Spam "Send to an Alternate Envelope Recipient" block as spam

[eng-ops]

Hello team,

I need to configure in antispam policy the "Send to an Alternate Envelope Recipient" option, in the same domain. The problem is that the mail is generated for the alternative recipient but it is blocked as as spam.

I have tried to create a policy that matches the destination email, but from the logs seems that no matching policy for the alternate email.

Thank you for your help.
eng-ops

[Dustin Anderson]

Make sure you have it set to deliver the positive spam message if you are redirecting it.

[eng-ops]

Thank you for the quick reply. If i'm not wrong, this will deliver also the original spam message, correct?
The goal is:
an incoming spam email for user1@abc.com, keep in the spam quarantine but sent the same email to alertspam@abc.com. 
the delivery for user1 must be quarantine but for alertspam must ne delivered.

Thank you,
eng-ops

[Dustin Anderson]

OK, that can get complicated. If you are OK using a different quarantine, then you can do what you want in a content filter, but I think within the spam engine if you quarantine that is it.

With a content filter, you could set the spam engine to set a header of say X-Spam and a value of positive/suspect etc.

Then in a content filter use if that header exists, send a copy to alt recip and then send to a quarantine. You can't use the spam quarantine so would have to create a new one.

[eng-ops]

Thank you for the update and the alternative way.
But from the documentation it is clear:

For example, you could route messages identified as spam to an administrator’s mailbox for subsequent examination. In the case of a multi-recipient message, only a single copy is sent to the alternate recipient.

I might miss something more in the configuration or the feature does not work.

Thank you,
eng-ops

[Dustin Anderson]

ok, but you said it was then sending that to the quarantine? You may need to open a TAC to verify, but by the instructions it should be sending it.

Actually, now that I think about it, you are sending to an alternate recipient, but is it set to deliver or something else on action? I'm not sure if this sends a copy, or is redirecting the entire message.