How do I retrieve false positives?

[switt]

I apologize if this has already been answered but if so I couldn't find it and I'm short on time to purchase something. So....

I installed ProxMox (free version) 3 days ago and I think it's is great. I had been using MimeDefang which left me crying in the corner of my office on more than one occasion. Anyway, I plan to purchase the Professional version to activate some functions but I have a question about handling false positives.

With MimeDefang I was forwarding all mail tagged as spam to a spam drop mailbox. If a user complained about not getting a message I'd search through the spam drop and forward it if necessary.

I've had a couple of users complaining about not receiving messages. I also had a message from a company that never arrived yesterday so I know some legitimate emails aren't getting through. Even if I find them in the greylist log I can't find a way to save them.

Should I quarantine anything tagged as spam and retrieve it from there if necessary? Is there a better way?

Thanks.

 

[dietmar]

I guess the best solution for you is to use the Spam Quarantine. There is an inactive rule called 'Quarantine Spam' - just activat that rule (and maybe incativate the 'Mark Spam' rule). Users will then receive a daily report about received spam mails (and they can preview and unblock those mails).

Another way woul be to forward all mail tagged as spam to a spam drop mailbox. You can do this with the BCC action object.

Even if I find them in the greylist log I can't find a way to save them.

Greylisting blocks mails at a very early stage of the SMTP protocol. Mails are blocked before receiving any mail data (the algorithm works on serder/receiver and IP addreses). So there is no way to store data from greylisted mails, because we never received any data.

Note: Greylisting never rejects mails, insted it returns an temporary error code to the sender, indicating that the sender should try to deliver the mails later. Any reasonable mailer will just deliver the mail a few minutes later (as specified in the SMTP RFC).

Best Regards,

Dietmar