Spam stored in wrong quarantine folder {Scanned by VITANIUM}

Paul Houselander paul at 4FRONTMEDIA.NET
Fri Nov 5 16:28:18 GMT 2004

On Fri, 2004-11-05 at 15:21, Julian Field wrote:
> Paul Houselander wrote:
> >Hi
> >
> >Have found some unusual behaviour I just wanted to run by the list.
> >
> >I have 2 domains ( and whose mail accounts reside on
> >the same server. Both domains are scanned for Spam, but only on
> >incomming mail i.e. my Use Spamassasin ruleset looks like
> >
> >To: * yes
> >To: * yes
> >FromTo: default no
> >
> >I have a ruleset for quarantine as well
> >
> >FromTo: *     /quarantine/
> >FromTo: *       /quarantine/
> >
> >and my Spam Actions ruleset looks like
> >
> >To: *         store forward spam at
> >To: *           store forward spam at
> >
> >If user1 at sends a message to user2 at that gets tagged as
> >spam it gets quarantined in /quarantine/, I would have expected
> >it to be quarantined in /quarantine/
> >
> >
> Why? The first quarantine rule that matches is
> FromTo: *
> so that is the rule that is used.
> --
> Julian Field
> Buy the MailScanner book at
> Professional Support Services at
> MailScanner thanks transtec Computers for their support

The reason I was thinking this was wrong is I set the SpamAssasin
rule-set to only scan incoming mail, but it was quarantining it based on
the sending domain not the receiving domain.

If the mail was sent from a domain not hosted on my box the spam would
have been quarantined in /quarantine/

Ive just set the quarantine rules to only To: and I agree its now
placing the spam in the correct quarantine directory.

The reason I had FromTo: set was I wanted to quarantine any viruses sent
out From the domains. So my setup is virus scan incoming and outgoing
mail but only check for spam on incoming mail.

In this setup spam sent from one domain to another domain hosted on my
box would be quarantined (IMO) based on sending domain (even though I
don't want outgoing mail spam checked).

Feel free to shout me down, its Friday and been a long week so maybe my
brains not functioning correctly :)



This message has been scanned for unacceptable content by 'VITANIUM'
the industry leading email virus and content management service from
Vitanium Systems. Contact details are available at

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ ( and
the archives (

More information about the MailScanner mailing list