Mystic behavior of multiple recipients mail

[Mark Martinec]

Joe,

> I have a Postfix + Amavisd-new + SpamAssassin as a mail gateway to filter
> out the mails by using whitelist_to and blacklist_to in SpamAssassin only,
> yes everything is so simply, no virus checking, no others. Just check the
> recipient address to decide relay or discard.
> 
> But the thing is, when there is a multiple-recipient mail, lets say to
> white_user1 at test.com, white_user2 at test.com,black_user3 at test.com,
> black_user4 at test.com.
> 
> This mail will go to all these 4 users, the mails to black_user are maked as
> "Passed CLEAN", they are receiving the mails, but they shouldn't.

Amavisd calls SpamAssassin only once per message, not once per recipient.
For this reason SpamAssassin directives like whitelist_to and blacklist_to
cannot work per-recipient. Moreover, all recipients of a multi-recipient
message see the same To header field, so this is another reason why
a SpamAssassin rule which only sees a message (header) cannot
give different results for different recipients of the same message,
even if amavisd would call SpamAssassin multiple times - the message
is the same for all recipients.

Proper per-recipient is only available through @*_maps and related
settings implemented by amavisd itself. An equivalent of whitelist_to
is to declare a recipient to be a spam lover or rise its spam kill level.
A @score_sender_maps is another mechanism that can achieve
similar goal, either through a static setting, or through SQL lookups.

  Mark