Spam stored in wrong quarantine folder {Scanned by VITANIUM}

[Desai, Jason]

Paul Houselander wrote:
> On Fri, 2004-11-05 at 15:21, Julian Field wrote:
>> Paul Houselander wrote:
>>
>>> Hi
>>>
>>> Have found some unusual behaviour I just wanted to run by the list.
>>>
>>> I have 2 domains (abc.co.uk and xyz.com) whose mail accounts reside
>>> on the same server. Both domains are scanned for Spam, but only on
>>> incomming mail i.e. my Use Spamassasin ruleset looks like
>>>
>>> To: *@abc.co.uk yes
>>> To: *@xyz.com yes
>>> FromTo: default no
>>>
>>> I have a ruleset for quarantine as well
>>>
>>> FromTo: *@abc.co.uk     /quarantine/abc.co.uk
>>> FromTo: *@xyz.com       /quarantine/xyz.com
>>>
>>> and my Spam Actions ruleset looks like
>>>
>>> To: *@abc.co.uk         store forward spam at abc.co.uk
>>> To: *@xyz.com           store forward spam at xyz.com
>>>
>>> If user1 at abc.co.uk sends a message to user2 at xyz.com that gets
>>> tagged as spam it gets quarantined in /quarantine/abc.co.uk, I
>>> would have expected it to be quarantined in /quarantine/xyz.com
>>>
>>>
>> Why? The first quarantine rule that matches is
>> FromTo: *@abc.co.uk.....
>> so that is the rule that is used.
>>
>> --
>> Julian Field
>> www.MailScanner.info
>> Buy the MailScanner book at www.MailScanner.info/store
>> Professional Support Services at www.MailScanner.biz
>> MailScanner thanks transtec Computers for their support
>
> The reason I was thinking this was wrong is I set the SpamAssasin
> rule-set to only scan incoming mail, but it was quarantining it based
> on the sending domain not the receiving domain.
>
> If the mail was sent from a domain not hosted on my box the spam would
> have been quarantined in /quarantine/xyz.com
>
> Ive just set the quarantine rules to only To: and I agree its now
> placing the spam in the correct quarantine directory.
>
> The reason I had FromTo: set was I wanted to quarantine any viruses
> sent out From the domains. So my setup is virus scan incoming and
> outgoing mail but only check for spam on incoming mail.
>
> In this setup spam sent from one domain to another domain hosted on my
> box would be quarantined (IMO) based on sending domain (even though I
> don't want outgoing mail spam checked).
>
> Feel free to shout me down, its Friday and been a long week so maybe
> my brains not functioning correctly :)

If you wanted to quarantine based on the recipient, but still be able to
quarantine viruses from your domains, you could change your quarantine rules
to

To: *@abc.co.uk     /quarantine/abc.co.uk
To: *@xyz.com       /quarantine/xyz.com
From: *@abc.co.uk     /quarantine/abc.co.uk
From: *@xyz.com       /quarantine/xyz.com

But then of course, if someone sends a virus from xyz.com to abc.co.uk, it
will be quarantined in /quarantine/abc.co.cu, and not /quarantine/xyz.com.

Jase

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).