Inbound Only Scan Set But Outbound Mail Still Marked

[Serversphere]

I have my MS set up to scan inbound mail only. However a client sent out some mail to his customers this week that all had the {Spam?} attached to them (very embarassing as he is in the data security business - people will probably look down upon his own site marking his mail as spam!). I've confirmed in the header that the mail was scanned and marked on my server. Wondering why this happened....

I do see in the header that it was mailed to himself and BCC'd to all the clients. Does mail that is sent this way somehow bypass the MS rules? I need to investigate further but wondering if anyone else had this problem.

Thanks!
Darren @ Serversphere

(EDIT:Additional) I have confirmed about the BCC. Just tested by sending an email to myself with a BCC address to my Gmail account. It was scanned. A normal message sent directly to the address was not scanned. Interesting. Wonder if this is me being a numbskull and not setting something properly....

[Sarah]

That's the way MailScanner and exim work. A message to multiple recipients is treated as a single message, not a separate message to each recipient. Therefore if one of the recipients is on the server and MS is configured to scan mail to that recipient, it will be scanned.

One way to avoid it may be for the user to whitelist mail from his own domain or IP address. He should do this in the cPanel MailScanner configuration - Email Black/Whitelist Settings. It should work, but you will need to test it.

[Serversphere]

Aha! Sherlock Holmes moment here.

Thanks for the reply Sarah. I see what you mean. I might suggest he send to his GMail account or some such in the future. And I will test the whitelist and post results back here.

[docbreed]

To avoid this from happening and intensive work to create a white-list. Is there a way to white-list all domains on local server?

[Sarah]

No, there is no way to automatically whitelist all domains on the server. THis is a bad idea anyway as it will let through any spam spoofing the domains on the server.