How can I reinject mail scanned with spamassassin back into the queue for final delivery without causing a loop?
NO You can't
I understand the reason you use
virtual_transport to pipe email into Spam Assassin. You only want to scan the email intended to your
virtual_mailbox_domain. Unfortunately it doesn't follow the recommended setup for simple content filter that using
content_filter parameter instead
Why I can't pass
virtual_transport to pickup or smtpd?
Generally, here the email journey across postfix code
Input --> cleanup --> qmgr --> Output
cleanup daemon, postfix will 'route' your email, whether they are belong to virtual, local, smtp or other transports. One exception is when non-blank
content_filter parameter was passed into input service (
qmqpd). When this happened, postfix will override the message route and send the email into
Another note, by default all postfix service was get parameter value from
main.cf unless you override it by using -o parameter=value on
master.cf. But not every parameter in
man 5 postconf used by a service. For example, content_filter only used by
qmqpd so you can put -o content_filter=amavis:[127.0.0.1:10025 on them. Another example, it is not sensible to put -o smtp_bind_address in
smtpd as this parameter only used in
The same argument can be applied to your question, "why I can pass -o virtual_transport in
So here are the several alternatives for your setup
content_filter as explained in postfix documentation. The downside is you also scan the email that relayed outside your domain.
content_filter via ACCESS table and FILTER action. With this way, you can selectively scan the incoming email.
Unfortunately you must enlist your . You can avoid it by carefully placing ACCESS table after
virtual domain again in that table.
permit_sasl_authenticated. With this way, outgoing email will be already permitted and you only scan incoming email. (Credit to OP comment :) )
Using Postfix Multiple Instance. With this way, you can keep the
virtual_transport parameter and spamc will inject the email to your second instance. And then you can define different
virtual_transport in different instance. But it's a bit overkill if you want to keep your setup simple.