I'd like to split quarantines to give access to one user to review spam for a special domain.
So I've build a new quarantine, added an "Incoming mail policies" that uses a content filter.
From what I thought, the content filter should determine if a mail has to be moved to the special quarantine.
So I created the content filter as follows (I use the GUI so the language is approximative) :
if (rcpt-to ends with "myspecialdomain.com")
duplicate-quarantine ("Special quarantine")
But this make every mail for this domain quarantined.
I've tried, with no success, to add conditions to isolate spam-only mails.
For example, adding a "Subject begins with [SPAM]" condition or header("X_IronPort_Anti_Spam_Filtered") exists.
Some ideas ?
Maybe all my process is wrong ;-)