Attachment blocking with spoofed addresses and DMARC

[Quanah Gibson-Mount]

A customer who has set up DKIM + SPF notes a spammer tactic where they set 
the TO and FROM to be the same value.  I.e.,:

To: user at domain.com
From: user at domain.com

With an attachment type that has been set up to be blocked.  Even though 
the message clearly fails DMARC and thus will be flagged as Junk in our 
setup (SA scores DMARC failure with a large negative score), the user ends 
up getting a notification for every one of these emails.  Is there any way 
to get Amavis to NOT send a notice to the user if the SA score is above the 
SPAM threshold?

Thanks,
Quanah


--

Quanah Gibson-Mount
Platform Architect
Zimbra, Inc.
--------------------
Zimbra ::  the leader in open source messaging and collaboration
A division of Synacor, Inc