Hello,
I've gone over things and re-tested again.
1) If you've disabled catch-all's then the default settings should be sufficient.
With the default, the only real requirement for SA to run on the forwarder is that the domain is local.
With that, the SA is run on the forwarder, and the domain_filter is run on it.
So as long as it's flagged as spam and the domain_filter drops the message.. then spam will not be relayed.
These are the default settings:
Code:
[COLOR=#000000][FONT=courier new]# Spam Assassin[/FONT][/COLOR]
[COLOR=#000000][FONT=courier new]spamcheck_director:[/FONT][/COLOR]
[COLOR=#000000][FONT=courier new] driver = accept[/FONT][/COLOR]
[COLOR=#000000][FONT=courier new] condition = "${if and { \[/FONT][/COLOR]
[COLOR=#000000][FONT=courier new] {!def:h_X-Spam-Flag:} \[/FONT][/COLOR]
[COLOR=#000000][FONT=courier new] {!eq {$received_protocol}{spam-scanned}} \[/FONT][/COLOR]
[COLOR=#000000][FONT=courier new] {!eq {$received_protocol}{local}} \[/FONT][/COLOR]
[COLOR=#000000][FONT=courier new] {exists{/home/${lookup{$domain}lsearch{/etc/virtual/domainowners}{$value}}/.spamassassin/user_prefs}} \[/FONT][/COLOR]
[COLOR=#000000][FONT=courier new] {<{$message_size}{100k}} \[/FONT][/COLOR]
[COLOR=#000000][FONT=courier new] } {1}{0}}"[/FONT][/COLOR]
[COLOR=#000000][FONT=courier new] retry_use_local_part[/FONT][/COLOR]
[COLOR=#000000][FONT=courier new] transport = spamcheck[/FONT][/COLOR]
[COLOR=#000000][FONT=courier new] no_verify[/FONT][/COLOR]
Note it just checks for the message to be from the outside, must be local, and must be smaller than 500k.
A forwarder logically does fall into that category.
2) As well, I tested it with auto-replies. As long as the message is fully discarded by the domain_filter (which is how messages are dropped in SA).. then on auto-reply is sent.
If mail is tagged as spam (eg: in the subject) but is set to continue on to the inbox, then yes, the forwarder will still make it to the external address.
So unless I'm missing something.. everything seems to be working.
Again, spam must be dropped, else it will continue to go where it's told.
And easy way to test yourself is to setup a "Spam Filter" to block a certain word, like "thisisspam" and include that in your message.
Ensure you set the Spam Filter to drop the emails.
You can compare:
/etc/virtual/
domain.com/filter
to make sure you see "seen finish" after both the high-scoring block, as well as the Spam Filter "word" block... thus, it's the same difference (just confirm you are seeing SA in the headers to make the test fair)
3) Another option, which is not implemented... If you want to stop anything with the hader "X-Spam-Status: Yes,*" from leaving your server.. you could edit the /etc/system_filter.exim.. in a similar fashion to this guide:
http://help.directadmin.com/item.php?id=357
but instead of the lookup{}, you'd instead do a check on the filter.. in a similar manner to the domain_filter.
I've not tested it, but it might look like this:
Code:
[COLOR=#000000][FONT=courier new]if $sender_address is ""[/FONT][/COLOR]
[COLOR=#000000][FONT=courier new]then[/FONT][/COLOR]
[COLOR=#000000][FONT=courier new] if
[/FONT][/COLOR][COLOR=#000000][FONT=courier new] $h_X-Spam-Status: contains "Yes,"
[/FONT][/COLOR][COLOR=#000000][FONT=courier new] then
[/FONT][/COLOR][COLOR=#000000][FONT=courier new] noerror fail text "Dropping outbound spam"[/FONT][/COLOR]
[COLOR=#000000][FONT=courier new] seen finish
[/FONT][/COLOR][COLOR=#000000][FONT=courier new] endif[/FONT][/COLOR]
[COLOR=#000000][FONT=courier new]endif[/FONT][/COLOR]
Again, not sure if that works, but it does it my head.
John
