Send spam mail to a special folder using postfix

Cursory perusal of postfix's local(8) local delivery agent man page shows no hint of this type of capability - as expected. This kind of tasks is usually offloaded to procmail (probably through the mailbox_command directive) which can handle the task you describe while managing your kitchen sink on the side. The downside of procmail is the config file format, the upside the flexibility and the tons of examples that are easily found. If anything better than procmail has recently emerged, I know not.

For my money, though, even if I found the way to shoehorn the MTA in doing what you want, I would not follow that road, because this kind of mail sorting things have a way of balooning and no MTA (that I know of: perhaps exchange does,who knows) can do a good job in also being a flexible message handler/delivery agent.

This is a procmail recipe that woud do what you want based on the sole header content (where DEFAULT is the delivery directory, often something like $HOME/Mail/):

:0
* ^X-Spam-Flag: YES
$DEFAULT/.Spam/

Edit: (This assumes maildir mailbox format, as noted in a comment below. Omit final slash if using mbox)

As Alien Life Form said, this is a job for procmail. That's not a replacement for the mail server's local delivery agent; it's a separate process which will be called after the MDA has done it's work.

Each user that wants to have procmail sort their mail will need to create a file called .forward in their home directory. That file should contain the following:

"|exec /usr/local/bin/procmail || exit 75"

complete with the " sign and all.

ALF has already posted a basic .procmail file that will sort the mail tagged with spam into a separate folder.

What is your mail delivery agent (see main.cf mailbox_command)? If the MDA is dovecot, it supports the Sieve IETF standard (rfc5228), which can do a lot more than procmail without exposing possible security holes. DON'T bolt on procmail to postfix/dovecot, sieve is fully integrated. If you're using Courier, then procmail is an okay solution. However, you will find the sieve/sievec programs from Pigeonhole to be faster and cleaner.

The following is a simple sieve script to recognize your spam header and put the message in the Trash file.

require "fileinto";

if header :comparator "i;ascii-casemap" :contains "Subject" "**SPAM**"  
{
  fileinto "Trash";
  stop;
}