diff --git a/Dockerfile b/Dockerfile
index 8ac2e2bb..3063c11a 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -77,7 +77,7 @@ COPY target/postfix/ldap-users.cf target/postfix/ldap-groups.cf target/postfix/l
 # Enables Spamassassin CRON updates
 RUN sed -i -r 's/^(CRON)=0/\1=1/g' /etc/default/spamassassin
 
-#Enables Postgrey
+# Enables Postgrey
 COPY target/postgrey/postgrey /etc/default/postgrey
 COPY target/postgrey/postgrey.init /etc/init.d/postgrey
 RUN chmod 755 /etc/init.d/postgrey
@@ -85,7 +85,6 @@ RUN mkdir /var/run/postgrey
 RUN chown postgrey:postgrey /var/run/postgrey
 
 # Enables Amavis
-RUN sed -i -r 's/#(@|   \\%)bypass/\1bypass/g' /etc/amavis/conf.d/15-content_filter_mode
 RUN adduser clamav amavis && adduser amavis clamav
 RUN useradd -u 5000 -d /home/docker -s /bin/bash -p $(echo docker | openssl passwd -1 -stdin) docker
 RUN (echo "0 4 * * * /usr/local/bin/virus-wiper" ; crontab -l) | crontab -
diff --git a/Makefile b/Makefile
index cccb1c89..e3f9d4b2 100644
--- a/Makefile
+++ b/Makefile
@@ -24,7 +24,7 @@ run:
 		-v "`pwd`/test/onedir":/var/mail-state \
 		-e ENABLE_CLAMAV=1 \
 		-e ENABLE_SPAMASSASSIN=1 \
-		-e SA_TAG=1.0 \
+		-e SA_TAG=-5.0 \
 		-e SA_TAG2=2.0 \
 		-e SA_KILL=3.0 \
 		-e VIRUSMAILS_DELETE_DELAY=7 \
@@ -150,7 +150,8 @@ fixtures:
 	docker exec mail /bin/sh -c "nc 0.0.0.0 25 < /tmp/docker-mailserver-test/email-templates/existing-alias-external.txt"
 	docker exec mail /bin/sh -c "nc 0.0.0.0 25 < /tmp/docker-mailserver-test/email-templates/existing-alias-local.txt"
 	docker exec mail /bin/sh -c "nc 0.0.0.0 25 < /tmp/docker-mailserver-test/email-templates/existing-alias-recipient-delimiter.txt"
-	docker exec mail /bin/sh -c "nc 0.0.0.0 25 < /tmp/docker-mailserver-test/email-templates/existing-user.txt"
+	docker exec mail /bin/sh -c "nc 0.0.0.0 25 < /tmp/docker-mailserver-test/email-templates/existing-user1.txt"
+	docker exec mail /bin/sh -c "nc 0.0.0.0 25 < /tmp/docker-mailserver-test/email-templates/existing-user2.txt"
 	docker exec mail /bin/sh -c "nc 0.0.0.0 25 < /tmp/docker-mailserver-test/email-templates/existing-user-and-cc-local-alias.txt"
 	docker exec mail /bin/sh -c "nc 0.0.0.0 25 < /tmp/docker-mailserver-test/email-templates/existing-regexp-alias-external.txt"
 	docker exec mail /bin/sh -c "nc 0.0.0.0 25 < /tmp/docker-mailserver-test/email-templates/existing-regexp-alias-local.txt"
diff --git a/target/amavis/README.l10n b/target/amavis/README.l10n
new file mode 100644
index 00000000..0b8c1a3b
--- /dev/null
+++ b/target/amavis/README.l10n
@@ -0,0 +1,21 @@
+$Id: README.l10n 742 2005-12-26 17:15:22Z hmh $
+
+First of all, read /usr/share/doc/amavisd-new/README.customize.gz
+
+Amavisd-new is UTF8-aware, and it will do character-set conversion when dealing
+with DSN templates.  The full unicode codespace is available, if used with the
+proper encodings... and you have to use the proper encodings if you don't want
+your DSNs to be flagged as more charset-challenged SPAM by other systems.
+
+ALWAYS respect the charset when adding l10n files.
+
+Amavisd-new does charset conversion twice: one when reading the text files with
+localized templates (to internal perl UTF8), and another when writing the email
+notification (from internal perl UTF8 to $hdr_encoding and $bdy_encoding).
+
+Headers will be RFC2047-encoded if they have any codepoints not allowed by
+RFC2822 after the charset conversions.  The body text charset encoding is
+inserted in the proper MIME header.
+
+More details are available in /usr/share/doc/amavisd-new/RELEASE_NOTES.gz
+
diff --git a/target/amavis/conf.d/01-debian b/target/amavis/conf.d/01-debian
new file mode 100644
index 00000000..764d8d48
--- /dev/null
+++ b/target/amavis/conf.d/01-debian
@@ -0,0 +1,47 @@
+use strict;
+
+# ADMINISTRATORS:
+# Debian suggests that any changes you need to do that should never
+# be "updated" by the Debian package should be made in another file,
+# overriding the settings in this file.
+#
+# The package will *not* overwrite your settings, but by keeping
+# them separate, you will make the task of merging changes on these
+# configuration files much simpler...
+
+#   see /usr/share/doc/amavisd-new/examples/amavisd.conf-default for
+#       a list of all variables with their defaults;
+#   see /usr/share/doc/amavisd-new/examples/amavisd.conf-sample for
+#       a traditional-style commented file  
+#   [note: the above files were not converted to Debian settings!]
+#
+#   for more details see documentation in /usr/share/doc/amavisd-new
+#   and at http://www.ijs.si/software/amavisd/amavisd-new-docs.html
+
+
+# SETTINGS RARELY MODIFIED BY THE LOCAL ADMIN
+
+$ENV{PATH} = $path = '/usr/local/sbin:/usr/local/bin:/usr/sbin:/sbin:/usr/bin:/bin';
+$file   = 'file';
+$gzip   = 'gzip';
+$bzip2  = 'bzip2';
+$lzop   = 'lzop';
+$rpm2cpio   = ['rpm2cpio.pl','rpm2cpio'];
+$cabextract = 'cabextract';
+$uncompress = ['uncompress', 'gzip -d', 'zcat'];
+#$unfreeze   = ['unfreeze', 'freeze -d', 'melt', 'fcat']; #disabled (non-free, no security support)
+$unfreeze = undef; 
+$arc        = ['nomarch', 'arc'];
+$unarj      = ['arj', 'unarj'];
+#$unrar      = ['rar', 'unrar']; #disabled (non-free, no security support)
+$unrar      = ['unrar-free']; 
+$zoo    = 'zoo';
+$lha    = 'lha';
+$lha	= undef;
+$pax    = 'pax';
+$cpio   = 'cpio';
+$ar     = 'ar';
+$ripole = 'ripole';
+$dspam  = 'dspam';
+
+1;  # ensure a defined return
diff --git a/target/amavis/conf.d/05-domain_id b/target/amavis/conf.d/05-domain_id
new file mode 100644
index 00000000..e1174c00
--- /dev/null
+++ b/target/amavis/conf.d/05-domain_id
@@ -0,0 +1,19 @@
+use strict;
+
+# $mydomain is used just for convenience in the config files and it is not
+# used internally by amavisd-new except in the default X_HEADER_LINE (which
+# Debian overrides by default anyway).
+
+chomp($mydomain = `head -n 1 /etc/mailname`);
+
+# amavisd-new needs to know which email domains are to be considered local
+# to the administrative domain.  Only emails to "local" domains are subject
+# to certain functionality, such as the addition of spam tags.
+#
+# Default local domains to $mydomain and all subdomains.  Remember to
+# override or redefine this if $mydomain is changed later in the config
+# sequence.
+
+@local_domains_acl = ( ".$mydomain" );
+
+1;  # ensure a defined return
diff --git a/target/amavis/conf.d/05-node_id b/target/amavis/conf.d/05-node_id
new file mode 100644
index 00000000..10358c34
--- /dev/null
+++ b/target/amavis/conf.d/05-node_id
@@ -0,0 +1,13 @@
+use strict;
+
+# $myhostname is used by amavisd-new for node identification, and it is
+# important to get it right (e.g. for ESMTP EHLO, loop detection, and so on).
+
+chomp($myhostname = `hostname --fqdn`);
+
+# To manually set $myhostname, edit the following line with the correct Fully
+# Qualified Domain Name (FQDN) and remove the # at the beginning of the line.
+#
+$myhostname = "mail.my-domain.com";
+
+1;  # ensure a defined return
diff --git a/target/amavis/conf.d/15-av_scanners b/target/amavis/conf.d/15-av_scanners
new file mode 100644
index 00000000..59ac2f3d
--- /dev/null
+++ b/target/amavis/conf.d/15-av_scanners
@@ -0,0 +1,473 @@
+use strict;
+
+##
+## AV Scanners (Debian version)
+##
+
+@av_scanners = (
+
+# ### http://www.clanfield.info/sophie/ (http://www.vanja.com/tools/sophie/)
+# ['Sophie',
+#   \&ask_daemon, ["{}/\n", '/var/run/sophie'],
+#   qr/(?x)^ 0+ ( : | [\000\r\n]* $)/m,  qr/(?x)^ 1 ( : | [\000\r\n]* $)/m,
+#   qr/(?x)^ [-+]? \d+ : (.*?) [\000\r\n]* $/m ],
+
+# ### http://www.csupomona.edu/~henson/www/projects/SAVI-Perl/
+# ['Sophos SAVI', \&sophos_savi ],
+
+### http://www.clamav.net/
+ ['ClamAV-clamd',
+   \&ask_daemon, ["CONTSCAN {}\n", "/var/run/clamav/clamd.ctl"],
+   qr/\bOK$/m, qr/\bFOUND$/m,
+   qr/^.*?: (?!Infected Archive)(.*) FOUND$/m ],
+# NOTE: run clamd under the same user as amavisd, or run it under its own
+#   uid such as clamav, add user clamav to the amavis group, and then add
+#   AllowSupplementaryGroups to clamd.conf;
+# NOTE: match socket name (LocalSocket) in clamav.conf to the socket name in
+#   this entry; when running chrooted one may prefer socket "$MYHOME/clamd".
+
+# ### http://www.openantivirus.org/
+# ['OpenAntiVirus ScannerDaemon (OAV)',
+#   \&ask_daemon, ["SCAN {}\n", '127.0.0.1:8127'],
+#   qr/^OK/m, qr/^FOUND: /m, qr/^FOUND: (.+)/m ],
+
+# ### http://www.vanja.com/tools/trophie/
+# ['Trophie',
+#   \&ask_daemon, ["{}/\n", '/var/run/trophie'],
+#   qr/(?x)^ 0+ ( : | [\000\r\n]* $)/m,  qr/(?x)^ 1 ( : | [\000\r\n]* $)/m,
+#   qr/(?x)^ [-+]? \d+ : (.*?) [\000\r\n]* $/m ],
+
+# ### http://www.grisoft.com/
+# ['AVG Anti-Virus',
+#   \&ask_daemon, ["SCAN {}\n", '127.0.0.1:55555'],
+#   qr/^200/m, qr/^403/m, qr/^403 .*?: ([^\r\n]+)/m ],
+
+# ### http://www.f-prot.com/
+# ['F-Prot fpscand',  # F-PROT Antivirus for BSD/Linux/Solaris, version 6
+#   \&ask_daemon,
+#   ["SCAN FILE {}/*\n", '127.0.0.1:10200'],
+#   qr/^(0|8|64) /m,
+#   qr/^([1235679]|1[01345]) |<[^>:]*(?i)(infected|suspicious|unwanted)/m,
+#   qr/(?i)<[^>:]*(?:infected|suspicious|unwanted)[^>:]*: ([^>]*)>/m ],
+
+# ### http://www.f-prot.com/
+# ['F-Prot f-protd',  # old version
+#   \&ask_daemon,
+#   ["GET {}/*?-dumb%20-archive%20-packed HTTP/1.0\r\n\r\n",
+#     ['127.0.0.1:10200', '127.0.0.1:10201', '127.0.0.1:10202',
+#      '127.0.0.1:10203', '127.0.0.1:10204'] ],
+#   qr/(?i)<summary[^>]*>clean<\/summary>/m,
+#   qr/(?i)<summary[^>]*>infected<\/summary>/m,
+#   qr/(?i)<name>(.+)<\/name>/m ],
+
+# ### http://www.sald.com/, http://www.dials.ru/english/, http://www.drweb.ru/
+# ['DrWebD', \&ask_daemon,   # DrWebD 4.31 or later
+#   [pack('N',1).  # DRWEBD_SCAN_CMD
+#    pack('N',0x00280001).   # DONT_CHANGEMAIL, IS_MAIL, RETURN_VIRUSES
+#    pack('N',     # path length
+#      length("$TEMPBASE/amavis-yyyymmddTHHMMSS-xxxxx/parts/pxxx")).
+#    '{}/*'.       # path
+#    pack('N',0).  # content size
+#    pack('N',0),
+#    '/var/drweb/run/drwebd.sock',
+#  # '/var/amavis/var/run/drwebd.sock',   # suitable for chroot
+#  # '/usr/local/drweb/run/drwebd.sock',  # FreeBSD drweb ports default
+#  # '127.0.0.1:3000',                    # or over an inet socket
+#   ],
+#   qr/\A\x00[\x10\x11][\x00\x10]\x00/sm,        # IS_CLEAN,EVAL_KEY; SKIPPED
+#   qr/\A\x00[\x00\x01][\x00\x10][\x20\x40\x80]/sm,# KNOWN_V,UNKNOWN_V,V._MODIF
+#   qr/\A.{12}(?:infected with )?([^\x00]+)\x00/sm,
+# ],
+# # NOTE: If using amavis-milter, change length to:
+# # length("$TEMPBASE/amavis-milter-xxxxxxxxxxxxxx/parts/pxxx").
+
+  ### http://www.kaspersky.com/  (kav4mailservers)
+  ['KasperskyLab AVP - aveclient',
+    ['/usr/local/kav/bin/aveclient','/usr/local/share/kav/bin/aveclient',
+     '/opt/kav/5.5/kav4mailservers/bin/aveclient','aveclient'],
+    '-p /var/run/aveserver -s {}/*',
+    [0,3,6,8], qr/\b(INFECTED|SUSPICION|SUSPICIOUS)\b/m,
+    qr/(?:INFECTED|WARNING|SUSPICION|SUSPICIOUS) (.+)/m,
+  ],
+  # NOTE: one may prefer [0],[2,3,4,5], depending on how suspicious,
+  # currupted or protected archives are to be handled
+
+  ### http://www.kaspersky.com/
+  ['KasperskyLab AntiViral Toolkit Pro (AVP)', ['avp'],
+    '-* -P -B -Y -O- {}', [0,3,6,8], [2,4],    # any use for -A -K   ?
+    qr/infected: (.+)/m,
+    sub {chdir('/opt/AVP') or die "Can't chdir to AVP: $!"},
+    sub {chdir($TEMPBASE) or die "Can't chdir back to $TEMPBASE $!"},
+  ],
+
+  ### The kavdaemon and AVPDaemonClient have been removed from Kasperky
+  ### products and replaced by aveserver and aveclient
+  ['KasperskyLab AVPDaemonClient',
+    [ '/opt/AVP/kavdaemon',       'kavdaemon',
+      '/opt/AVP/AvpDaemonClient', 'AvpDaemonClient',
+      '/opt/AVP/AvpTeamDream',    'AvpTeamDream',
+      '/opt/AVP/avpdc', 'avpdc' ],
+    "-f=$TEMPBASE {}", [0,8], [3,4,5,6], qr/infected: ([^\r\n]+)/m ],
+    # change the startup-script in /etc/init.d/kavd to:
+    #   DPARMS="-* -Y -dl -f=/var/amavis /var/amavis"
+    #   (or perhaps:   DPARMS="-I0 -Y -* /var/amavis" )
+    # adjusting /var/amavis above to match your $TEMPBASE.
+    # The '-f=/var/amavis' is needed if not running it as root, so it
+    # can find, read, and write its pid file, etc., see 'man kavdaemon'.
+    # defUnix.prf: there must be an entry "*/var/amavis" (or whatever
+    #   directory $TEMPBASE specifies) in the 'Names=' section.
+    # cd /opt/AVP/DaemonClients; configure; cd Sample; make
+    # cp AvpDaemonClient /opt/AVP/
+    # su - vscan -c "${PREFIX}/kavdaemon ${DPARMS}"
+
+  ### http://www.centralcommand.com/
+  ['CentralCommand Vexira (new) vascan',
+    ['vascan','/usr/lib/Vexira/vascan'],
+    "-a s --timeout=60 --temp=$TEMPBASE -y $QUARANTINEDIR ".
+    "--log=/var/log/vascan.log {}",
+    [0,3], [1,2,5],
+    qr/(?x)^\s* (?:virus|iworm|macro|mutant|sequence|trojan)\ found:\ ( [^\]\s']+ )\ \.\.\.\ /m ],
+    # Adjust the path of the binary and the virus database as needed.
+    # 'vascan' does not allow to have the temp directory to be the same as
+    # the quarantine directory, and the quarantine option can not be disabled.
+    # If $QUARANTINEDIR is not used, then another directory must be specified
+    # to appease 'vascan'. Move status 3 to the second list if password
+    # protected files are to be considered infected.
+
+  ### http://www.avira.com/
+  ### Avira AntiVir (formerly H+BEDV) or (old) CentralCommand Vexira Antivirus
+  ['Avira AntiVir', ['antivir','vexira'],
+    '--allfiles -noboot -nombr -rs -s -z {}', [0], qr/ALERT:|VIRUS:/m,
+    qr/(?x)^\s* (?: ALERT: \s* (?: \[ | [^']* ' ) |
+         (?i) VIRUS:\ .*?\ virus\ '?) ( [^\]\s']+ )/m ],
+    # NOTE: if you only have a demo version, remove -z and add 214, as in:
+    #  '--allfiles -noboot -nombr -rs -s {}', [0,214], qr/ALERT:|VIRUS:/,
+
+  ### http://www.commandsoftware.com/
+  ['Command AntiVirus for Linux', 'csav',
+    '-all -archive -packed {}', [50], [51,52,53],
+    qr/Infection: (.+)/m ],
+
+  ### http://www.symantec.com/
+  ['Symantec CarrierScan via Symantec CommandLineScanner',
+    'cscmdline', '-a scan -i 1 -v -s 127.0.0.1:7777 {}',
+    qr/^Files Infected:\s+0$/m, qr/^Infected\b/m,
+    qr/^(?:Info|Virus Name):\s+(.+)/m ],
+
+  ### http://www.symantec.com/
+  ['Symantec AntiVirus Scan Engine',
+    'savsecls', '-server 127.0.0.1:7777 -mode scanrepair -details -verbose {}',
+    [0], qr/^Infected\b/m,
+    qr/^(?:Info|Virus Name):\s+(.+)/m ],
+    # NOTE: check options and patterns to see which entry better applies
+
+# ### http://www.f-secure.com/products/anti-virus/  version 4.65
+#  ['F-Secure Antivirus for Linux servers',
+#   ['/opt/f-secure/fsav/bin/fsav', 'fsav'],
+#   '--delete=no --disinf=no --rename=no --archive=yes --auto=yes '.
+#   '--dumb=yes --list=no --mime=yes {}', [0], [3,6,8],
+#   qr/(?:infection|Infected|Suspected): (.+)/m ],
+
+  ### http://www.f-secure.com/products/anti-virus/  version 5.52
+   ['F-Secure Antivirus for Linux servers',
+    ['/opt/f-secure/fsav/bin/fsav', 'fsav'],
+    '--virus-action1=report --archive=yes --auto=yes '.
+    '--dumb=yes --list=no --mime=yes {}', [0], [3,4,6,8],
+    qr/(?:infection|Infected|Suspected|Riskware): (.+)/m ],
+    # NOTE: internal archive handling may be switched off by '--archive=no'
+    #   to prevent fsav from exiting with status 9 on broken archives
+
+# ### http://www.avast.com/
+# ['avast! Antivirus daemon',
+#   \&ask_daemon,	# greets with 220, terminate with QUIT
+#   ["SCAN {}\015\012QUIT\015\012", '/var/run/avast4/mailscanner.sock'],
+#   qr/\t\[\+\]/m, qr/\t\[L\]\t/m, qr/\t\[L\]\t([^[ \t\015\012]+)/m ],
+
+# ### http://www.avast.com/
+# ['avast! Antivirus - Client/Server Version', 'avastlite',
+#   '-a /var/run/avast4/mailscanner.sock -n {}', [0], [1],
+#   qr/\t\[L\]\t([^[ \t\015\012]+)/m ],
+
+  ['CAI InoculateIT', 'inocucmd',  # retired product
+    '-sec -nex {}', [0], [100],
+    qr/was infected by virus (.+)/m ],
+  # see: http://www.flatmtn.com/computer/Linux-Antivirus_CAI.html
+
+  ### http://www3.ca.com/Solutions/Product.asp?ID=156  (ex InoculateIT)
+  ['CAI eTrust Antivirus', 'etrust-wrapper',
+    '-arc -nex -spm h {}', [0], [101],
+    qr/is infected by virus: (.+)/m ],
+    # NOTE: requires suid wrapper around inocmd32; consider flag: -mod reviewer
+    # see http://marc.theaimsgroup.com/?l=amavis-user&m=109229779912783
+
+  ### http://mks.com.pl/english.html
+  ['MkS_Vir for Linux (beta)', ['mks32','mks'],
+    '-s {}/*', [0], [1,2],
+    qr/--[ \t]*(.+)/m ],
+
+  ### http://mks.com.pl/english.html
+  ['MkS_Vir daemon', 'mksscan',
+    '-s -q {}', [0], [1..7],
+    qr/^... (\S+)/m ],
+
+# ### http://www.nod32.com/,  version v2.52 (old)
+# ['ESET NOD32 for Linux Mail servers',
+#   ['/opt/eset/nod32/bin/nod32cli', 'nod32cli'],
+#    '--subdir --files -z --sfx --rtp --adware --unsafe --pattern --heur '.
+#    '-w -a --action-on-infected=accept --action-on-uncleanable=accept '.
+#    '--action-on-notscanned=accept {}',
+#   [0,3], [1,2], qr/virus="([^"]+)"/m ],
+
+# ### http://www.eset.com/, version v2.7 (old)
+# ['ESET NOD32 Linux Mail Server - command line interface',
+#   ['/usr/bin/nod32cli', '/opt/eset/nod32/bin/nod32cli', 'nod32cli'],
+#   '--subdir {}', [0,3], [1,2], qr/virus="([^"]+)"/m ],
+
+# ### http://www.eset.com/, version 2.71.12
+# ['ESET Software ESETS Command Line Interface',
+#   ['/usr/bin/esets_cli', 'esets_cli'],
+#   '--subdir {}', [0], [1,2,3], qr/virus="([^"]+)"/m ],
+
+  ### http://www.eset.com/, version 3.0
+  ['ESET Software ESETS Command Line Interface',
+    ['/usr/bin/esets_cli', 'esets_cli'],
+    '--subdir {}', [0], [2,3],
+    qr/:\s*action="(?!accepted)[^"]*"\n.*:\s*virus="([^"]*)"/m ],
+
+  ## http://www.nod32.com/,  NOD32LFS version 2.5 and above
+  ['ESET NOD32 for Linux File servers',
+    ['/opt/eset/nod32/sbin/nod32','nod32'],
+    '--files -z --mail --sfx --rtp --adware --unsafe --pattern --heur '.
+    '-w -a --action=1 -b {}',
+    [0], [1,10], qr/^object=.*, virus="(.*?)",/m ],
+
+# Experimental, based on posting from Rado Dibarbora (Dibo) on 2002-05-31
+# ['ESET Software NOD32 Client/Server (NOD32SS)',
+#   \&ask_daemon2,    # greets with 200, persistent, terminate with QUIT
+#   ["SCAN {}/*\r\n", '127.0.0.1:8448' ],
+#   qr/^200 File OK/m, qr/^201 /m, qr/^201 (.+)/m ],
+
+  ### http://www.norman.com/products_nvc.shtml
+  ['Norman Virus Control v5 / Linux', 'nvcc',
+    '-c -l:0 -s -u -temp:$TEMPBASE {}', [0,10,11], [1,2,14],
+    qr/(?i).* virus in .* -> \'(.+)\'/m ],
+
+  ### http://www.pandasoftware.com/
+  ['Panda CommandLineSecure 9 for Linux',
+    ['/opt/pavcl/usr/bin/pavcl','pavcl'],
+    '-auto -aex -heu -cmp -nbr -nor -nos -eng -nob {}',
+    qr/Number of files infected[ .]*: 0+(?!\d)/m,
+    qr/Number of files infected[ .]*: 0*[1-9]/m,
+    qr/Found virus :\s*(\S+)/m ],
+  # NOTE: for efficiency, start the Panda in resident mode with 'pavcl -tsr'
+  # before starting amavisd - the bases are then loaded only once at startup.
+  # To reload bases in a signature update script:
+  #   /opt/pavcl/usr/bin/pavcl -tsr -ulr; /opt/pavcl/usr/bin/pavcl -tsr
+  # Please review other options of pavcl, for example:
+  #  -nomalw, -nojoke, -nodial, -nohackt, -nospyw, -nocookies
+
+# ### http://www.pandasoftware.com/
+# ['Panda Antivirus for Linux', ['pavcl'],
+#   '-TSR -aut -aex -heu -cmp -nbr -nor -nso -eng {}',
+#   [0], [0x10, 0x30, 0x50, 0x70, 0x90, 0xB0, 0xD0, 0xF0],
+#   qr/Found virus :\s*(\S+)/m ],
+
+# GeCAD AV technology is acquired by Microsoft; RAV has been discontinued.
+# Check your RAV license terms before fiddling with the following two lines!
+# ['GeCAD RAV AntiVirus 8', 'ravav',
+#   '--all --archive --mail {}', [1], [2,3,4,5], qr/Infected: (.+)/m ],
+# # NOTE: the command line switches changed with scan engine 8.5 !
+# # (btw, assigning stdin to /dev/null causes RAV to fail)
+
+  ### http://www.nai.com/
+  ['NAI McAfee AntiVirus (uvscan)', 'uvscan',
+    '--secure -rv --mime --summary --noboot - {}', [0], [13],
+    qr/(?x) Found (?:
+        \ the\ (.+)\ (?:virus|trojan)  |
+        \ (?:virus|trojan)\ or\ variant\ ([^ ]+)  |
+        :\ (.+)\ NOT\ a\ virus)/m,
+  # sub {$ENV{LD_PRELOAD}='/lib/libc.so.6'},
+  # sub {delete $ENV{LD_PRELOAD}},
+  ],
+  # NOTE1: with RH9: force the dynamic linker to look at /lib/libc.so.6 before
+  # anything else by setting environment variable LD_PRELOAD=/lib/libc.so.6
+  # and then clear it when finished to avoid confusing anything else.
+  # NOTE2: to treat encrypted files as viruses replace the [13] with:
+  #  qr/^\s{5,}(Found|is password-protected|.*(virus|trojan))/
+
+  ### http://www.virusbuster.hu/en/
+  ['VirusBuster', ['vbuster', 'vbengcl'],
+    "{} -ss -i '*' -log=$MYHOME/vbuster.log", [0], [1],
+    qr/: '(.*)' - Virus/m ],
+  # VirusBuster Ltd. does not support the daemon version for the workstation
+  # engine (vbuster-eng-1.12-linux-i386-libc6.tgz) any longer. The names of
+  # binaries, some parameters AND return codes have changed (from 3 to 1).
+  # See also the new Vexira entry 'vascan' which is possibly related.
+
+# ### http://www.virusbuster.hu/en/
+# ['VirusBuster (Client + Daemon)', 'vbengd',
+#   '-f -log scandir {}', [0], [3],
+#   qr/Virus found = (.*);/m ],
+# # HINT: for an infected file it always returns 3,
+# # although the man-page tells a different story
+
+  ### http://www.cyber.com/
+  ['CyberSoft VFind', 'vfind',
+    '--vexit {}/*', [0], [23], qr/##==>>>> VIRUS ID: CVDL (.+)/m,
+  # sub {$ENV{VSTK_HOME}='/usr/lib/vstk'},
+  ],
+
+  ### http://www.avast.com/
+  ['avast! Antivirus', ['/usr/bin/avastcmd','avastcmd'],
+    '-a -i -n -t=A {}', [0], [1], qr/\binfected by:\s+([^ \t\n\[\]]+)/m ],
+
+  ### http://www.ikarus-software.com/
+  ['Ikarus AntiVirus for Linux', 'ikarus',
+    '{}', [0], [40], qr/Signature (.+) found/m ],
+
+  ### http://www.bitdefender.com/
+  ['BitDefender', 'bdscan',  # new version
+    '--action=ignore --no-list {}', qr/^Infected files *:0+(?!\d)/m,
+    qr/^(?:Infected files|Identified viruses|Suspect files) *:0*[1-9]/m,
+    qr/(?:suspected|infected): (.*)(?:\033|$)/m ],
+
+  ### http://www.bitdefender.com/
+  ['BitDefender', 'bdc',  # old version
+    '--arc --mail {}', qr/^Infected files *:0+(?!\d)/m,
+    qr/^(?:Infected files|Identified viruses|Suspect files) *:0*[1-9]/m,
+    qr/(?:suspected|infected): (.*)(?:\033|$)/m ],
+  # consider also: --all --nowarn --alev=15 --flev=15.  The --all argument may
+  # not apply to your version of bdc, check documentation and see 'bdc --help'
+
+  ### ArcaVir for Linux and Unix http://www.arcabit.pl/
+  ['ArcaVir for Linux', ['arcacmd','arcacmd.static'],
+    '-v 1 -summary 0 -s {}', [0], [1,2],
+    qr/(?:VIR|WIR):[ \t]*(.+)/m ],
+
+# ['File::Scan', sub {Amavis::AV::ask_av(sub{
+#   use File::Scan; my($fn)=@_;
+#   my($f)=File::Scan->new(max_txt_size=>0, max_bin_size=>0);
+#   my($vname) = $f->scan($fn);
+#   $f->error ? (2,"Error: ".$f->error)
+#   : ($vname ne '') ? (1,"$vname FOUND") : (0,"Clean")}, @_) },
+#   ["{}/*"], [0], [1], qr/^(.*) FOUND$/m ],
+
+# ### fully-fledged checker for JPEG marker segments of invalid length
+# ['check-jpeg',
+#   sub { use JpegTester (); Amavis::AV::ask_av(\&JpegTester::test_jpeg, @_) },
+#   ["{}/*"], undef, [1], qr/^(bad jpeg: .*)$/m ],
+# # NOTE: place file JpegTester.pm somewhere where Perl can find it,
+# #       for example in /usr/local/lib/perl5/site_perl
+
+# ### example: simpleminded checker for JPEG marker segments with
+# ### invalid length (only checks first 32k, which is not thorough enough)
+# ['check-jpeg-simple',
+#   sub { Amavis::AV::ask_av(sub {
+#     my($f)=@_; local(*FF,$_,$1,$2); my(@r)=(0,'not jpeg');
+#     open(FF,$f) or die "jpeg: open err $f: $!";
+#     binmode(FF) or die "jpeg: binmode err $f: $!";
+#     defined read(FF,$_,32000) or die "jpeg: read err $f: $!";
+#     close(FF) or die "jpeg: close err $f: $!";
+#     if (/^\xff\xd8\xff/) {
+#       @r=(0,'jpeg ok');
+#       while (!/\G(?:\xff\xd9|\z)/gc) {          # EOI or eof
+#         if (/\G\xff+(?=\xff|\z)/gc) {}          # fill-bytes before marker
+#         elsif (/\G\xff([\x01\xd0-\xd8])/gc) {}  # TEM, RSTi, SOI
+#         elsif (/\G\xff([^\x00\xff])(..)/gcs) {  # marker segment start
+#           my($n)=unpack("n",$2)-2;
+#           $n=32766 if $n>32766;  # Perl regexp limit
+#           if ($n<0) {@r=(1,"bad jpeg: len=$n, pos=".pos); last}
+#           elsif (/\G.{$n}/gcs) {}          # ok
+#           elsif (/\G.{0,$n}\z/gcs) {last}  # truncated
+#           else {@r=(1,"bad jpeg: unexpected, pos=".pos); last}
+#         }
+#         elsif (/\G[^\xff]+/gc)      {}  # ECS
+#         elsif (/\G(?:\xff\x00)+/gc) {}  # ECS
+#         else {@r=(2,"bad jpeg: unexpected char, pos=".pos); last}
+#       }
+#     }; @r}, @_) },
+#   ["{}/*"], undef, [1], qr/^(bad jpeg: .*)$/m ],
+
+# ### an example/testing/template virus scanner (external), wastes 3 seconds
+# ['wasteful sleeper example',
+#   '/bin/sleep', '3',  # calls external program
+#   undef, undef, qr/no such/m ],
+
+# ### an example/testing/template virus scanner (internal), does nothing
+# ['null',
+#   sub {}, ["{}"],     # supplies its own subroutine, no external program
+#   undef, undef, qr/no such/m ],
+
+);
+
+
+# If no virus scanners from the @av_scanners list produce 'clean' nor
+# 'infected' status (i.e. they all fail to run or the list is empty),
+# then _all_ scanners from the @av_scanners_backup list are tried
+# (again, subject to $first_infected_stops_scan). When there are both
+# daemonized and equivalent or similar command-line scanners available,
+# it is customary to place slower command-line scanners in the
+# @av_scanners_backup list. The default choice is somewhat arbitrary,
+# move entries from one list to another as desired, keeping main scanners
+# in the primary list to avoid warnings.
+
+@av_scanners_backup = (
+
+  ### http://www.clamav.net/   - backs up clamd or Mail::ClamAV
+  ['ClamAV-clamscan', 'clamscan',
+    "--stdout --no-summary -r --tempdir=$TEMPBASE {}",
+    [0], qr/:.*\sFOUND$/m, qr/^.*?: (?!Infected Archive)(.*) FOUND$/m ],
+
+  ### http://www.f-prot.com/   - backs up F-Prot Daemon, V6
+  ['F-PROT Antivirus for UNIX', ['fpscan'],
+    '--report --mount --adware {}',  # consider: --applications -s 4 -u 3 -z 10
+    [0,8,64],  [1,2,3, 4+1,4+2,4+3, 8+1,8+2,8+3, 12+1,12+2,12+3],
+    qr/^\[Found\s+[^\]]*\]\s+<([^ \t(>]*)/m ],
+
+  ### http://www.f-prot.com/   - backs up F-Prot Daemon (old)
+  ['FRISK F-Prot Antivirus', ['f-prot','f-prot.sh'],
+    '-dumb -archive -packed {}', [0,8], [3,6],   # or: [0], [3,6,8],
+    qr/(?:Infection:|security risk named) (.+)|\s+contains\s+(.+)$/m ],
+
+  ### http://www.trendmicro.com/   - backs up Trophie
+  ['Trend Micro FileScanner', ['/etc/iscan/vscan','vscan'],
+    '-za -a {}', [0], qr/Found virus/m, qr/Found virus (.+) in/m ],
+
+  ### http://www.sald.com/, http://drweb.imshop.de/   - backs up DrWebD
+  ['drweb - DrWeb Antivirus',  # security LHA hole in Dr.Web 4.33 and earlier
+    ['/usr/local/drweb/drweb', '/opt/drweb/drweb', 'drweb'],
+    '-path={} -al -go -ot -cn -upn -ok-',
+    [0,32], [1,9,33], qr' infected (?:with|by)(?: virus)? (.*)$'m ],
+
+   ### http://www.kaspersky.com/
+   ['Kaspersky Antivirus v5.5',
+     ['/opt/kaspersky/kav4fs/bin/kav4fs-kavscanner',
+      '/opt/kav/5.5/kav4unix/bin/kavscanner',
+      '/opt/kav/5.5/kav4mailservers/bin/kavscanner', 'kavscanner'],
+     '-i0 -xn -xp -mn -R -ePASBME {}/*', [0,10,15], [5,20,21,25],
+     qr/(?:INFECTED|WARNING|SUSPICION|SUSPICIOUS) (.*)/m,
+#    sub {chdir('/opt/kav/bin') or die "Can't chdir to kav: $!"},
+#    sub {chdir($TEMPBASE) or die "Can't chdir back to $TEMPBASE $!"},
+   ],
+
+# Commented out because the name 'sweep' clashes with Debian and FreeBSD
+# package/port of an audio editor. Make sure the correct 'sweep' is found
+# in the path when enabling.
+#
+# ### http://www.sophos.com/   - backs up Sophie or SAVI-Perl
+# ['Sophos Anti Virus (sweep)', 'sweep',
+#   '-nb -f -all -rec -ss -sc -archive -cab -mime -oe -tnef '.
+#   '--no-reset-atime {}',
+#   [0,2], qr/Virus .*? found/m,
+#   qr/^>>> Virus(?: fragment)? '?(.*?)'? found/m,
+# ],
+# # other options to consider: -idedir=/usr/local/sav
+
+# Always succeeds and considers mail clean.
+# Potentially useful when all other scanners fail and it is desirable
+# to let mail continue to flow with no virus checking (when uncommented).
+# ['always-clean', sub {0}],
+
+);
+
+1;  # ensure a defined return
diff --git a/target/amavis/conf.d/15-content_filter_mode b/target/amavis/conf.d/15-content_filter_mode
new file mode 100644
index 00000000..7b1a2ac6
--- /dev/null
+++ b/target/amavis/conf.d/15-content_filter_mode
@@ -0,0 +1,27 @@
+use strict;
+
+# You can modify this file to re-enable SPAM checking through spamassassin
+# and to re-enable antivirus checking.
+
+#
+# Default antivirus checking mode
+# Please note, that anti-virus checking is DISABLED by 
+# default.
+# If You wish to enable it, please uncomment the following lines:
+
+
+@bypass_virus_checks_maps = (
+   \%bypass_virus_checks, \@bypass_virus_checks_acl, \$bypass_virus_checks_re);
+
+
+#
+# Default SPAM checking mode
+# Please note, that anti-spam checking is DISABLED by 
+# default.
+# If You wish to enable it, please uncomment the following lines:
+
+
+@bypass_spam_checks_maps = (
+   \%bypass_spam_checks, \@bypass_spam_checks_acl, \$bypass_spam_checks_re);
+
+1;  # ensure a defined return
diff --git a/target/amavis/conf.d/20-debian_defaults b/target/amavis/conf.d/20-debian_defaults
new file mode 100644
index 00000000..4572df4d
--- /dev/null
+++ b/target/amavis/conf.d/20-debian_defaults
@@ -0,0 +1,212 @@
+use strict;
+
+# ADMINISTRATORS:
+# Debian suggests that any changes you need to do that should never
+# be "updated" by the Debian package should be made in another file,
+# overriding the settings in this file.
+#
+# The package will *not* overwrite your settings, but by keeping
+# them separate, you will make the task of merging changes on these
+# configuration files much simpler...
+
+#   see /usr/share/doc/amavisd-new/examples/amavisd.conf-default for
+#       a list of all variables with their defaults;
+#   see /usr/share/doc/amavisd-new/examples/amavisd.conf-sample for
+#       a traditional-style commented file  
+#   [note: the above files were not converted to Debian settings!]
+#
+#   for more details see documentation in /usr/share/doc/amavisd-new
+#   and at http://www.ijs.si/software/amavisd/amavisd-new-docs.html
+
+$QUARANTINEDIR = "$MYHOME/virusmails";
+$quarantine_subdir_levels = 1; # enable quarantine dir hashing
+
+$log_recip_templ = undef;    # disable by-recipient level-0 log entries
+$DO_SYSLOG = 1;              # log via syslogd (preferred)
+$syslog_ident = 'amavis';    # syslog ident tag, prepended to all messages
+$syslog_facility = 'mail';
+$syslog_priority = 'debug';  # switch to info to drop debug output, etc
+
+$enable_db = 1;              # enable use of BerkeleyDB/libdb (SNMP and nanny)
+$enable_global_cache = 1;    # enable use of libdb-based cache if $enable_db=1
+
+$inet_socket_port = 10024;   # default listening socket
+
+$sa_spam_subject_tag = '***SPAM*** ';
+$sa_tag_level_deflt = 1.0;  # add spam info headers if at, or above that level
+$sa_tag2_level_deflt = 2.0; # add 'spam detected' headers at that level
+$sa_kill_level_deflt = 3.0; # triggers spam evasive actions
+$sa_dsn_cutoff_level = 10;   # spam level beyond which a DSN is not sent
+
+$sa_mail_body_size_limit = 200*1024; # don't waste time on SA if mail is larger
+$sa_local_tests_only = 0;    # only tests which do not require internet access?
+
+# Quota limits to avoid bombs (like 42.zip)
+
+$MAXLEVELS = 14;
+$MAXFILES = 1500;
+$MIN_EXPANSION_QUOTA =      100*1024;  # bytes
+$MAX_EXPANSION_QUOTA = 300*1024*1024;  # bytes
+
+# You should:
+#   Use D_DISCARD to discard data (viruses)
+#   Use D_BOUNCE to generate local bounces by amavisd-new
+#   Use D_REJECT to generate local or remote bounces by the calling MTA
+#   Use D_PASS to deliver the message
+#
+# Whatever you do, *NEVER* use D_REJECT if you have other MTAs *forwarding*
+# mail to your account.  Use D_BOUNCE instead, otherwise you are delegating
+# the bounce work to your friendly forwarders, which might not like it at all.
+#
+# On dual-MTA setups, one can often D_REJECT, as this just makes your own
+# MTA generate the bounce message.  Test it first.
+#
+# Bouncing viruses is stupid, always discard them after you are sure the AV
+# is working correctly.  Bouncing real SPAM is also useless, if you cannot
+# D_REJECT it (and don't D_REJECT mail coming from your forwarders!).
+
+$final_virus_destiny      = D_DISCARD;  # (data not lost, see virus quarantine)
+$final_banned_destiny     = D_BOUNCE;   # D_REJECT when front-end MTA
+$final_spam_destiny       = D_BOUNCE;
+$final_bad_header_destiny = D_PASS;     # False-positive prone (for spam)
+
+$enable_dkim_verification = 0; #disabled to prevent warning
+
+$virus_admin = "postmaster\@$mydomain"; # due to D_DISCARD default
+
+# Set to empty ("") to add no header
+$X_HEADER_LINE = "Debian $myproduct_name at $mydomain";
+
+# REMAINING IMPORTANT VARIABLES ARE LISTED HERE BECAUSE OF LONGER ASSIGNMENTS
+
+#
+# DO NOT SEND VIRUS NOTIFICATIONS TO OUTSIDE OF YOUR DOMAIN. EVER.
+#
+# These days, almost all viruses fake the envelope sender and mail headers.
+# Therefore, "virus notifications" became nothing but undesired, aggravating
+# SPAM.  This holds true even inside one's domain.  We disable them all by
+# default, except for the EICAR test pattern.
+#
+
+@viruses_that_fake_sender_maps = (new_RE(
+  [qr'\bEICAR\b'i => 0],            # av test pattern name
+  [qr/.*/ => 1],  # true for everything else
+));
+
+@keep_decoded_original_maps = (new_RE(
+# qr'^MAIL$',   # retain full original message for virus checking (can be slow)
+  qr'^MAIL-UNDECIPHERABLE$', # recheck full mail if it contains undecipherables
+  qr'^(ASCII(?! cpio)|text|uuencoded|xxencoded|binhex)'i,
+# qr'^Zip archive data',     # don't trust Archive::Zip
+));
+
+
+# for $banned_namepath_re, a new-style of banned table, see amavisd.conf-sample
+
+$banned_filename_re = new_RE(
+# qr'^UNDECIPHERABLE$',  # is or contains any undecipherable components
+
+  # block certain double extensions anywhere in the base name
+  qr'\.[^./]*\.(exe|vbs|pif|scr|bat|cmd|com|cpl|dll)\.?$'i,
+
+  qr'\{[0-9a-f]{8}(-[0-9a-f]{4}){3}-[0-9a-f]{12}\}?$'i, # Windows Class ID CLSID, strict
+
+  qr'^application/x-msdownload$'i,                  # block these MIME types
+  qr'^application/x-msdos-program$'i,
+  qr'^application/hta$'i,
+
+# qr'^application/x-msmetafile$'i,	# Windows Metafile MIME type
+# qr'^\.wmf$',				# Windows Metafile file(1) type
+
+# qr'^message/partial$'i, qr'^message/external-body$'i, # rfc2046 MIME types
+
+# [ qr'^\.(Z|gz|bz2)$'           => 0 ],  # allow any in Unix-compressed
+# [ qr'^\.(rpm|cpio|tar)$'       => 0 ],  # allow any in Unix-type archives
+# [ qr'^\.(zip|rar|arc|arj|zoo)$'=> 0 ],  # allow any within such archives
+# [ qr'^application/x-zip-compressed$'i => 0],  # allow any within such archives
+
+  qr'.\.(exe|vbs|pif|scr|bat|cmd|com|cpl)$'i, # banned extension - basic
+# qr'.\.(ade|adp|app|bas|bat|chm|cmd|com|cpl|crt|emf|exe|fxp|grp|hlp|hta|
+#        inf|ins|isp|js|jse|lnk|mda|mdb|mde|mdw|mdt|mdz|msc|msi|msp|mst|
+#        ops|pcd|pif|prg|reg|scr|sct|shb|shs|vb|vbe|vbs|
+#        wmf|wsc|wsf|wsh)$'ix,  # banned ext - long
+
+# qr'.\.(mim|b64|bhx|hqx|xxe|uu|uue)$'i,  # banned extension - WinZip vulnerab.
+
+  qr'^\.(exe-ms)$',                       # banned file(1) types
+# qr'^\.(exe|lha|tnef|cab|dll)$',         # banned file(1) types
+);
+# See http://support.microsoft.com/default.aspx?scid=kb;EN-US;q262631
+# and http://www.cknow.com/vtutor/vtextensions.htm
+
+
+# ENVELOPE SENDER SOFT-WHITELISTING / SOFT-BLACKLISTING
+
+@score_sender_maps = ({ # a by-recipient hash lookup table,
+                        # results from all matching recipient tables are summed
+
+# ## per-recipient personal tables  (NOTE: positive: black, negative: white)
+# 'user1@example.com'  => [{'bla-mobile.press@example.com' => 10.0}],
+# 'user3@example.com'  => [{'.ebay.com'                 => -3.0}],
+# 'user4@example.com'  => [{'cleargreen@cleargreen.com' => -7.0,
+#                           '.cleargreen.com'           => -5.0}],
+
+  ## site-wide opinions about senders (the '.' matches any recipient)
+  '.' => [  # the _first_ matching sender determines the score boost
+
+   new_RE(  # regexp-type lookup table, just happens to be all soft-blacklist
+    [qr'^(bulkmail|offers|cheapbenefits|earnmoney|foryou)@'i         => 5.0],
+    [qr'^(greatcasino|investments|lose_weight_today|market\.alert)@'i=> 5.0],
+    [qr'^(money2you|MyGreenCard|new\.tld\.registry|opt-out|opt-in)@'i=> 5.0],
+    [qr'^(optin|saveonlsmoking2002k|specialoffer|specialoffers)@'i   => 5.0],
+    [qr'^(stockalert|stopsnoring|wantsome|workathome|yesitsfree)@'i  => 5.0],
+    [qr'^(your_friend|greatoffers)@'i                                => 5.0],
+    [qr'^(inkjetplanet|marketopt|MakeMoney)\d*@'i                    => 5.0],
+   ),
+
+#  read_hash("/var/amavis/sender_scores_sitewide"),
+
+# This are some examples for whitelists, since envelope senders can be forged
+# they are not enabled by default. 
+   { # a hash-type lookup table (associative array)
+     #'nobody@cert.org'                        => -3.0,
+     #'cert-advisory@us-cert.gov'              => -3.0,
+     #'owner-alert@iss.net'                    => -3.0,
+     #'slashdot@slashdot.org'                  => -3.0,
+     #'securityfocus.com'                      => -3.0,
+     #'ntbugtraq@listserv.ntbugtraq.com'       => -3.0,
+     #'security-alerts@linuxsecurity.com'      => -3.0,
+     #'mailman-announce-admin@python.org'      => -3.0,
+     #'amavis-user-admin@lists.sourceforge.net'=> -3.0,
+     #'amavis-user-bounces@lists.sourceforge.net' => -3.0,
+     #'spamassassin.apache.org'                => -3.0,
+     #'notification-return@lists.sophos.com'   => -3.0,
+     #'owner-postfix-users@postfix.org'        => -3.0,
+     #'owner-postfix-announce@postfix.org'     => -3.0,
+     #'owner-sendmail-announce@lists.sendmail.org'   => -3.0,
+     #'sendmail-announce-request@lists.sendmail.org' => -3.0,
+     #'donotreply@sendmail.org'                => -3.0,
+     #'ca+envelope@sendmail.org'               => -3.0,
+     #'noreply@freshmeat.net'                  => -3.0,
+     #'owner-technews@postel.acm.org'          => -3.0,
+     #'ietf-123-owner@loki.ietf.org'           => -3.0,
+     #'cvs-commits-list-admin@gnome.org'       => -3.0,
+     #'rt-users-admin@lists.fsck.com'          => -3.0,
+     #'clp-request@comp.nus.edu.sg'            => -3.0,
+     #'surveys-errors@lists.nua.ie'            => -3.0,
+     #'emailnews@genomeweb.com'                => -5.0,
+     #'yahoo-dev-null@yahoo-inc.com'           => -3.0,
+     #'returns.groups.yahoo.com'               => -3.0,
+     #'clusternews@linuxnetworx.com'           => -3.0,
+     #lc('lvs-users-admin@LinuxVirtualServer.org')    => -3.0,
+     #lc('owner-textbreakingnews@CNNIMAIL12.CNN.COM') => -5.0,
+
+     # soft-blacklisting (positive score)
+     #'sender@example.net'                     =>  3.0,
+     #'.example.net'                           =>  1.0,
+
+   },
+  ],  # end of site-wide tables
+});
+
+1;  # ensure a defined return
diff --git a/target/amavis/conf.d/21-ubuntu_defaults b/target/amavis/conf.d/21-ubuntu_defaults
new file mode 100644
index 00000000..e8dc67fe
--- /dev/null
+++ b/target/amavis/conf.d/21-ubuntu_defaults
@@ -0,0 +1,19 @@
+use strict;
+
+#
+# These are Ubuntu specific defaults for amavisd-new configuration
+#
+# DOMAIN KEYS IDENTIFIED MAIL (DKIM)
+$enable_dkim_verification = 1;
+# Don't be verbose about sending mail:
+@whitelist_sender_acl = qw( .$mydomain );
+$final_virus_destiny      = D_DISCARD; # (defaults to D_BOUNCE)
+$final_banned_destiny     = D_DISCARD;  # (defaults to D_BOUNCE)
+$final_spam_destiny       = D_DISCARD;  # (defaults to D_REJECT)
+$final_bad_header_destiny = D_PASS;  # (defaults to D_PASS), D_BOUNCE suggested
+
+$virus_admin = undef;
+$spam_admin = undef;
+
+#------------ Do not modify anything below this line -------------
+1;  # insure a defined return
diff --git a/target/amavis/conf.d/25-amavis_helpers b/target/amavis/conf.d/25-amavis_helpers
new file mode 100644
index 00000000..ef399e41
--- /dev/null
+++ b/target/amavis/conf.d/25-amavis_helpers
@@ -0,0 +1,23 @@
+use strict;
+
+##
+## Functionality required for amavis helpers like
+## amavis-release.
+##
+
+# Enable required AM.PDP protocol socket.
+#
+# this is incompatible with the old helpers, but one can
+# have multiple inet (not unix) sockets to overcome this
+# issue.  Refer to the amavisd-new documentation for more
+# information
+
+$unix_socketname = "/var/lib/amavis/amavisd.sock";
+
+$interface_policy{'SOCK'} = 'AM.PDP-SOCK';
+$policy_bank{'AM.PDP-SOCK'} = {
+  protocol => 'AM.PDP',
+  auth_required_release => 0, # don't require secret-id for release
+};
+
+1;  # ensure a defined return
diff --git a/target/amavis/conf.d/30-template_localization b/target/amavis/conf.d/30-template_localization
new file mode 100644
index 00000000..b808bd71
--- /dev/null
+++ b/target/amavis/conf.d/30-template_localization
@@ -0,0 +1,42 @@
+use strict;
+
+# l10n (localization) of the AMaViSd-new DSN templates
+# Override or change as necessary
+
+# Select notifications text encoding when Unicode-aware Perl is converting
+# text from internal character representation to external encoding (charset
+# in MIME terminology). Used as argument to Perl Encode::encode subroutine.
+#
+#   to be used in RFC 2047-encoded header field bodies, e.g. in Subject:
+#$hdr_encoding = 'iso-8859-1';  # (default: 'iso-8859-1')
+#
+#   to be used in notification body text: its encoding and Content-type.charset
+#$bdy_encoding = 'iso-8859-1';  # (default: 'iso-8859-1')
+
+# Default template texts for notifications may be overruled by directly
+# assigning new text to template variables, or by reading template text
+# from files. A second argument may be specified in a call to read_text(),
+# specifying character encoding layer to be used when reading from the
+# external file, e.g. 'utf8', 'iso-8859-1', or often just $bdy_encoding.
+# Text will be converted to internal character representation by Perl 5.8.0
+# or later; second argument is ignored otherwise. See PerlIO::encoding,
+# Encode::PerlIO and perluniintro man pages.
+#
+# $notify_sender_templ      = read_text('/var/amavis/notify_sender.txt');
+# $notify_virus_sender_templ= read_text('/var/amavis/notify_virus_sender.txt');
+# $notify_virus_admin_templ = read_text('/var/amavis/notify_virus_admin.txt');
+# $notify_virus_recips_templ= read_text('/var/amavis/notify_virus_recips.txt');
+# $notify_spam_sender_templ = read_text('/var/amavis/notify_spam_sender.txt');
+# $notify_spam_admin_templ  = read_text('/var/amavis/notify_spam_admin.txt');
+
+# If notification template files are collectively available in some directory,
+# you can use read_l10n_templates which calls read_text for each known
+# template.  Name the files as above, and include a file named "charset" with
+# the charset used in the files.  This is how Debian ships l10n templates.
+#
+# syntax: read_l10n_templates(<directory>); OR
+#         read_l10n_templates(<subdirectory>, <master directory>);
+#
+read_l10n_templates('en_US', '/etc/amavis');
+
+1;  # ensure a defined return
diff --git a/target/amavis/conf.d/40-policy_banks b/target/amavis/conf.d/40-policy_banks
new file mode 100644
index 00000000..dad8caff
--- /dev/null
+++ b/target/amavis/conf.d/40-policy_banks
@@ -0,0 +1,33 @@
+# DKIM signing domain whitelist. The domain to use is the domain after
+# d= in the DKIM header. 
+
+@author_to_policy_bank_maps = ( {
+  # 'friends.example.net'     => 'WHITELIST,NOBANNEDCHECK',
+  # 'user1@cust.example.net'  => 'WHITELIST,NOBANNEDCHECK',
+    '.ebay.com'               => 'WHITELIST',
+    '.ebay.co.uk'             => 'WHITELIST',
+    'ebay.at'                 => 'WHITELIST',
+    'ebay.ca'                 => 'WHITELIST',
+    'ebay.de'                 => 'WHITELIST',
+    'ebay.fr'                 => 'WHITELIST',
+    '.paypal.co.uk'           => 'WHITELIST',
+    '.paypal.com'             => 'WHITELIST',  # author signatures
+    './@paypal.com'           => 'WHITELIST',  # 3rd-party sign. by paypal.com
+    'alert.bankofamerica.com' => 'WHITELIST',
+    'amazon.com'              => 'WHITELIST',
+    'cisco.com'               => 'WHITELIST',
+    '.cnn.com'                => 'WHITELIST',
+    'skype.net'               => 'WHITELIST',
+    'welcome.skype.com'       => 'WHITELIST',
+    'cc.yahoo-inc.com'        => 'WHITELIST',
+    'cc.yahoo-inc.com/@yahoo-inc.com' => 'WHITELIST',
+  # 'google.com'              => 'MILD_WHITELIST',
+  # 'googlemail.com'          => 'MILD_WHITELIST',
+  # './@googlegroups.com'     => 'MILD_WHITELIST',
+  # './@yahoogroups.com'      => 'MILD_WHITELIST',
+  # './@yahoogroups.co.uk'    => 'MILD_WHITELIST',
+  # './@yahoogroupes.fr'      => 'MILD_WHITELIST',
+  # 'yousendit.com'           => 'MILD_WHITELIST',
+  # 'meetup.com'              => 'MILD_WHITELIST',
+  # 'dailyhoroscope@astrology.com' => 'MILD_WHITELIST',
+  } );
diff --git a/target/amavis/conf.d/50-user b/target/amavis/conf.d/50-user
new file mode 100644
index 00000000..09df670a
--- /dev/null
+++ b/target/amavis/conf.d/50-user
@@ -0,0 +1,14 @@
+use strict;
+
+#
+# Place your configuration directives here.  They will override those in
+# earlier files.
+#
+# See /usr/share/doc/amavisd-new/ for documentation and examples of
+# the directives you can use in this file
+#
+
+# Test Verification
+
+#------------ Do not modify anything below this line -------------
+1;  # ensure a defined return
diff --git a/target/amavis/conf.d/60-dms_default_config b/target/amavis/conf.d/60-dms_default_config
new file mode 100644
index 00000000..e5b71e2f
--- /dev/null
+++ b/target/amavis/conf.d/60-dms_default_config
@@ -0,0 +1,7 @@
+use strict;
+
+@local_domains_maps = (
+   read_hash('/etc/postfix/vhost')
+);
+
+1;  # ensure a defined return
diff --git a/target/amavis/conf.d/65-dms_auto_generated b/target/amavis/conf.d/65-dms_auto_generated
new file mode 100644
index 00000000..8c45e9dc
--- /dev/null
+++ b/target/amavis/conf.d/65-dms_auto_generated
@@ -0,0 +1,3 @@
+# WARNING: this file is auto-generated.
+use strict;
+1;  # ensure a defined return
diff --git a/target/amavis/en_US/charset b/target/amavis/en_US/charset
new file mode 100644
index 00000000..fd23d723
--- /dev/null
+++ b/target/amavis/en_US/charset
@@ -0,0 +1,4 @@
+# This is charset for en_US messages.
+# If you are creating new messages, use 'iconv -l' to get possible encodings.
+ascii   # or iso-8859-1
+ignored lines after first one
diff --git a/target/amavis/en_US/template-auto-response.txt b/target/amavis/en_US/template-auto-response.txt
new file mode 100644
index 00000000..5b50bafe
--- /dev/null
+++ b/target/amavis/en_US/template-auto-response.txt
@@ -0,0 +1,23 @@
+#
+# =============================================================================
+# This is a template for the plain text part of an auto response (e.g.
+# vacation, out-of-office), see RFC 3834.
+#
+From: %f
+Date: %d
+To: [? %#T |undisclosed-recipients:;|[%T|, ]]
+[? %#C |#|Cc: [%C|, ]]
+Reply-To: postmaster@%h
+Message-ID: <ARE%i@%h>
+Auto-Submitted: auto-replied
+[:wrap|76||\t|Subject: Auto: autoresponse to: %s]
+[? %m  |#|In-Reply-To: %m]
+Precedence: junk
+
+This is an auto-response to a message \
+[? %a |\nreceived on %d,|received from\nIP address \[%a\] on %d,]
+envelope sender: %s
+(author)   From: [:rfc2822_from]
+[? %j |#|[:wrap|78||  |Subject: %j]]
+[?[:dkim|author]|#|
+A first-party DKIM or DomainKeys signature is valid, d=[:dkim|author].]
diff --git a/target/amavis/en_US/template-dsn.txt b/target/amavis/en_US/template-dsn.txt
new file mode 100644
index 00000000..561d1631
--- /dev/null
+++ b/target/amavis/en_US/template-dsn.txt
@@ -0,0 +1,134 @@
+#
+# =============================================================================
+# This is a template for (neutral: non-virus, non-spam, non-banned)
+# DELIVERY STATUS NOTIFICATIONS to sender.
+# For syntax and customization instructions see README.customize.
+# The From, To and Date header fields will be provided automatically.
+# Long header fields will be automatically wrapped by the program.
+#
+Subject: [?%#D|Undeliverable mail|Delivery status notification]\
+[? [:ccat|major] |||, MTA-BLOCKED\
+|, OVERSIZED message\
+|, invalid header section[=explain_badh|1]\
+[?[:ccat|minor]||: bad MIME|: unencoded 8-bit character\
+|: improper use of control char|: all-whitespace header line\
+|: header line longer than 998 characters|: header field syntax error\
+|: missing required header field|: duplicate header field|]\
+|, UNSOLICITED BULK EMAIL apparently from you\
+|, UNSOLICITED BULK EMAIL apparently from you\
+|, contents UNCHECKED\
+|, BANNED contents type (%F)\
+|, VIRUS in message apparently from you (%V)\
+]
+Message-ID: <DSN%i@%h>
+
+[? %#D |#|Your message WAS SUCCESSFULLY RELAYED to:[\n  %D]
+[~[:dsn_notify]|["\\bSUCCESS\\b"]|\
+and you explicitly requested a delivery status notification on success.\n]\
+]
+[? %#N |#|The message WAS NOT relayed to:[\n  %N]
+]
+[:wrap|78|||This [?%#D|nondelivery|delivery] report was \
+generated by the program amavisd-new at host %h. \
+Our internal reference code for your message is %n/%i]
+
+# ccat_min 0: other,  1: bad MIME,  2: 8-bit char,  3: NUL/CR,
+#          4: empty,  5: long,  6: syntax,  7: missing,  8: multiple
+[? [:explain_badh] ||[? [:ccat|minor]
+|INVALID HEADER
+|INVALID HEADER: BAD MIME HEADER SECTION OR BAD MIME STRUCTURE
+|INVALID HEADER: INVALID 8-BIT CHARACTERS IN HEADER SECTION
+|INVALID HEADER: INVALID CONTROL CHARACTERS IN HEADER SECTION
+|INVALID HEADER: FOLDED HEADER FIELD LINE MADE UP ENTIRELY OF WHITESPACE
+|INVALID HEADER: HEADER LINE LONGER THAN RFC 5322 LIMIT OF 998 CHARACTERS
+|INVALID HEADER: HEADER FIELD SYNTAX ERROR
+|INVALID HEADER: MISSING REQUIRED HEADER FIELD
+|INVALID HEADER: DUPLICATE HEADER FIELD
+|INVALID HEADER
+]
+[[:wrap|78|  |  |%X]\n]
+]\
+#
+[:wrap|78||  |Return-Path: %s[?[:dkim|envsender]|| (OK)]]
+[:wrap|78||  |From: [:header_field|From|100][?[:dkim|author]|| (dkim:AUTHOR)]]
+[? [:header_field|Sender]|#|\
+[:wrap|78||  |Sender: [:header_field|Sender|100]\
+[?[:dkim|sender]|| (dkim:SENDER)]]]
+[? %m |#|[:wrap|78||  |Message-ID: %m]]
+[? %r |#|[:wrap|78||  |Resent-Message-ID: %r]]
+[? %#X|#|[? [:useragent] |#|[:wrap|78||  |[:useragent]]]]
+[? %j |#|[:wrap|78||  |Subject: [:header_field|Subject|100]]]
+
+# ccat_min 0: other,  1: bad MIME,  2: 8-bit char,  3: NUL/CR,
+#          4: empty,  5: long,  6: syntax,  7: missing,  8: multiple
+[? [:explain_badh] ||[? [:ccat|minor]
+|# 0: other
+|# 1: bad MIME
+|# 2: 8-bit char
+WHAT IS AN INVALID CHARACTER IN A MAIL HEADER SECTION?
+
+  The RFC 5322 document specifies rules for forming internet messages.
+  It does not allow the use of characters with codes above 127 to be
+  used directly (non-encoded) in a mail header section.
+
+  If such characters (e.g. with diacritics) from ISO Latin or other
+  alphabets need to be included in a header section, these characters
+  need to be properly encoded according to RFC 2047. Such encoding
+  is often done transparently by mail reader (MUA), but if automatic
+  encoding is not available (e.g. by some older MUA) it is a user's
+  responsibility to avoid using such characters in a header section,
+  or to encode them manually. Typically the offending header fields
+  in this category are 'Subject', 'Organization', and comment fields
+  or display names in e-mail addresses of 'From', 'To' or 'Cc'.
+
+  Sometimes such invalid header fields are inserted automatically
+  by some MUA, MTA, content filter, or other mail handling service.
+  If this is the case, such service needs to be fixed or properly
+  configured. Typically the offending header fields in this category
+  are 'Date', 'Received', 'X-Mailer', 'X-Priority', 'X-Scanned', etc.
+
+  If you don't know how to fix or avoid the problem, please report it
+  to _your_ postmaster or system manager.
+#
+[~[:useragent]|^X-Mailer:\\s*Microsoft Outlook Express 6\\.00|["
+  If using Microsoft Outlook Express as your MUA, make sure its
+  settings under:
+     Tools -> Options -> Send -> Mail Sending Format -> Plain & HTML
+  are: "MIME format" MUST BE selected,
+  and  "Allow 8-bit characters in headers" MUST NOT be enabled!
+"]]#
+|# 3: NUL/CR
+IMPROPER USE OF CONTROL CHARACTER IN A MESSAGE HEADER SECTION
+
+  The RFC 5322 document specifies rules for forming internet messages.
+  It does not allow the use of control characters NUL and bare CR
+  to be used directly in a mail header section.
+|# 4: empty
+IMPROPERLY FOLDED HEADER FIELD LINE MADE UP ENTIRELY OF WHITESPACE
+
+  The RFC 5322 document specifies rules for forming internet messages.
+  In section '3.2.2. Folding white space and comments' it explicitly
+  prohibits folding of header fields in such a way that any line of a
+  folded header field is made up entirely of white-space characters
+  (control characters SP and HTAB) and nothing else.
+|# 5: long
+HEADER LINE LONGER THAN RFC 5322 LIMIT OF 998 CHARACTERS
+
+  The RFC 5322 document specifies rules for forming internet messages.
+  Section '2.1.1. Line Length Limits' prohibits each line of a header
+  section to be more than 998 characters in length (excluding the CRLF).
+|# 6: syntax
+|# 7: missing
+MISSING REQUIRED HEADER FIELD
+
+  The RFC 5322 document specifies rules for forming internet messages.
+  Section '3.6. Field Definitions' specifies that certain header fields
+  are required (origination date field and the "From:" originator field).
+|# 8: multiple
+DUPLICATE HEADER FIELD
+
+  The RFC 5322 document specifies rules for forming internet messages.
+  Section '3.6. Field Definitions' specifies that certain header fields
+  must not occur more than once in a message header section.
+|# other
+]]#
diff --git a/target/amavis/en_US/template-problem-feedback.txt b/target/amavis/en_US/template-problem-feedback.txt
new file mode 100644
index 00000000..2f6b14e3
--- /dev/null
+++ b/target/amavis/en_US/template-problem-feedback.txt
@@ -0,0 +1,37 @@
+#
+# =============================================================================
+# This is a template for the plain text part of a problem/feedback report,
+# with either the original message included in-line, or attached,
+# or the message is structured as a FEEDBACK REPORT NOTIFICATIONS format.
+# See RFC 5965 - "An Extensible Format for Email Feedback Reports".
+#
+From: %f
+Date: %d
+Subject: Fw: %j
+To: [? %#T |undisclosed-recipients:;|[%T|, ]]
+[? %#C |#|Cc: [%C|, ]]
+Message-ID: <ARF%i@%h>
+#Auto-Submitted: auto-generated
+
+This is an e-mail [:feedback_type] report for a message \
+[? %a |\nreceived on %d,|received from\nIP address [:client_addr_port] on %d,]
+
+[:wrap|78||  |Return-Path: %s]
+[:wrap|78||  |From: [:header_field|From][?[:dkim|author]|| (dkim:AUTHOR)]]
+[? [:header_field|Sender]|#|[:wrap|78||  |Sender: [:header_field|Sender]]]
+[? %m |#|[:wrap|78||  |Message-ID: %m]]
+[? %r |#|[:wrap|78||  |Resent-Message-ID: %r]]
+[? %j |#|[:wrap|78||  |Subject: [:header_field|Subject|100]]]
+[?[:dkim|author]|#|
+A first-party DKIM or DomainKeys signature is valid, d=[:dkim|author].]
+
+Reporting-MTA: %h
+Our internal reference code for the message is %n/%i
+
+[~[:report_format]|["^(arf|attach|dsn)$"]|["\
+A complete original message is attached.
+[~[:report_format]|["^arf$"]|\
+For more information on the ARF format please see RFC 5965.
+]"]|["\
+A complete original message in its pristine form follows:
+"]]#
diff --git a/target/amavis/en_US/template-release-quarantine.txt b/target/amavis/en_US/template-release-quarantine.txt
new file mode 100644
index 00000000..affd42e4
--- /dev/null
+++ b/target/amavis/en_US/template-release-quarantine.txt
@@ -0,0 +1,45 @@
+#
+# =============================================================================
+# This is a template for the plain text part of a RELEASE FROM A QUARANTINE,
+# applicable if a chosen release format is 'attach' (not 'resend').
+#
+From: %f
+Date: %d
+Subject: \[released message\] %j
+To: [? %#T |undisclosed-recipients:;|[%T|, ]]
+[? %#C |#|Cc: [%C|, ]]
+Message-ID: <QRA%i@%h>
+
+Please find attached a message which was held in a quarantine,
+and has now been released.
+
+[:wrap|78||  |Return-Path: %s[?[:dkim|envsender]|| (OK)]]
+[:wrap|78||  |From: [:header_field|From][?[:dkim|author]|| (dkim:AUTHOR)]]
+[? [:header_field|Sender]|#|\
+[:wrap|78||  |Sender: [:header_field|Sender]\
+[?[:dkim|sender]|| (dkim:SENDER)]]]
+# [? %m |#|[:wrap|78||  |Message-ID: %m]]
+# [? %r |#|[:wrap|78||  |Resent-Message-ID: %r]]
+# [? [:useragent] |#|[:wrap|78||  |[:useragent]]]
+[? %j |#|[:wrap|78||  |Subject: %j]]
+
+Our internal reference code for the message is %n/%i
+#
+[~[:report_format]|["^attach$"]|["[? [:attachment_password] |#|
+
+Contents of the attached mail message may pose a threat to your computer or
+could be a social engineering deception, so it should be handled cautiously.
+To prevent undesired automatic opening, the attached original mail message
+has been wrapped in a password-protected ZIP archive.
+
+Here is the password that allows opening of the attached archive:
+
+  [:attachment_password]
+
+Note that the attachment is not strongly encrypted and the password
+is not a strong secret (being displayed in this non-encrypted text),
+so this attachment is not suitable for guarding a secret contents.
+The sole purpose of this password protection it to prevent undesired
+accidental or automatic opening of a message, either by some filtering
+software, a virus scanner, or by a mail reader.
+]"]|]#
diff --git a/target/amavis/en_US/template-spam-admin.txt b/target/amavis/en_US/template-spam-admin.txt
new file mode 100644
index 00000000..317acc33
--- /dev/null
+++ b/target/amavis/en_US/template-spam-admin.txt
@@ -0,0 +1,39 @@
+#
+# =============================================================================
+# This is a template for spam ADMINISTRATOR NOTIFICATIONS.
+# For syntax and customization instructions see README.customize.
+# Long header fields will be automatically wrapped by the program.
+#
+From: %f
+Date: %d
+Subject: Spam FROM [?%l||LOCAL ][?%a||[:client_addr_port] ]%s
+To: [? %#T |undisclosed-recipients:;|[%T|, ]]
+[? %#C |#|Cc: [%C|, ]]
+Message-ID: <SA%i@%h>
+
+Content type: [:ccat|name|main]#
+[? [:ccat|is_blocked_by_nonmain] ||, blocked for [:ccat|name]]
+Internal reference code for the message is %n/%i
+
+[? %a |#|[:wrap|78||  |First upstream SMTP client IP address: \[%a\] %g]]
+[? %e |#|[:wrap|78||  |According to a 'Received:' trace,\
+ the message apparently originated at: \[%e\], %t]]
+
+[:wrap|78||  |Return-Path: %s[?[:dkim|envsender]|| (OK)]]
+[:wrap|78||  |From: [:header_field|From][?[:dkim|author]|| (dkim:AUTHOR)]]
+[? [:header_field|Sender]|#|\
+[:wrap|78||  |Sender: [:header_field|Sender]\
+[?[:dkim|sender]|| (dkim:SENDER)]]]
+[? %m |#|[:wrap|78||  |Message-ID: %m]]
+[? %r |#|[:wrap|78||  |Resent-Message-ID: %r]]
+[? [:useragent] |#|[:wrap|78||  |[:useragent]]]
+[? %j |#|[:wrap|78||  |Subject: %j]]
+[? %q |Not quarantined.|The message has been quarantined as: %q]
+
+[? %#D |#|The message WILL BE relayed to:[\n%D]
+]
+[? %#N |#|The message WAS NOT relayed to:[\n%N]
+]
+Spam scanner report:
+[%A
+]\
diff --git a/target/amavis/en_US/template-spam-sender.txt b/target/amavis/en_US/template-spam-sender.txt
new file mode 100644
index 00000000..5d91afee
--- /dev/null
+++ b/target/amavis/en_US/template-spam-sender.txt
@@ -0,0 +1,48 @@
+#
+# =============================================================================
+# This is a template for spam SENDER NOTIFICATIONS.
+# For syntax and customization instructions see README.customize.
+# The From, To and Date header fields will be provided automatically.
+# Long header fields will be automatically wrapped by the program.
+#
+Subject: Considered UNSOLICITED BULK EMAIL, apparently from you
+[? %m  |#|In-Reply-To: %m]
+Message-ID: <SS%i@%h>
+
+A message from %s[
+to: %R]
+
+was considered unsolicited bulk e-mail (UBE).
+
+Our internal reference code for your message is %n/%i
+
+The message carried your return address, so it was either a genuine mail
+from you, or a sender address was faked and your e-mail address abused
+by third party, in which case we apologize for undesired notification.
+
+We do try to minimize backscatter for more prominent cases of UBE and
+for infected mail, but for less obvious cases some balance between
+losing genuine mail and sending undesired backscatter is sought,
+and there can be some collateral damage on either side.
+
+[? %a |#|[:wrap|78||  |First upstream SMTP client IP address: \[%a\] %g]]
+[? %e |#|[:wrap|78||  |According to a 'Received:' trace,\
+ the message apparently originated at: \[%e\], %t]]
+
+[:wrap|78||  |Return-Path: %s[?[:dkim|envsender]|| (OK)]]
+[:wrap|78||  |From: [:header_field|From|100][?[:dkim|author]|| (dkim:AUTHOR)]]
+[? [:header_field|Sender]|#|\
+[:wrap|78||  |Sender: [:header_field|Sender|100]\
+[?[:dkim|sender]|| (dkim:SENDER)]]]
+[? %m |#|[:wrap|78||  |Message-ID: %m]]
+[? %r |#|[:wrap|78||  |Resent-Message-ID: %r]]
+# [? [:useragent] |#|[:wrap|78||  |[:useragent]]]
+[? %j |#|[:wrap|78||  |Subject: [:header_field|Subject|100]]]
+[? %#X |#|\n[[:wrap|78||  |%X]\n]]
+
+[? %#D |Delivery of the email was stopped!
+]#
+#
+# Spam scanner report:
+# [%A
+# ]\
diff --git a/target/amavis/en_US/template-virus-admin.txt b/target/amavis/en_US/template-virus-admin.txt
new file mode 100644
index 00000000..559b6d05
--- /dev/null
+++ b/target/amavis/en_US/template-virus-admin.txt
@@ -0,0 +1,54 @@
+#
+# =============================================================================
+# This is a template for non-spam (e.g. VIRUS,...) ADMINISTRATOR NOTIFICATIONS.
+# For syntax and customization instructions see README.customize.
+# Long header fields will be automatically wrapped by the program.
+#
+From: %f
+Date: %d
+Subject: [? [:ccat|major] |Clean mail|Clean mail|MTA-blocked mail|\
+OVERSIZED mail|INVALID HEADER in mail|Spammy|Spam|UNCHECKED contents in mail|\
+BANNED contents (%F) in mail|VIRUS (%V) in mail]\
+ FROM [?%l||LOCAL ][?%a||[:client_addr_port] ]%s
+To: [? %#T |undisclosed-recipients:;|[%T|, ]]
+[? %#C |#|Cc: [%C|, ]]
+Message-ID: <VA%i@%h>
+
+[? %#V |No viruses were found.
+|A virus was found: %V
+|Two viruses were found:\n  %V
+|%#V viruses were found:\n  %V
+]
+[? %#F |#|[:wrap|78||  |Banned [?%#F|names|name|names]: %F]]
+[? %#X |#|Bad header:[\n[:wrap|78|  |  |%X]]]
+[? %#W |#\
+|Scanner detecting a virus: %W
+|Scanners detecting a virus: %W
+]
+Content type: [:ccat|name|main]#
+[? [:ccat|is_blocked_by_nonmain] ||, blocked for [:ccat|name]]
+Internal reference code for the message is %n/%i
+
+[? %a |#|[:wrap|78||  |First upstream SMTP client IP address: \[%a\] %g]]
+[? %e |#|[:wrap|78||  |According to a 'Received:' trace,\
+ the message apparently originated at: \[%e\], %t]]
+
+[:wrap|78||  |Return-Path: %s[?[:dkim|envsender]|| (OK)]]
+[:wrap|78||  |From: [:header_field|From][?[:dkim|author]|| (dkim:AUTHOR)]]
+[? [:header_field|Sender]|#|\
+[:wrap|78||  |Sender: [:header_field|Sender]\
+[?[:dkim|sender]|| (dkim:SENDER)]]]
+[? %m |#|[:wrap|78||  |Message-ID: %m]]
+[? %r |#|[:wrap|78||  |Resent-Message-ID: %r]]
+[? %j |#|[:wrap|78||  |Subject: %j]]
+[? %q |Not quarantined.|The message has been quarantined as: %q]
+
+[? %#S |Notification to sender will not be mailed.
+
+]#
+[? %#D |#|The message WILL BE relayed to:[\n%D]
+]
+[? %#N |#|The message WAS NOT relayed to:[\n%N]
+]
+[? %#V |#|[? %#v |#|Virus scanner output:[\n  %v]
+]]
diff --git a/target/amavis/en_US/template-virus-recipient.txt b/target/amavis/en_US/template-virus-recipient.txt
new file mode 100644
index 00000000..f8e579a8
--- /dev/null
+++ b/target/amavis/en_US/template-virus-recipient.txt
@@ -0,0 +1,46 @@
+#
+# =============================================================================
+# This is a template for VIRUS/BANNED/BAD-HEADER RECIPIENTS NOTIFICATIONS.
+# For syntax and customization instructions see README.customize.
+# Long header fields will be automatically wrapped by the program.
+#
+From: %f
+Date: %d
+Subject: [? [:ccat|major] |Clean mail|Clean mail|MTA-blocked mail|\
+OVERSIZED mail|INVALID HEADER in mail|Spammy|Spam|UNCHECKED contents in mail|\
+BANNED contents (%F) in mail|VIRUS (%V) in mail] TO YOU from %s
+[? [:header_field|To] |To: undisclosed-recipients:;|To: [:header_field|To]]
+[? [:header_field|Cc] |#|Cc: [:header_field|Cc]]
+Message-ID: <VR%i@%h>
+
+[? %#V |[? %#F ||BANNED CONTENTS ALERT]|VIRUS ALERT]
+
+Our content checker found
+[? %#V |#|[:wrap|78|    |  |[?%#V|viruses|virus|viruses]: %V]]
+[? %#F |#|[:wrap|78|    |  |banned [?%#F|names|name|names]: %F]]
+[? %#X |#|[[:wrap|78|    |  |%X]\n]]
+
+in an email to you [? %#V |from:|from probably faked sender:]
+  %o
+[? %#V |#|claiming to be: %s]
+
+Content type: [:ccat|name|main]#
+[? [:ccat|is_blocked_by_nonmain] ||, blocked for [:ccat|name]]
+Our internal reference code for your message is %n/%i
+
+[? %a |#|[:wrap|78||  |First upstream SMTP client IP address: \[%a\] %g]]
+[? %e |#|[:wrap|78||  |According to a 'Received:' trace,\
+ the message apparently originated at: \[%e\], %t]]
+
+[:wrap|78||  |Return-Path: %s[?[:dkim|envsender]|| (OK)]]
+[:wrap|78||  |From: [:header_field|From][?[:dkim|author]|| (dkim:AUTHOR)]]
+[? [:header_field|Sender]|#|\
+[:wrap|78||  |Sender: [:header_field|Sender]\
+[?[:dkim|sender]|| (dkim:SENDER)]]]
+[? %m |#|[:wrap|78||  |Message-ID: %m]]
+[? %r |#|[:wrap|78||  |Resent-Message-ID: %r]]
+[? [:useragent] |#|[:wrap|78||  |[:useragent]]]
+[? %j |#|[:wrap|78||  |Subject: %j]]
+[? %q |Not quarantined.|The message has been quarantined as: %q]
+
+Please contact your system administrator for details.
diff --git a/target/amavis/en_US/template-virus-sender.txt b/target/amavis/en_US/template-virus-sender.txt
new file mode 100644
index 00000000..5f254c8d
--- /dev/null
+++ b/target/amavis/en_US/template-virus-sender.txt
@@ -0,0 +1,91 @@
+#
+# =============================================================================
+# This is a template for VIRUS/BANNED SENDER NOTIFICATIONS.
+# For syntax and customization instructions see README.customize.
+# The From, To and Date header fields will be provided automatically.
+# Long header fields will be automatically wrapped by the program.
+#
+Subject: [? [:ccat|major]
+|Clean message from you\
+|Clean message from you\
+|Clean message from you (MTA blocked)\
+|OVERSIZED message from you\
+|BAD-HEADER in message from you\
+|Spam claiming to be from you\
+|Spam claiming to be from you\
+|A message with UNCHECKED contents from you\
+|BANNED contents from you (%F)\
+|VIRUS in message apparently from you (%V)\
+]
+[? %m  |#|In-Reply-To: %m]
+Message-ID: <VS%i@%h>
+
+[? [:ccat|major] |Clean|Clean|MTA-BLOCKED|OVERSIZED|INVALID HEADER|\
+Spammy|Spam|UNCHECKED contents|BANNED CONTENTS ALERT|VIRUS ALERT]
+
+Our content checker found
+[? %#V |#|[:wrap|78|    |  |[? %#V |viruses|virus|viruses]: %V]]
+[? %#F |#|[:wrap|78|    |  |banned [? %#F |names|name|names]: %F]]
+[? %#X |#|[[:wrap|78|    |  |%X]\n]]
+
+in email presumably from you %s
+to the following [? %#R |recipients|recipient|recipients]:[
+-> %R]
+
+Our internal reference code for your message is %n/%i
+
+[? %a |#|[:wrap|78||  |First upstream SMTP client IP address: \[%a\] %g]]
+[? %e |#|[:wrap|78||  |According to a 'Received:' trace,\
+ the message apparently originated at: \[%e\], %t]]
+
+[:wrap|78||  |Return-Path: %s[?[:dkim|envsender]|| (OK)]]
+[:wrap|78||  |From: [:header_field|From|100][?[:dkim|author]|| (dkim:AUTHOR)]]
+[? [:header_field|Sender]|#|\
+[:wrap|78||  |Sender: [:header_field|Sender|100]\
+[?[:dkim|sender]|| (dkim:SENDER)]]]
+[? %m |#|[:wrap|78||  |Message-ID: %m]]
+[? %r |#|[:wrap|78||  |Resent-Message-ID: %r]]
+[? %j |#|[:wrap|78||  |Subject: [:header_field|Subject|100]]]
+
+[? %#D |Delivery of the email was stopped!
+
+]#
+[? %#V ||Please check your system for viruses,
+or ask your system administrator to do so.
+
+]#
+[? %#V |[? %#F ||#
+The message [?%#D|has been blocked|triggered this warning] because it contains a component
+(as a MIME part or nested within) with declared name
+or MIME type or contents type violating our access policy.
+
+To transfer contents that may be considered risky or unwanted
+by site policies, or simply too large for mailing, please consider
+publishing your content on the web, and only sending an URL of the
+document to the recipient.
+
+Depending on the recipient and sender site policies, with a little
+effort it might still be possible to send any contents (including
+viruses) using one of the following methods:
+
+- encrypted using pgp, gpg or other encryption methods;
+
+- wrapped in a password-protected or scrambled container or archive
+  (e.g.: zip -e, arj -g, arc g, rar -p, or other methods)
+
+Note that if the contents is not intended to be secret, the
+encryption key or password may be included in the same message
+for recipient's convenience.
+
+We are sorry for inconvenience if the contents was not malicious.
+
+The purpose of these restrictions is to cut the most common propagation
+methods used by viruses and other malware. These often exploit automatic
+mechanisms and security holes in more popular mail readers (Microsoft
+mail readers and browsers are a common target). By requiring an explicit
+and decisive action from the recipient to decode mail, the danger of
+automatic malware propagation is largely reduced.
+#
+# Details of our mail restrictions policy are available at ...
+
+]]#
diff --git a/test/email-templates/existing-user.txt b/test/email-templates/existing-user1.txt
similarity index 100%
rename from test/email-templates/existing-user.txt
rename to test/email-templates/existing-user1.txt
diff --git a/test/email-templates/existing-user2.txt b/test/email-templates/existing-user2.txt
new file mode 100644
index 00000000..eb75c7fe
--- /dev/null
+++ b/test/email-templates/existing-user2.txt
@@ -0,0 +1,12 @@
+HELO mail.external.tld
+MAIL FROM: user@external.tld
+RCPT TO: user2@otherdomain.tld
+DATA
+From: Docker Mail Server <dockermailserver@external.tld>
+To: Existing Local User <user2@otherdomain.tld>
+Date: Sat, 22 May 2010 07:43:25 -0400
+Subject: Test Message
+This is a test mail.
+
+.
+QUIT
diff --git a/test/tests.bats b/test/tests.bats
index df632df8..938a8cac 100644
--- a/test/tests.bats
+++ b/test/tests.bats
@@ -406,7 +406,7 @@ load 'test_helper/bats-assert/load'
 }
 
 @test "checking spamassassin: docker env variables are set correctly (custom)" {
-  run docker exec mail /bin/sh -c "grep '\$sa_tag_level_deflt' /etc/amavis/conf.d/20-debian_defaults | grep '= 1.0'"
+  run docker exec mail /bin/sh -c "grep '\$sa_tag_level_deflt' /etc/amavis/conf.d/20-debian_defaults | grep '= -5.0'"
   assert_success
   run docker exec mail /bin/sh -c "grep '\$sa_tag2_level_deflt' /etc/amavis/conf.d/20-debian_defaults | grep '= 2.0'"
   assert_success
@@ -414,6 +414,14 @@ load 'test_helper/bats-assert/load'
   assert_success
 }
 
+@test "checking spamassassin: all registered domains should see spam headers" {
+  run docker exec mail /bin/sh -c "grep -ir 'X-Spam-' /var/mail/localhost.localdomain/user1/new"
+  assert_success
+  run docker exec mail /bin/sh -c "grep -ir 'X-Spam-' /var/mail/otherdomain.tld/user2/new"
+  assert_success
+}
+
+
 #
 # clamav
 #