> Michael, > >> if an email that is sent to two people gets quarantined due to (sql) >> policy setings for one user, but the score is above the threshold for >> another user, two msgrcpt entries are made, and x-blocked-to includes >> both names. using amavisd 2.6.2 on freebsd, mysql policy settings. (I >> think an earlier fix added x-blocked-to in cases where the email to one >> of the users was NOT blocked due to policy, how about if it was NOT >> supposed to be quarantined by policy? > >> example: >> email scored 19 points >> >> email came to [email protected] and [email protected] >> >> | spam_kill_level | spam_quarantine_cutoff_level | >> | 6 | 20 | >> | 10 | 15 | > > 19 points is above 6 and above 10, mail is considered spam > for both recipients. > >> created two msgrcpt records: > > This is normal. A msgrcpt record is created for EVERY mail recipient, > regardless of scores and settings. Likewise a msgs record, there is > exactly one msgs record generated for every mail, regardless of its > contents. > >> from quarantine file: >> X-Envelope-To-Blocked: <[email protected]>, <[email protected]> > > Normal, 19 > 6, 19 > 10, mail is spam for both. > >> so, should amavisd have NOT added the second msgsrcpt record, and (even >> though it WAS blocked) not added [email protected] to the Blocked list? > > No. > > You are confused by spam_quarantine_cutoff_level. The only purpose > of this setting is to skip writing a message to quarantine > if score is above this level for ALL recipients. Which is consistent > with the fact that only one quarantine copy is otherwise made, > regardless of the number of recipients, if at least one requires > quarantining. A spam level above spam_quarantine_cutoff_level > (= absence of a quarantined message) does not mean the mail is > no longer spam. > >> if this is the design, then when doing quarantine reports, I can just >> doublecheck spam level and spam_quarantine_cutoff_level when doing reports. > > Not sure what you mean. If counting spam, ignore spam_quarantine_cutoff_level. > If reporting quarantined messages for a user, test both, i.e. > msgrcpt.bspam_level >= kill-level for this recip, and there exists > a quarantine record.
And, yes, I decided to add that when I got thinking that if someone has 'quarantine /archive' all (which would archive/quarantine email past the spam_quarantine_cutoff_level anyway) they would probably not want quarantine reports either. -- Michael Scheidell, CTO >|SECNAP Network Security Finalist 2009 Network Products Guide Hot Companies FreeBSD SpamAssassin Ports maintainer _________________________________________________________________________ This email has been scanned and certified safe by SpammerTrap(r). For Information please see http://www.secnap.com/products/spammertrap/ _________________________________________________________________________ ------------------------------------------------------------------------------ Open Source Business Conference (OSBC), March 24-25, 2009, San Francisco, CA -OSBC tackles the biggest issue in open source: Open Sourcing the Enterprise -Strategies to boost innovation and cut costs with open source participation -Receive a $600 discount off the registration fee with the source code: SFAD http://p.sf.net/sfu/XcvMzF8H _______________________________________________ AMaViS-user mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/amavis-user AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3 AMaViS-HowTos:http://www.amavis.org/howto/
