iRedMail configures Amavisd to bypass detected spam/banned emails, if you want to quarantine them into SQL database, please check our tutorial here:
http://www.iredmail.org/docs/quarantining.html

If you just need to DISCARD them, please just update '$final_[XXX]_destiny' variables.

Virus will be DISCARD directly without quarantining by default.

If you check Amavisd config file, if will find many alerts will be sent to 'root@[myhostname]', it's root user.
And, we have some alias entries in /etc/postfix/aliases, several system accounts are aliased to 'postmaster@[xxx]' (the admin account created during iRedMail installation). So all emails sent to these system accounts are delivered to 'postmaster@xxx', that's why.

Hope it helps.

I did succeed half of it:

1) amavis cannot manipulate email subject, only exception is spam which is processed by spamassassin
2) you can write a global sieve which moves marked spam and banned attachements to junk folder

vi /etc/dovecot/dovecot.conf

sieve_before = /var/vmail/sieve/dovecot.sieve.global

vi /var/vmail/sieve/dovecot.sieve.global

require ["fileinto"];

# rule:[Move Spam to Junk Folder]
if header :is "X-Spam-Flag" "YES"
{
    fileinto "Junk";
    stop;
}

if header :is "X-Amavis-Alert" "BANNED"
{
    fileinto "Junk";
    stop;
}

If iredmail decides to pass junk by default then please move them to junk folder. And if somebody knows a hack about 1) I would be happy if you let me know.

Thanks

I'm not an expert when it comes to amavis new. That's why I investigate so much time to understand how things work. Please correct me if I'm wrong:

- amavis new uses clamav (virus), spamassassin (spam) and has internal mechanism (banned attachement, bad header)
- subject manipulation is set ONLY for spamassassin (*** SPAM ***)
- if you see my initial question I received six e-mails into inbox all of them are spam but only one email, which was handled by spamassassin, has additional *** SPAM *** in the subject.
- all other e-mails are not marked in the subject, which is in my opinion dangerous for customers

Anyway I found a solution:

$subject_tag_maps_by_ccat{+CC_BANNED} = [ '***BANNED*** ' ];

Still my question above: Is quarantining enabled by default in paid version of iRedMail?

So far I don't get the point to pass spam to the recipient. Of course, there must be a way to correct false negative/positiv. I imagine how unhappy our customers would be if they get hundreds of spam every day. That's not the way to go, is it?

For me iRedMail is missing good documentation. Right now I need a lot of time  to find out how things work (how iRedMail is configured). This know how is essential to run this system as a service. Once things don't work anymore as excepted I need to know what to do.

I was thinking to do some system overview. But then I need a faster channel to ask you questions. If you like the idea let me know.

Wright they got banned but in my opinion it's spam. How is the flow in amavis? Does amavis first check for viruses, banned attachements and bad headers? Once a criteria matches it stops and spamassassin never sees that email? If this is the case we never know if it was spam or not. But recipient must be aware something might be wrong with that email.

Good to know, thank you.

Makes sense to me, thanks.

Thanks for your offer. There are still many questions, I'll ask;-)