Our mail server was recently blacklisted because a web server was infected with a spamming virus. We discovered and blocked the guilty sender only after we started inspecting the message bodies of mails we found suspicious. Luckily there was a few of them stuck in the message queue.
But my concern is; what if the blacklisting happens during a weekend or vacation, or for some other reason we don't notice it immediately. The evidence could be gone from the mail queue.
To that end, it would be nice if Postfix could be instructed to keep mails locally for a few days after they have been sent. Is that possible?
I realize it's probably unlikely that there is no evidence to be found in the mail queue, but I'd rather be safe than sorry.
