> Thanks!  That works well.

Update 1:  Nope, I spoke too soon.  Making that change:

$final_spam_destiny       = D_REJECT; #D_PASS;

means all INBOUND spam is also rejected (clients usually decide for themselves how to filter the spam classified email, so we don't to unconditionally reject inbound spam).  I only want to reject OUTBOUND spam (ie, any spam sent via submission on port 587 (permit_sasl_authenticated) and spam sent via our webmail interface.

As I mentioned before, the spam message is being correctly detected, but how do I reject the email if it's a message sent:

- from a sasl authenticated user, or
- a local user who is sending via webmail

Any ideas?  Apologies - my postfix experience is meagre.

Thanks

Thanks - this worked, added following:

  final_virus_destiny      => D_DISCARD,
  final_banned_destiny     => D_REJECT,
  final_spam_destiny       => D_REJECT,
  final_bad_header_destiny => D_REJECT,

to $policy_bank{'ORIGINATING'}, $policy_bank{'SASLBYPASS'} and $policy_bank{'MYUSERS'} (all for good measure).

Tests confirm outbound spam is being rejected, which is precisely what we want.

Final question now is how to *always* have X-Spam headers added to outbound mail, but I'll raise a second forum topic for that.