I found the following entry in amavis log :
<<<
May 13 02:39:42 plug-psmtp2 postfix/smtpd[11768]: 58BFD200067: client=plug-psmtp2.xxxxx.xxx[127.0.0.1]
May 13 02:39:42 plug-psmtp2 postfix/cleanup[11758]: 58BFD200067: message-id=<20110513053942.58BFD200067@plug-psmtp2.xxxxx.xxx>
May 13 02:39:42 plug-psmtp2 postfix/qmgr[1860]: 58BFD200067: from=<contato@superlitoral.com.br>, size=2707, nrcpt=1 (queue active)
May 13 02:39:42 plug-psmtp2 amavis[1632]: (01632-08) Passed SPAM, LOCAL [189.84.27.26] [189.84.26.60] <contato@superlitoral.com.br> -> <xxxxxx@xxxxx.xxx>, quarantine: x/spam-xk06Mj8tRJ8P.gz, mail_id: xk06Mj8tRJ8P, Hits: 9.948, size: 1895, queued_as: 58BFD200067, 4105 ms
May 13 02:39:42 plug-psmtp2 postfix/smtp[11763]: 2992C200066: to=<xxxxxx@xxxxx.xxx>, relay=127.0.0.1[127.0.0.1]:10024, delay=4.4, delays=0.17/0.02/0.01/4.2, dsn=2.0.0, status=sent (250 2.0.0 Ok, id=01632-08, from MTA([127.0.0.1]:10025): 250 2.0.0 Ok: queued as 58BFD200067)
May 13 02:39:42 plug-psmtp2 postfix/pipe[11769]: 58BFD200067: to=<xxxxxx@xxxxx.xxx>, relay=dovecot, delay=0.39, delays=0.04/0.02/0/0.33, dsn=2.0.0, status=sent (delivered via dovecot service)
May 13 02:39:42 plug-psmtp2 postfix/qmgr[1860]: 58BFD200067: removed
>>>
But the message was delivered to the mailbox without SPAM flag in the header. See:
Return-Path: <contato@superlitoral.com.br>
Delivered-To: xxxxxx@xxxxx.xxx
Received: from localhost (plug-psmtp2.xxxxx.xxx [127.0.0.1])
by plug-psmtp2.xxxxx.xxx (Postfix) with ESMTP id 58BFD200067
for <xxxxxx@xxxxx.xxx>; Fri, 13 May 2011 02:39:42 -0300 (BRT)
X-Virus-Scanned: Debian amavisd-new at plug01
X-Amavis-Alert: BAD HEADER SECTION, Non-encoded 8-bit data (char E7 hex):
Subject: Planos de Saude melhores hospitais melhor pre\347o
Received: from plug-psmtp2.xxxxx.xxx ([127.0.0.1])
by localhost (plug-psmtp2.xxxxx.xxx [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id xk06Mj8tRJ8P for <xxxxxx@xxxxx.xxx>;
Fri, 13 May 2011 02:39:38 -0300 (BRT)
X-Original-Helo: 152.tvwww.com.br (iRedMail: http://www.iredmail.org/)
Received: from 152.tvwww.com.br (unknown [189.84.27.26])
by plug-psmtp2.xxxxx.xxx (Postfix) with ESMTPS id 2992C200066
for <xxxxxx@xxxxx.xxx>; Fri, 13 May 2011 02:39:38 -0300 (BRT)
Received: (qmail 10375 invoked by uid 507); 13 May 2011 00:40:42 -0300
Received: from unknown (HELO User) (contato@tvwww.com.br@189.84.26.60)
by 152.tvwww.com.br with SMTP; 13 May 2011 00:40:42 -0300
From: "Planos de Saude Notredame"<contato@superlitoral.com.br>
To: Notredame@plug-psmtp2.xxxxx.xxx,
Planos@plug-psmtp2.xxxxx.xxx, de@plug-psmtp2.xxxxx.xxx,
Saude@plug-psmtp2.xxxxx.xxx
Subject: Planos de Saude melhores hospitais melhor preo
Date: Fri, 13 May 2011 02:25:54 -0300
MIME-Version: 1.0
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1081
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1081
Message-Id: <20110513053942.58BFD200067@plug-psmtp2.xxxxx.xxx>
What action is indicated in these entries:
plug-psmtp2 amavis[1632]: (01632-08) Passed SPAM, LOCAL [189.84.27.26] [189.84.26.60] <contato@superlitoral.com.br> -> <xxxxxx@xxxxx.xxx>, quarantine: x/spam-xk06Mj8tRJ8P.gz
(Passed SPAM AND quarantine: x/spam-xk06Mj8tRJ8P.gz)
Thanks for your support at this early stage