I spoke to some very helpful folks on the MailScanner list (especially Drew) and they sorted me out. I thought I would share in case others run into this problem. First, MailScanner apparently occurs AFTER the postfix virtual mapping takes place... so you have to use the /etc/postfix/aliases vs /etc/postfix/virtual_alias. Next problem: I had to get /etc/postfix/aliases working together with the /etc/postfix/virtual_alias table. After banging my head on the wall for about a day, the answer was embarrassingly simple. You can't have the same domain in the main.cf variable 'mydestination =' (sends domains in this list to /etc/postfix/aliases) and 'virtual_alias_domains =' (sends these domains to the /etc/postfix/virtual_alias table). So, I did this to create a "fake" subdomain of sample1.com: /etc/MailScanner/MailScanner.conf Spam Actions = store forward spam@xxxxxxxxxxxxxxxxxxxxx High Scoring Spam Actions = store forward spam@xxxxxxxxxxxxxxxxxxxxx /etc/postfix/main.cf myhostname = svr.sample1.com mydomain = sample1.com mydestination = $myhostname, localhost.$mydomain virtual_alias_domains = sample1.com, sample2.org /etc/postfix/virtual_alias joe@xxxxxxxxxxx joeb@localhost joe@xxxxxxxxxxx joeb@localhost bob@xxxxxxxxxxx bob@localhost @sample2.org frank@localhost group1@xxxxxxxxxxx joeb@localhost, bob@localhost, bob@localhost ... /etc/postfix/alias # Deliver spam to local 'spam' shell account spam@xxxxxxxxxxxxxxxxxxxxx: spam The trick was using spam@xxxxxxxxxxxxxxxxxxxxx in both MailScanner.conf AND /etc/postfix/alias (along with having this subdomain of sample1.com listed in mydestination of postfix). These 3 items together allowed local delivery without the virtual_alias stuff getting in the way. MailScanner was now happy and the spam forward worked. Let me know if folks see a better way of doing this. Kennedy