I spoke to some very helpful folks on the MailScanner list (especially Drew) and they sorted me out. I thought I would share in case others run into this problem. First, MailScanner apparently occurs AFTER the postfix virtual mapping takes place... so you have to use the /etc/postfix/aliases vs /etc/postfix/virtual_alias. Next problem: I had to get /etc/postfix/aliases working together with the /etc/postfix/virtual_alias table. After banging my head on the wall for about a day, the answer was embarrassingly simple. You can't have the same domain in the main.cf variable 'mydestination =' (sends domains in this list to /etc/postfix/aliases) and 'virtual_alias_domains =' (sends these domains to the /etc/postfix/virtual_alias table). So, I did this to create a "fake" subdomain of sample1.com: /etc/MailScanner/MailScanner.conf Spam Actions = store forward spam at localhost.sample1.com High Scoring Spam Actions = store forward spam at localhost.sample1.com /etc/postfix/main.cf myhostname = svr.sample1.com mydomain = sample1.com mydestination = $myhostname, localhost.$mydomain virtual_alias_domains = sample1.com, sample2.org /etc/postfix/virtual_alias joe at sample1.com joeb at localhost joe at sample2.org joeb at localhost bob at sample1.com bob at localhost @sample2.org frank at localhost group1 at sample1.com joeb at localhost, bob at localhost, bob at localhost ... /etc/postfix/alias # Deliver spam to local 'spam' shell account spam at localhost.sample1.com: spam The trick was using spam at LOCALHOST.sample1.com in both MailScanner.conf AND /etc/postfix/alias (along with having this subdomain of sample1.com listed in mydestination of postfix). These 3 items together allowed local delivery without the virtual_alias stuff getting in the way. MailScanner was now happy and the spam forward worked. Let me know if folks see a better way of doing this. Kennedy