Isolate spam for one special domain in a special quarantine

[nounours54]

Hi.

I'd like to split quarantines to give access to one user to review spam for a special domain.

So I've build a new quarantine, added an "Incoming mail policies" that uses a content filter.

From what I thought, the content filter should determine if a mail has to be moved to the special quarantine.

So I created the content filter as follows (I use the GUI so the language is approximative) :

if (rcpt-to ends with "myspecialdomain.com")

     duplicate-quarantine ("Special quarantine")

But this make every mail for this domain quarantined.

I've tried, with no success, to add conditions to isolate spam-only mails.

For example, adding a "Subject begins with [SPAM]" condition or header("X_IronPort_Anti_Spam_Filtered") exists.

Some ideas ?

Maybe all my process is wrong ;-)

[Martin Eppler]

Hello,

the basic issue here is that you deal with two different types of quarantines: the spam quarantine and the system quarantine.

The spam quarantine is end user accessible (depending on your cinfiguration) and each end user can see it's own massages under the spam quarantine.

System quarantines (Virus, Policy) are different. They are not end user facing and can only be accessed by helpdesk or admin personnel. They are also not designed to quarantine spam messages (as there is already a spam quarantine).

Per system design a spam message cannot be in the spam AND system quarantine at the same time, so a end user released spam message may end up later on in a system quarantine due to (for instance) a content filter and not delivered to the end user (as he/she would expect then...).

So I'm sorry but it is not possible to configure the requested scenario as the system design does not allow this. The only option would be to allow the respective user access to the full spam quarantine and then carry out a query for the recipent domain in the search field.

Hope this helps. If not, please let us know.

Thanks and regards,

Martin

[nounours54]

Hi, Martin.

Thanks for your quick answer.

It will guide me to another concept.

Regards

Alain