How to prevent multiple scans on same email?

[Richard Mealing]

Hi Norman,


Once the email has been forwarded it should have a different address or domain name. I imagine that hits your MX again. If you just ensure that you don't scan for that (forwarded) domain name, then it won't.
I imagine you scan for everything coming your way, so you'll need to make a slight change in mailscanner.conf -

Spam Checks = %rules-dir%/somerulefile.rules

To:     default         yes
To:          somedomainname          no


You could do the same for the virus scanning also.

Virus Scanning = %rules-dir%/virus.scanning.rules
FromOrTo:       default                 yes
FromOrTo:          somedomainname          no



Thanks,
Rich

From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Norman
Sent: 30 September 2013 16:09
To: mailscanner at lists.mailscanner.info
Subject: How to prevent multiple scans on same email?

Hi List,

I have this conundrum which I am hoping the experts on here will help me resolve. :)

How do I tell mailscanner not to rescan an email that it had already scanned?

I have a small server set up with mailscanner, spamassassin, etc. whose sole purpose is to process the inbound and outbound emails for a separate mail server. The mail flows well between the mail server and the mailscanner server. The issue I have is with 'forwarders', which are, as all of you will know, essentially an email address that is set up to forward incoming emails to another email address.

Briefly, an incoming email for a 'forwarder' first hits the mailscanner server (being the primary mx), it gets processed for spam and viruses and then handed to the mail server. The mail server sees that the local address is not an email account but a 'forwarder', so it sends the email back to the mailscanner server for processing and distribution. That is fine. However, MailScanner treats the email on the second pass as completely 'new' and scans it for spam and viruses again, which is unneeded and causes unwanted resource usage.

Is it possible to tell mailscanner not to scan twice by having it evaluate the headers so it could see that it is dealing with an email which it had already scanned? I couldn't find any options for this in the .conf file. The MTA on both servers is Exim, in case that may be relevant.

Regards,

Norman
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20130930/8d7d3648/attachment.html