Anti-spamの機能で隔離されるメールは、Anti-spamで判定されてすぐに隔離されるのではなく、その後のスキャンも実施した上で隔離されます。
Mail Logs出力例:
Fri Jan 28 07:42:24 2022 Info: Start MID 37 ICID 37
Fri Jan 28 08:42:24 2022 Info: MID 37 ICID 37 From: <user01@example.local>
Fri Jan 28 07:42:34 2022 Info: MID 37 ICID 37 RID 0 To: <user01@example.local>
Fri Jan 28 07:43:00 2022 Info: MID 37 Subject test mail
Fri Jan 28 07:43:02 2022 Info: MID 37 ready 181 bytes from <user01@example.local>
Fri Jan 28 07:43:02 2022 Info: MID 37 matched all recipients for per-recipient policy DEFAULT in the inbound table
Fri Jan 28 07:43:02 2022 Info: MID 37 interim verdict using engine: CASE spam positive
Fri Jan 28 07:43:02 2022 Info: MID 37 using engine: CASE spam positive
Fri Jan 28 07:43:02 2022 Info: ISQ: Tagging MID 37 for quarantine
Fri Jan 28 07:43:02 2022 Info: MID 37 interim AV verdict using Sophos CLEAN
Fri Jan 28 07:43:02 2022 Info: MID 37 antivirus negative
Fri Jan 28 07:43:02 2022 Info: MID 37 AMP file reputation verdict : SKIPPED (no attachment in message)
Fri Jan 28 07:43:02 2022 Info: MID 37 using engine: GRAYMAIL negative
Fri Jan 28 07:43:02 2022 Info: MID 37 Outbreak Filters: verdict negative
Fri Jan 28 07:43:02 2022 Info: MID 37 Message-ID '<2969c8$15@esa.example.local>'
Fri Jan 28 07:43:02 2022 Info: MID 37 queued for delivery
Fri Jan 28 07:43:02 2022 Info: RPC Delivery start RCID 10 MID 37 to local IronPort Spam Quarantine
Fri Jan 28 07:43:03 2022 Info: ISQ: Quarantined MID 37
Fri Jan 28 07:43:03 2022 Info: RPC Message done RCID 10 MID 37
Fri Jan 28 07:43:03 2022 Info: Message finished MID 37 done
Anti-spam以降の処理で何らかのアクションがある場合、メールはそのアクションで処理され、スパム隔離はされません。
Mail Logs出力例:
Fri Jan 28 08:07:30 2022 Info: Start MID 42 ICID 49
Fri Jan 28 08:07:30 2022 Info: MID 42 ICID 49 From: <user01@example.local>
Fri Jan 28 08:07:39 2022 Info: MID 42 ICID 49 RID 0 To: <user01@example.local>
Fri Jan 28 08:08:20 2022 Info: MID 42 Subject 'eicar'
Fri Jan 28 08:08:21 2022 Info: MID 42 ready 845 bytes from <user01@example.local>
Fri Jan 28 08:08:21 2022 Info: MID 42 matched all recipients for per-recipient policy DEFAULT in the inbound table
Fri Jan 28 08:08:24 2022 Info: MID 42 interim verdict using engine: CASE spam positive
Fri Jan 28 08:08:24 2022 Info: MID 42 using engine: CASE spam positive
Fri Jan 28 08:08:24 2022 Info: ISQ: Tagging MID 42 for quarantine
Fri Jan 28 08:08:25 2022 Info: MID 42 interim AV verdict using Sophos VIRAL
Fri Jan 28 08:08:25 2022 Info: MID 42 antivirus positive 'EICAR-AV-Test'
Fri Jan 28 08:08:25 2022 Info: Message aborted MID 42 Dropped by antivirus
Fri Jan 28 08:08:25 2022 Info: Message finished MID 42 done
そのため、スパム隔離されているメールは、Anti-Virusなどのスキャンが完了しているメールとなります。
