User-Problem with DSPAM

[p.artur]

After a reserch of several how-to's i have managed to set-up my own mailserver. I set up DSPAM as antispam-engine. It uses the MySQL-Extension. But now i have a problem. When i check the entries in the table "dspam_virtual_uids" of DSPAM there are usernames which does not exist on the system (Virtual-Users).

I use:
- Debian Etch
- Dovecot 1.0.rc15
- Postfix 2.3.8
- DSPAM 3.6.8

Authentication is made through Dovecot, which use a MySQL-Database for Virtual-Users (here the main howto i have followed from workaround.org - in german). When you (can/will) follow the howto you will see, that the usernames are the E-Mail-Adresses of the users (so the username x@domain.com is for the mail-adress x@domain.com).

Now the Problem in the Table username of DSPAM are also E-Mail-Adresses of external Users who communicate with the internal users, so if x@domain.com communicate with abc@web.de, then sometimes abc@web.de is displayed as Username in DSPAM-username-table. Till now i could't reconstruct this situations, so i don't know when this happen.

Here are some configuration-Informations:
master.cf

smtpd_recipient_restrictions =
        permit_tls_clientcerts
        permit_sasl_authenticated
        reject_unknown_recipient_domain
        reject_unauth_destination
        reject_non_fqdn_sender
        reject_unauth_pipelining
        reject_non_fqdn_recipient

smtpd_client_restrictions =
        permit_mynetworks
        check_client_access pcre:/etc/postfix/dspam_filter_access

dspam_destination_recipient_limit = 1

master.cf

dovecot   unix  -       n       n       -       -       pipe
    flags=DRhu user=vmail:vmail argv=/usr/lib/dovecot/deliver -d ${recipient}
dspam     unix    -       n       n       -       10    pipe
flags=Ru user=dspam argv=/usr/bin/dspam --client --deliver=innocent,spam --user ${recipient} -i -f $sender -- $recipient
localhost:10026 inet  n -       n       -       -        smtpd
  -o content_filter=
  -o receive_override_options=no_unknown_recipient_checks,no_header_body_checks
  -o smtpd_helo_restrictions=
  -o smtpd_client_restrictions=
  -o smtpd_sender_restrictions=
  -o smtpd_recipient_restrictions=permit_mynetworks,reject
  -o mynetworks=127.0.0.0/8
  -o smtpd_authorized_xforward_hosts=127.0.0.0/8

File dspam_filter_access:

/./ FILTER dspam:dspam

As workaround not to use the ham and spam-email-adresses i use the antispam-plugin for dovecot. This plugin calls DSPAM for retrain if an E-Mail ist moved from or into the Spam-Folder. Here is the configuration of this Plugin in dovecot.conf.

plugin {
 antispam_signature = X-DSPAM-Signature
 antispam_trash = Trash
 antispam_spam = Junk
 antispam_dspam_args = --user;%u
}

Okey, all this work fine but i don't understand where the external E-Mail-Adresses (usernames) came from. Maybe someone can point me to the right cofiguration-error.

EDIT:
After some test i have managed to catch the situation when this happen. It happen only a local user (x@domain.com) write/send an e-mail to an external user (abc@web.de). Then abc@web.de is inserted as user in the DSPAM-Database. So in the interaction between DSPAM and Postfix is something wrong. Still can't see where. Hope for your help.

[p.artur]

Oh, i think after the last EDIT here (and some reading) i get the solution. I have setted up DSPAM on a howto where Postfix should not scan outgoing E-Mails. But as you can read in my EDIT above it does. So i read a littlebit and it seems, that Postfix has the following Access-Order:
- smtpd_client_restrictions
- smtpd_helo_restrictions
- smtpd_sender_restrictions
- smtpd_recipient_restrictions

The guy in the tutorial seems to use to restrict the usage the definitions in "smtpd_client_restrictions", whereas i use the "smtpd_recipient_restrictions". So i moved the call for DSPAM in Postpix from "client" to "recipient", so:

smtpd_recipient_restrictions =
        permit_tls_clientcerts
        permit_sasl_authenticated
        reject_unknown_recipient_domain
        reject_unauth_destination
        reject_non_fqdn_sender
        reject_unauth_pipelining
        reject_non_fqdn_recipient
        check_client_access pcre:/etc/postfix/dspam_filter_access

Removed the smtpd_client_restrictions completely. It seems to work. Outgoing Mails does not have any DSPAM-Header-Informations, whereas incoming have. And no external Users are added t the Database.

Still, i'm not sure if all is right there. If anyone see here a problem please post.