Manually released mail moving from Policy Quarantine to SPAM Quarantine

Question

We have configured content filter to quarantine mails which are categorized as a 'Suspected Spam'
hence all mails quarantined by suspected spam content filter are getting quarantined under 'Policy quarantine'
I have observed that whenever we release mail from Suspected spam content filter, it is moving from Policy quarantine to Spam quarantine instead of getting delivered to the end user. (behavior is only for suspected spam mails. rest of the filters are working fine)
has anyone experienced such kind of behavior ?? please suggest

Answer 1

Hi Don,
Indeed there are two ways to send to ISQ.
a)  alt-mailhost('the.euq.queue')
b)  Insert-Header ('X-Ironport-Quarantine: somevalue')
But both will send the mail to quarantine and stop, even if I have an action such as duplicate-quarantine. No mail is sent to recipient.
It may sound weird to most because why would we need to ISQ an email but at the same time want to mail be delivered.
My goal is to just copy it, and send it to ISQ, while let the mail be delivered.
At this moment, I can't get both done at the same message/content filter.
MonitorUserADGroupFilter: if mail-from-group == "CN=somegroup, OU=XX, DC=company, dc=com" {
                               deliver();
                               alt-mailhost ("the.euq.queue");
deliver() is now called "skip-filters()", btw.
The above wont work because once delivered, the message is no long exist and quarantine to 'the.euq.queue' do no effect.
If I put alt-mailhost higher than deliver, then the message does not deliver.
Also replaced with "duplicate-quarantine" to deliver(). Same behavior.
What's the best way to "deliver and copy to ISQ"?
Regards,
Chris