Spam stored in wrong quarantine folder {Scanned by VITANIUM}

Desai, Jason jase at SENSIS.COM
Fri Nov 5 19:08:06 GMT 2004

Paul Houselander wrote:
> On Fri, 2004-11-05 at 15:21, Julian Field wrote:
>> Paul Houselander wrote:
>>> Hi
>>> Have found some unusual behaviour I just wanted to run by the list.
>>> I have 2 domains ( and whose mail accounts reside
>>> on the same server. Both domains are scanned for Spam, but only on
>>> incomming mail i.e. my Use Spamassasin ruleset looks like
>>> To: * yes
>>> To: * yes
>>> FromTo: default no
>>> I have a ruleset for quarantine as well
>>> FromTo: *     /quarantine/
>>> FromTo: *       /quarantine/
>>> and my Spam Actions ruleset looks like
>>> To: *         store forward spam at
>>> To: *           store forward spam at
>>> If user1 at sends a message to user2 at that gets
>>> tagged as spam it gets quarantined in /quarantine/, I
>>> would have expected it to be quarantined in /quarantine/
>> Why? The first quarantine rule that matches is
>> FromTo: *
>> so that is the rule that is used.
>> --
>> Julian Field
>> Buy the MailScanner book at
>> Professional Support Services at
>> MailScanner thanks transtec Computers for their support
> The reason I was thinking this was wrong is I set the SpamAssasin
> rule-set to only scan incoming mail, but it was quarantining it based
> on the sending domain not the receiving domain.
> If the mail was sent from a domain not hosted on my box the spam would
> have been quarantined in /quarantine/
> Ive just set the quarantine rules to only To: and I agree its now
> placing the spam in the correct quarantine directory.
> The reason I had FromTo: set was I wanted to quarantine any viruses
> sent out From the domains. So my setup is virus scan incoming and
> outgoing mail but only check for spam on incoming mail.
> In this setup spam sent from one domain to another domain hosted on my
> box would be quarantined (IMO) based on sending domain (even though I
> don't want outgoing mail spam checked).
> Feel free to shout me down, its Friday and been a long week so maybe
> my brains not functioning correctly :)

If you wanted to quarantine based on the recipient, but still be able to
quarantine viruses from your domains, you could change your quarantine rules

To: *     /quarantine/
To: *       /quarantine/
From: *     /quarantine/
From: *       /quarantine/

But then of course, if someone sends a virus from to, it
will be quarantined in /quarantine/, and not /quarantine/


------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ ( and
the archives (

More information about the MailScanner mailing list