[quote user="bfluet"]You are doing almost exactly what I do except I use a rule in the Global filter to detect the spam tag header and move to the SPAM user.  Also, the first rules in my Global filter set detect messages originating locally and stops rule processing.  It took me awhile to figure out effective rules for this but I think I ended up with a filter that detected a 'resent by Pegasus' header in conjunction with a logical AND rule that detected mydomain.  I am not at the office so can't look to confirm but I will send myself a note to check into it and post back. [/quote]

The rules I use at the top of my global filter set are:

     If expression headers matches "Message-ID:*mydomain.com?" LogicalAnd ""
     If expression headers matches "X-mailer: Pegasus Mail*" Exit ""

Checking the X-mailer header for "Pegasus Mail" works because all of my users use Pegasus Mail.

Thinking about this further, I don't recall having problems with forwards out of my Spam folder being redirected back to my Spam folder before I got these filtering rules in place.  I put them in place so that outgoing mail did not get subjected this filter set.  A lot of time has passed since I set this up.  It is possible that at one time I had Pegasus Mail configured to not pass all mail through Mercury (configurable via the gateway settings set using pconfig).  I have that setting enabled now which I believe I did to insure that all messages were acted on when a forward file was in place.

I am using the MercuryD POP3 client to get all mails from ISP. I enabled the "Basic content check" that comes with Mercury 4.72, however the rules are not applied to the retrieved mails.

 There are some posts in the forum, saying that retrieved mails by POP3 client are considered as originated internal. These posts are dated 2007, Mercury V4.0x

 Do I still have to check "all mail" to get my POP3 mails filtered in V4.72? If I checked "all mail", the filter worked fine, but I don't want to have my internal generated mails spam checked.

Thank you,

Bernward

I don't have an answer to you specific question but I do wish to say that the spam problem has become much bigger than Content Control was designed to handle.  You can create a much more effective spam control system by using either Spamhalter (built-in to Mercury) or POPFile in conjunction with the POPFileD daemon (http://wiki.pmail.com/index.php?title=Mercury:Daemons/popfiled).  Both are trainable and use Bayesian techniques in their detection process. 

My preference is POPFile.  I find its configuration options meet my needs and find it is easy to use.  It is more difficult to set up than Spamhalter though.  At the office I use Mercury filters to detect and move POPFile tagged spam messages to a Spam mailbox where I then review them for false positive.  This process keeps spam out of our users mailboxes.  AFAIK, Spamhalter can be utilized the same way.  Combining filters, whether at Mercury or at the email client, with an effective spam detection tool allows you to create a very effective and personalized spam handling process.

Hello Brian,

we have Spam detection at provider site.So I have no work with the training [:)]

All I want Mercury to do is check for a header like "X-Spam-Level: **********" and move the message to a separate Spam account. Also I perform some additional tests and some address black- and whitelisting.

Bernward

Use an expression rule in the global rule set to detect the spam tagged mail.  My rules for handling Spam tagged messages look like this:

If expression headers matches "X-Text-Classification: spam" Goto "Junk"
.
.
.
Always Exit

Label "Junk"
Always Forward "Spam"
Always Delete
Always Exit

Note 1:  The "X-Text-Classification:" header is what is created with POPFile.  Yours would be "X-Spam-Level:".  I have found the easiest way to insure an accurate expression rule is to copy the header line from the raw view of a message the paste it into the rule. 

Note 2:  In my label I use a Forward rule followed by a Delete rule.   This is because I ran into problems with the Move rule although I have Move rules in other parts of my filter set that work fine.  I would try a Move rule instead of the Forward/Delete combination.

Global rules should allow you to accomplish any other tests as well as black and white list scanning.

FWIW, my domain hosts ISP's anti-spam system was very unreliable.  Set at a mid-detection level it produced too many false positives and at a low-detection level it allows too many spam messages through.  I ended up leaving it set low and putting POPFile in place for more granular, trainable solution.  The combination works great.

Coming back to my problem. Regardless of how I test for spam, I do it by a content filtering rule.

I retrieve all external mail using the Mercury POP3 client, from an ISP account. As Mercury treats POP3 mails as "internal", the filtering rule must apply to "All mail".

Spam mail is sorted into a separate junk account. As I am the postmaster of my company, I have to forward all false positives to the other employess. However doing so, these mails com back to me a minute later, because they are detected false positive again.

To solve the problem, I will now have to add all internal mail addresses (including the junk mail account) to the content control exception list. This way, all internal mail is excluded from the filtering process.

You are doing almost exactly what I do except I use a rule in the Global filter to detect the spam tag header and move to the SPAM user.  Also, the first rules in my Global filter set detect messages originating locally and stops rule processing.  It took me awhile to figure out effective rules for this but I think I ended up with a filter that detected a 'resent by Pegasus' header in conjunction with a logical AND rule that detected mydomain.  I am not at the office so can't look to confirm but I will send myself a note to check into it and post back.