Postfix with Spamassassin, discards the spam instead of delivering to spam folder

Question

I've a problem with my Spamassassin, it discards email instead of delivering it to the actual spam folder, I need to change this option just in case the email wasn't spam but i got marked that it was, so i can check my spam folder from time to time.

/etc/postfix/master.cf

smtp      inet  n       -       n       -       -       smtpd -o content_filter=spamassassin
spamassassin unix -     n       n       -       -       pipe user=spamd argv=/usr/bin/spamc -f -e  /usr/sbin/sendmail -oi -f ${sender} ${recipient}

My configuration is set to

/etc/postfix/header_checks 
/^X-Spam-Flag:.YES/ DISCARD This is spam

Is there a way to configure it so it will mark the message as spam and deliver it to spam/junk folder?

Log

Apr 28 09:55:26 testmail postfix/pickup[2171]: BF55C2C2451: uid=1001 from=<email@email>  
Apr 28 09:55:26 testmail postfix/pipe[2275]: 006602C244C: to=<s00152625@mail.itsligo.ie>, relay=spamassassin, delay=0.99, delays=0.34/0.03/0/0.62, dsn=2.0.0, status=sent (delivered via spamassassin service)  
Apr 28 09:55:26 testmail postfix/qmgr[2172]: 006602C244C: removed  
Apr 28 09:55:26 testmail postfix/cleanup[2274]: BF55C2C2451: message-id=<0d84bd23-8e3a-588d-d6f1-501f61f5d1a9@gmail.com>  
Apr 28 09:55:26 testmail postfix/cleanup[2274]: BF55C2C2451: discard: header X-Spam-Flag: YES from local; from=<email@email> to=<email@email>: This is spam  

Answer 1

In order to understand the possibilities it is good to have some conception of the Postfix Architecture.

This first picture visualizes your current situation. Postfix processes every message two times: before and after SpamAssassin. Therefore the X-Spam headers are set only on second round and the message flagged as spam is silently DISCARDed on the second cleanup.

More useful would be to REJECT definite spam (SPF hard failures, non-existent sender domains, some blacklisted IPs etc.) while it is first received by the smtpd. This gives possibility to actually reject the message with corresponding SMTP error code instead of queuing it, as queuing gives a false hint that the message was accepted. This can be configured with helo, sender, and recipient restrictions. This second picture additionally represents a path for message delivered normally to the Inbox.

Your desired state was to only mark message as a spam and then deliver it to mailbox Spam. Actually your SpamAssassin is already doing it, so you just need to let mail delivery agent MDA handle the situation instead of mail transfer agent MTA. In the last diagram Procmail delivers message to the correct mailbox based on X-Spam-Flag.

For this functionality:

• Remove /^X-Spam-Flag:.YES/ DISCARD from /etc/postfix/header_checks.
• Add mailbox_command = procmail -a "$EXTENSION" to main.cf.

• Example configuration for /etc/procmailrc (or per-user ~/.procmailrc):

  MAILDIR=$HOME/mail/
  DEFAULT=$HOME/mail/Inbox
  
  :0:
  * ^X-Spam-Flag: Yes
  Spam
  

There are also several alternatives, e.g. Procmail is able to pipe to SpamAssassin instead of Postfix, allowing per-user (scoring) settings. You may notice that Maildrop is a MDA, too.