help needed

[orient_ironport]

i would like to check with you guys if you have encounter this issue before.

under mail policies i have setup all positive mail to drop but my user are still receiving couple of mails with the [SPAM] tag at the subject of the mail.

Any ideas?

[MikeK_ironport]

If you have a content filter or mail filter using alt-mailhost then this will override your quarantine.

[lucas.castro_ironport]

post your XML configuration file here,
So we can take a closer look.

[kisanak_ironport]

under mail policies i have setup all positive mail to drop but my user are still receiving couple of mails with the [SPAM] tag at the subject of the mail.

Sometimes, users got those tagged [SPAM] messages from other mail servers that used the same tagging with you. It's better to trace the original message from its header first.

[lucas.castro_ironport]

under mail policies i have setup all positive mail to drop but my user are still receiving couple of mails with the [SPAM] tag at the subject of the mail.


Sometimes, users got those tagged [SPAM] messages from other mail servers that used the same tagging with you. It's better to trace the original message from its header first.

yahoo uses this tag.

Did you looked at your suspected spam settings?

[kisanak_ironport]

yahoo uses this tag. 

Did you looked at your suspected spam settings?

What do you mean?

[lucas.castro_ironport]

yahoo uses this tag. 

Did you looked at your suspected spam settings?

What do you mean?

About the suspected spam setting or about yahoo?

[orient_ironport]

dear all,

thanks for the reply.

I would like to highlight my issue again. for example:

from: xyz@freegift.com
mailto:xxx@mycompany.com
subject: [SPAM] free gift for you.join now!
body: txt

this mail is catergorize spam under ironport but under my "mail policies" i have set all spam to drop and suspected spam point to my local quarantee"


MikeK - yes i have a message filter which blocks certain domain from coming in. does that over ride my mail policies setting?

lucas.castro-which .xml do you want me to post?

the problem is when do a mail_log and trace the mail(with the [SPAM] tag on) ironport shows me the mail is drop. but im puzzle why the mail is still deliever to my user.

[lucas.castro_ironport]

lucas.castro-which .xml do you want me to post?

the 'saveconfig' xml

^^