I'm running CentOS 7.1 with Dovecot 2.2.10 (CentOS packaged version). I have Postfix feeding messages to Dovecot for local delivery via LMTP, and I have Amavisd for spam filtering. For messages above a certain threshold, Amavisd adds the "X-Spam-Flag: YES" header, and I file that into the Spam folder using a default (system-wide) sieve script (there aren't any per-user sieve scripts set up):
require "fileinto"; if header :contains "X-Spam-Flag" "YES" { fileinto "Spam"; }
I can see it work on my test messages and from lmtp log entries.
However, it doesn't seem to always work. I had a user complain about a spam increase, and I looked in their mailbox. I see a message with the "X-Spam-Flag: YES" header, but it is in the INBOX (and the corresponding lmtp log entry shows that's where it went).
Why would the sieve script work on some messages and not others? I don't see any errors in the log. I see a bunch of messages from the same source to different users, and they were all filed into INBOX, not Spam.
Looking at the message in question, it is a pretty bogus message. There are multiple From: and Subject: headers. Would that cause sieve to "punt" on the message (but not log anything about it)?
-- Chris Adams cma@cmadams.net