SpamAssassin will insert SPAM related headers/flags in email, what you need to do is moving these SPAM into Spam/Junk folders automatically.

You can find settings like below in /etc/dovecot.conf (RHEL/CentOS) or /etc/dovecot/dovecot.conf (Debian/Ubuntu/openSUSE):

protocol lda {
     [...]
     sieve_global_path = /var/vmail/sieve/dovecot.sieve
     [...]
}

And you can find a sample sieve rule here: /var/vmail/sieve/dovecot.sieve.sample, simple rename it to "/var/vmail/sieve/dovecot.sieve" will move SPAM mails into Spam/Junk folder.

sorry Zhang,
this solution (dovecot.sieve rename) works even if i have enabled "quarantene"?

bye bye and thanks!!
Luciano

But this mail server will provide other domains. For each new domain set up I must manually enter the 50-user file for Amavis add spam info headers?

Yes. Amavisd can't lookup new mail domains from MySQL/LDAP.

$sa_tag_level_deflt  = 2.0;  # add spam info headers if at, or above that level
$sa_tag2_level_deflt = 6.31; # add 'spam detected' headers at that level
$sa_kill_level_deflt = 6.31; # triggers spam evasive actions

Your mail log shows its spam score is "Hits: 9.948":

Did you add this mail domain in Amavisd "@local_domains_maps" in /etc/amavis/conf.d/50-user? like below:

@local_domains_maps = ['u1004.iredmail.org', 'YOUR_DOMAIN_NAME'];

Don't forget to restart amavis service to load changes.

Please let me where is located the configuration file.

Tks

sa_tag_level_deflt
sa_tag2_level_deflt
sa_kill_level_deflt

<<<
May 13 02:39:42 plug-psmtp2 postfix/smtpd[11768]: 58BFD200067: client=plug-psmtp2.xxxxx.xxx[127.0.0.1]
May 13 02:39:42 plug-psmtp2 postfix/cleanup[11758]: 58BFD200067: message-id=<20110513053942.58BFD200067@plug-psmtp2.xxxxx.xxx>
May 13 02:39:42 plug-psmtp2 postfix/qmgr[1860]: 58BFD200067: from=<contato@superlitoral.com.br>, size=2707, nrcpt=1 (queue active)
May 13 02:39:42 plug-psmtp2 amavis[1632]: (01632-08) Passed SPAM, LOCAL [189.84.27.26] [189.84.26.60] <contato@superlitoral.com.br> -> <xxxxxx@xxxxx.xxx>, quarantine: x/spam-xk06Mj8tRJ8P.gz, mail_id: xk06Mj8tRJ8P, Hits: 9.948, size: 1895, queued_as: 58BFD200067, 4105 ms
May 13 02:39:42 plug-psmtp2 postfix/smtp[11763]: 2992C200066: to=<xxxxxx@xxxxx.xxx>, relay=127.0.0.1[127.0.0.1]:10024, delay=4.4, delays=0.17/0.02/0.01/4.2, dsn=2.0.0, status=sent (250 2.0.0 Ok, id=01632-08, from MTA([127.0.0.1]:10025): 250 2.0.0 Ok: queued as 58BFD200067)
May 13 02:39:42 plug-psmtp2 postfix/pipe[11769]: 58BFD200067: to=<xxxxxx@xxxxx.xxx>, relay=dovecot, delay=0.39, delays=0.04/0.02/0/0.33, dsn=2.0.0, status=sent (delivered via dovecot service)
May 13 02:39:42 plug-psmtp2 postfix/qmgr[1860]: 58BFD200067: removed
>>>

But the message was delivered to the mailbox without SPAM flag in the header. See:

Return-Path: <contato@superlitoral.com.br>
Delivered-To: xxxxxx@xxxxx.xxx
Received: from localhost (plug-psmtp2.xxxxx.xxx [127.0.0.1])
    by plug-psmtp2.xxxxx.xxx (Postfix) with ESMTP id 58BFD200067
    for <xxxxxx@xxxxx.xxx>; Fri, 13 May 2011 02:39:42 -0300 (BRT)
X-Virus-Scanned: Debian amavisd-new at plug01
X-Amavis-Alert: BAD HEADER SECTION, Non-encoded 8-bit data (char E7 hex):
    Subject: Planos de Saude melhores hospitais melhor pre\347o
Received: from plug-psmtp2.xxxxx.xxx ([127.0.0.1])
    by localhost (plug-psmtp2.xxxxx.xxx [127.0.0.1]) (amavisd-new, port 10024)
    with ESMTP id xk06Mj8tRJ8P for <xxxxxx@xxxxx.xxx>;
    Fri, 13 May 2011 02:39:38 -0300 (BRT)
X-Original-Helo: 152.tvwww.com.br (iRedMail: http://www.iredmail.org/)
Received: from 152.tvwww.com.br (unknown [189.84.27.26])
    by plug-psmtp2.xxxxx.xxx (Postfix) with ESMTPS id 2992C200066
    for <xxxxxx@xxxxx.xxx>; Fri, 13 May 2011 02:39:38 -0300 (BRT)
Received: (qmail 10375 invoked by uid 507); 13 May 2011 00:40:42 -0300
Received: from unknown (HELO User) (contato@tvwww.com.br@189.84.26.60)
    by 152.tvwww.com.br with SMTP; 13 May 2011 00:40:42 -0300
From: "Planos de Saude Notredame"<contato@superlitoral.com.br>
To: Notredame@plug-psmtp2.xxxxx.xxx,
    Planos@plug-psmtp2.xxxxx.xxx, de@plug-psmtp2.xxxxx.xxx,
    Saude@plug-psmtp2.xxxxx.xxx
Subject: Planos de Saude melhores hospitais melhor preo
Date: Fri, 13 May 2011 02:25:54 -0300
MIME-Version: 1.0
Content-Type: text/html;
    charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1081
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1081
Message-Id: <20110513053942.58BFD200067@plug-psmtp2.xxxxx.xxx>

What action is indicated in these entries:

plug-psmtp2 amavis[1632]: (01632-08) Passed SPAM, LOCAL [189.84.27.26] [189.84.26.60] <contato@superlitoral.com.br> -> <xxxxxx@xxxxx.xxx>, quarantine: x/spam-xk06Mj8tRJ8P.gz

(Passed SPAM  AND  quarantine: x/spam-xk06Mj8tRJ8P.gz)

Thanks for your support at this early stage

For example:

# grep 'amavis' /var/log/maillog

Search 'RBL' in this forum will give you some useful reference posts:
http://www.iredmail.org/forum/search.html

You can find settings like below in /etc/dovecot.conf (RHEL/CentOS) or /etc/dovecot/dovecot.conf (Debian/Ubuntu/openSUSE):

protocol lda {
     [...]
     sieve_global_path = /var/vmail/sieve/dovecot.sieve
     [...]
}

And you can find a sample sieve rule here: /var/vmail/sieve/dovecot.sieve.sample, simple rename it to "/var/vmail/sieve/dovecot.sieve" will move SPAM mails into Spam/Junk folder.

So is writing SpamAssassin flags in the headers of incoming messages? There is another way that can be done this sort and filter?

Why Spamassasim is disabled by default?

SpamAssassin will be invoked by Amavisd, so we don't need daemon "spamd" running.