I.P.

I'm afraid there's not a good solution to your request. As you correctly said, when an email is sent to a blacklisted recipient, SpamFilter will immediately mark it as spam and for efficiency/performance reasons no more filters will be applied - the email will be blocked because of that match.

We've tested your idea of placing two SpamFilter inline - the first with all filters enabled except for the "Emails TO Blacklist", which then forwards the "clean" emails to the second SpamFilter, which instead must have all filters disabled except for the "Emails TO Blacklist". While this actually works, there's a big concerns with what happens when the second SpamFilter rejects the email because the "Emails TO Blacklist" is triggered.

This is how the email flow happens.

The first SpamFilter accepts the connection and checks the email for spam. During this entire process, SpamFilter places "on hold" the connection from the remote sender, and does not yet reply with a "250 OK" or another SMTP error. This is (unfortunately for you) actually one of the strengths in SpamFilter, because before replying to the sender we actually start the delivery of the email to the destination SMTP server. If, and only if the destination SMTP server accepts at least one recipient, then we are to believe the email will be accepted by the destination SMTP server, and at that point the first SpamFilter will issue a "250 OK" SMTP code back to the sender to let them know the email was delivered. This is usually a great feature, as if your destination SMTP rejected the recipient (ex. for a non-existent user, or a mailbox full) then SpamFilter would report the same exact rejection notice to the sender, which forces the sender, and not SpamFilter, to send an NDR back to the sender.

In your case however, since you want the second SpamFilter to quarantine the email if it's stopped by the Mail TO Blacklist, the second SpamFilter must accept the recipient as we need to receive the entire email to quarantine it. However, since the second SpamFilter accepted the recipient, the first SpamFilter then believes the email will be accepted, and will issue a "250 OK" to the sender to inform them it was delivered.

... but it wasn't delivered, as the destination SMTP server is not your real SMTP server (which we assume to always accept SpamFilter's emails), but rather it's another SpamFilter which will eventually reject the email. The first SpamFilter does see eventually that the email was rejected by the second SpamFilter, but it's too late as it already sent the "250 OK" to the sender's connection. So at this point, since the first SpamFilter wasn't able to deliver the email, we will have to send an NDR bounce email back to the sender. This will create backscatter, as for every email stopped by the 2nd SpamFilter, the 1st SpamFilter will send an NDR email back to the sender, which will often be a fake email, possibly belonging to a legitimate person who had their email address spoofed.

All this would not happen if the 2nd SpamFilter rejected the email without quarantining it, since the RCPT TO would not be accepted and thus the 1st SpamFilter would immediately see the rejection and terminate the connection with the sender.

We could resolve this by also having the 1st SpamFilter keep the connection from the sender "on hold" until the entire email is delivered to the destination SMTP server. But as usually the destination SMTP server for the 1st SpamFilter is your final mail server which would not check the email for spam, doing so would decrease performance and is something we've never looked into.

I'm sorry!

Edited by ik8sqi - 24 August 2020 at 6:27pm