> The file structre is that what debian is using. We have adoped the > settings to meet the local domains and also changeg av-scanners to > include sophos.
This does not yet answer my question. You say that you have made changes, but if the basis of your changes is not clear, then the current state is not clear either. Have you or your colleagues (who you can still ask about it) built this mail setup yourselves from scratch, or are you adapting a mail setup that a third party built? I am asking this because in the latter case, there are still possibilities to introduce different behavior apart from /etc/amavis/conf.d: - Modifying or adding files to /usr/share/amavis/conf.d - Using a different entry config file via a modified initscript - Using a different entry config file via a custom systemd unit - Using an executable from a different path - Using an amavis package that is not the one provided by Debian 9 - Modifying the amavis executable With log level 2 or higher, you should see a startup message stating > config files read: /usr/share/amavis/conf.d/10-debian_scripts, ... Do you see unexpected config files there? If you can reproduce the issue yourself, you might run amavis with log level 5, which should give more insight on the issue.
