|---|---|---|
/var/log/seczim-daemon.log |
Policy decisions | Email blocked/allowed questions |
/var/log/seczim-api.log |
Dashboard/API activity | Dashboard issues, API errors |
/var/log/mail.log |
General mail flow | Delivery issues |
journalctl -u seczim-* |
Service status | Service won't start |
curl https://localhost:8880/api/v1/statsReturns:
{
"total_requests": 1234,
"accepted": 1100,
"rejected": 134,
"acceptance_rate": 89.14,
"active_connections": 5,
"uptime": 86400
}curl https://localhost:8880/api/v1/policies/statscurl https://localhost:8880/api/v1/intelligence/dashboardcurl https://localhost:8880/api/v1/greylisting/statsMetrics are available at:
http://localhost:9090/metricsSecZim includes a built-in Prometheus metrics exporter that exposes key metrics for monitoring your mail security infrastructure. This allows integration with Prometheus, Grafana, and other monitoring tools.
Metrics are exposed on port 8181 without authentication:
http://your-server:8181/metricsAdd SecZim to your Prometheus configuration:
scrape_configs:
- job_name: 'seczim'
static_configs:
- targets: ['your-server:8181']
scrape_interval: 30sThese metrics track email flow through your server. Each metric includes a period label with values: 1h, 24h, 7d.
seczim_mail_total - Total mail transactionsseczim_mail_inbound - Inbound (external) mail countseczim_mail_outbound - Outbound (authenticated) mail countseczim_mail_accepted - Accepted mail countseczim_mail_rejected - Rejected mail countseczim_mail_deferred - Deferred mail countseczim_unique_ips - Unique connecting IP addressesseczim_geo_blocked_total - Connections blocked by geographic filteringseczim_rbl_blocked_total - Connections blocked by RBL checksseczim_spf_failed_total - SPF verification failuresseczim_greylist_deferred_total - Connections deferred by greylistingActive alerts by severity level:
seczim_alerts_active{severity="critical"}seczim_alerts_active{severity="high"}seczim_alerts_active{severity="medium"}seczim_alerts_active{severity="low"}seczim_blacklisted_ips - Manually blacklisted IPsseczim_auto_blacklisted_ips - Auto-blacklisted IPsseczim_anomalies_detected - Anomalies detected in last 24hseczim_users_near_quota - Users at >80% of their quota limitUseful PromQL queries for Grafana dashboards:
rate(seczim_mail_total{period="1h"}[5m]) * 60seczim_mail_rejected{period="24h"} / seczim_mail_total{period="24h"} * 100seczim_geo_blocked_total + seczim_rbl_blocked_total + seczim_spf_failed_totalseczim_mail_rejected{period="1h"} / seczim_mail_total{period="1h"} > 0.1You can create a Grafana dashboard to visualize these metrics. Key panels to include:
If legitimate emails are being rejected, follow these steps:
sudo journalctl -u seczim | grep "sender@domain.com"Look for the rejection reason.
New senders are temporarily deferred. This is normal - the email will be delivered on retry.
To bypass: Add sender to whitelist.
Sender IP is on a spam blacklist.
To bypass: Add IP to whitelist or disable RBL for that IP.
Sender IP has low reputation score.
To fix: Whitelist the IP in Intelligence → IP Reputation.
Sender has exceeded their daily limit.
To fix: Increase quota or wait for reset.
Sender's country is blocked.
To fix: Add country to allowed list or whitelist sender.
If the sender is legitimate:
curl -X POST https://localhost:8880/api/v1/acl/whitelist \
-H "Content-Type: application/json" \
-d '{"type": "email", "value": "sender@domain.com"}'One SecZim can protect several mail servers (since 3.4). Install it fully on one host, the central, and point every other MTA at it. Policies, greylisting, quotas, reputation and the dashboard are shared by all of them.
Bind the policy service to an internal address and list the MTAs allowed to query it in /etc/seczim/seczim.yaml:
server:
host: "10.0.0.5" # internal IP of this server, not 127.0.0.1
port: 10035
allowed_mtas:
- 10.0.0.11
- 10.0.0.0/24 # IPs or CIDRs; loopback is always allowedsudo systemctl restart seczimConnections from any address not in allowed_mtas are closed before a byte is read and logged with the peer's IP.
One command. Nothing is installed locally: it configures Postfix or Zimbra to consult the central, after verifying the central answers. No license key is needed; licensing lives on the central.
curl -fsSL https://get.seczim.com/install.sh | sudo bash -s -- --agent 10.0.0.5:10035If the central rejects this host, the command stops before touching the MTA and prints the exact lines to add to the central's allowed_mtas.
GET /api/v1/mtas with its last query time and volume.sudo seczim-agent-uninstall.allowed_mtas list and your private network are the access control. Never expose port 10035 to the internet; between datacenters use a VPN such as WireGuard.
Since 3.3 the dashboard and API are served over HTTPS on port 8880. Plain http:// requests to the same port are redirected, so old bookmarks keep working.
On first start SecZim generates a self-signed certificate covering the server's hostname and IP addresses, valid for ten years, at:
/etc/seczim/tls/server.crt
/etc/seczim/tls/server.keyYour browser will warn once because no public authority signed it. Accept the warning and it is remembered. The connection is encrypted either way.
Point SecZim at any certificate and key (for example the one your mail server already uses for SMTP), then restart the API:
# /etc/seczim/seczim.yaml
api:
tls_enabled: true
tls_cert_file: "/etc/letsencrypt/live/mail.example.com/fullchain.pem"
tls_key_file: "/etc/letsencrypt/live/mail.example.com/privkey.pem"sudo systemctl restart seczim-apicurl -k https://localhost:8880/api/v1/health
# {"success":true,"data":{"status":"ok","version":"3.4.0"},...}
curl -I http://localhost:8880/
# HTTP/1.1 301 Moved Permanently Location: https://localhost:8880/