I've managed to get this working on FreeBSD 4.11 and Plesk 7.5: HOWTO - FreeBSD 4.4 + Plesk + qmail-qfilter to log ALL e-mail What I'm trying to do is find who is sending out spam. For those whe don't know, qmail does not log the IP of incoming mail so there is no way to find out who is sending mail. The above link is instructions on how to capture ALL incoming and outgoing mail (entire email not just record of it like in a log). What I'd like to do is slim it down a bit and just capture some of the header info and record if it's incoming mail or outgoing mail. However, the only way I see to tell if the message is incoming or outgoing is to check for more than one Received: line. Is there a better way?