Spam stored in wrong quarantine folder {Scanned by VITANIUM}

[Paul Houselander]

On Fri, 2004-11-05 at 15:21, Julian Field wrote:
> Paul Houselander wrote:
>
> >Hi
> >
> >Have found some unusual behaviour I just wanted to run by the list.
> >
> >I have 2 domains (abc.co.uk and xyz.com) whose mail accounts reside on
> >the same server. Both domains are scanned for Spam, but only on
> >incomming mail i.e. my Use Spamassasin ruleset looks like
> >
> >To: *@abc.co.uk yes
> >To: *@xyz.com yes
> >FromTo: default no
> >
> >I have a ruleset for quarantine as well
> >
> >FromTo: *@abc.co.uk     /quarantine/abc.co.uk
> >FromTo: *@xyz.com       /quarantine/xyz.com
> >
> >and my Spam Actions ruleset looks like
> >
> >To: *@abc.co.uk         store forward spam at abc.co.uk
> >To: *@xyz.com           store forward spam at xyz.com
> >
> >If user1 at abc.co.uk sends a message to user2 at xyz.com that gets tagged as
> >spam it gets quarantined in /quarantine/abc.co.uk, I would have expected
> >it to be quarantined in /quarantine/xyz.com
> >
> >
> Why? The first quarantine rule that matches is
> FromTo: *@abc.co.uk.....
> so that is the rule that is used.
>
> --
> Julian Field
> www.MailScanner.info
> Buy the MailScanner book at www.MailScanner.info/store
> Professional Support Services at www.MailScanner.biz
> MailScanner thanks transtec Computers for their support

The reason I was thinking this was wrong is I set the SpamAssasin
rule-set to only scan incoming mail, but it was quarantining it based on
the sending domain not the receiving domain.

If the mail was sent from a domain not hosted on my box the spam would
have been quarantined in /quarantine/xyz.com

Ive just set the quarantine rules to only To: and I agree its now
placing the spam in the correct quarantine directory.

The reason I had FromTo: set was I wanted to quarantine any viruses sent
out From the domains. So my setup is virus scan incoming and outgoing
mail but only check for spam on incoming mail.

In this setup spam sent from one domain to another domain hosted on my
box would be quarantined (IMO) based on sending domain (even though I
don't want outgoing mail spam checked).

Feel free to shout me down, its Friday and been a long week so maybe my
brains not functioning correctly :)

Cheers

Paul



This message has been scanned for unacceptable content by 'VITANIUM'
the industry leading email virus and content management service from
Vitanium Systems. Contact details are available at www.vitanium.com.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).