global queue_name

13 files changed, 156 insertions, 129 deletions

diff --git a/src/exim_monitor/em_globals.c b/src/exim_monitor/em_globals.c
index 6415e4238..9221ae2da 100644
--- a/src/exim_monitor/em_globals.c
+++ b/src/exim_monitor/em_globals.c
@@ -187,6 +187,8 @@ uid_t   originator_uid;
 
 uschar *primary_hostname       = NULL;
 
+uschar *queue_name             = US"";
+
 int     received_count         = 0;
 uschar *received_protocol      = NULL;
 int     received_time          = 0;
diff --git a/src/exim_monitor/em_menu.c b/src/exim_monitor/em_menu.c
index 51a952e99..ccdfa05ba 100644
--- a/src/exim_monitor/em_menu.c
+++ b/src/exim_monitor/em_menu.c
@@ -148,10 +148,10 @@ call_data = call_data;
 for (i = 0; i < (spool_is_split? 2:1); i++)
   {
   message_subdir[0] = (i != 0)? ((uschar *)client_data)[5] : 0;
-  sprintf(CS buffer, "%s/msglog/%s/%s", spool_directory, message_subdir,
-    (uschar *)client_data);
-  f = fopen(CS buffer, "r");
-  if (f != NULL) break;
+  snprintf(CS buffer, sizeof(buffer), "%s/msglog/%s/%s/%s",
+    spool_directory, queue_name, message_subdir, (uschar *)client_data);
+  if ((f = fopen(CS buffer, "r")))
+    break;
   }
 
 if (f == NULL)
@@ -181,11 +181,11 @@ call_data = call_data;
 
 for (i = 0; i < (spool_is_split? 2:1); i++)
   {
-  message_subdir[0] = (i != 0)? ((uschar *)client_data)[5] : 0;
-  sprintf(CS buffer, "%s/input/%s/%s-D", spool_directory, message_subdir,
-    (uschar *)client_data);
-  f = fopen(CS buffer, "r");
-  if (f != NULL) break;
+  message_subdir[0] = i != 0 ? ((uschar *)client_data)[5] : 0;
+  snprintf(CS buffer, sizeof(buffer), "%s/input/%s/%s/%s-D",
+    spool_directory, queue_name, message_subdir, (uschar *)client_data);
+  if ((f = fopen(CS buffer, "r")))
+    break;
   }
 
 if (f == NULL)
diff --git a/src/exim_monitor/em_queue.c b/src/exim_monitor/em_queue.c
index c01a80fe0..893e43898 100644
--- a/src/exim_monitor/em_queue.c
+++ b/src/exim_monitor/em_queue.c
@@ -263,7 +263,8 @@ else
 
 sender_address = NULL;
 
-sprintf(CS buffer, "%s/input/%s/%s-D", spool_directory, message_subdir, name);
+snprintf(CS buffer, sizeof(buffer), "%s/input/%s/%s/%s-D",
+  spool_directory, queue_name, message_subdir, name);
 if (Ustat(buffer, &statdata) == 0)
   q->size = message_size + statdata.st_size - SPOOL_DATA_START_OFFSET + 1;
 
@@ -271,7 +272,6 @@ if (Ustat(buffer, &statdata) == 0)
 been delivered, and removing visible names. */
 
 if (recipients_list != NULL)
-  {
   for (i = 0; i < recipients_count; i++)
     {
     uschar *r = recipients_list[i].address;
@@ -282,7 +282,6 @@ if (recipients_list != NULL)
       (void)find_dest(q, r, dest_add, FALSE);
       }
     }
-  }
 
 /* Recover the dynamic store used by spool_read_header(). */
 
@@ -617,11 +616,13 @@ uschar buffer[1024];
 
 message_subdir[0] = p->dir_char;
 
-sprintf(CS buffer, "%s/input/%s/%s-J", spool_directory, message_subdir, p->name);
-jread = fopen(CS buffer, "r");
-if (jread == NULL)
+snprintf(CS buffer, sizeof(buffer), "%s/input/%s/%s/%s-J",
+  spool_directory, queue_name, message_subdir, p->name);
+
+if (!(jread = fopen(CS buffer, "r")))
   {
-  sprintf(CS buffer, "%s/input/%s/%s-H", spool_directory, message_subdir, p->name);
+  snprintf(CS buffer, sizeof(buffer), "%s/input/%s/%s/%s-H",
+    spool_directory, queue_name, message_subdir, p->name);
   if (Ustat(buffer, &statdata) < 0 || p->update_time == statdata.st_mtime)
     return;
   }
diff --git a/src/src/dcc.c b/src/src/dcc.c
index c9d0db236..2d9c16528 100644
--- a/src/src/dcc.c
+++ b/src/src/dcc.c
@@ -102,14 +102,14 @@ dcc_process(uschar **listptr)
   message_subdir[1] = '\0';
   for (i = 0; i < 2; i++)
     {
-    message_subdir[0] = (split_spool_directory == (i == 0))? message_id[5] : 0;
-    sprintf(CS mbox_path, "%s/input/%s/%s-D", spool_directory, message_subdir, message_id);
-    data_file = Ufopen(mbox_path,"rb");
-    if (data_file != NULL)
+    message_subdir[0] = split_spool_directory == (i == 0) ? message_id[5] : 0;
+    snprintf(CS mbox_path, sizeof(mbox_path), "%s/input/%s/%s/%s-D",
+	       spool_directory, queue_name, message_subdir, message_id);
+    if ((data_file = Ufopen(mbox_path,"rb")))
       break;
     }
 
-  if (data_file == NULL)
+  if (!data_file)
     {
     /* error while spooling */
     log_write(0, LOG_MAIN|LOG_PANIC,
diff --git a/src/src/deliver.c b/src/src/deliver.c
index 743fc83e8..631a3e18a 100644
--- a/src/src/deliver.c
+++ b/src/src/deliver.c
@@ -285,9 +285,9 @@ int fd = Uopen(filename, O_WRONLY|O_APPEND|O_CREAT, mode);
 
 if (fd < 0 && errno == ENOENT)
   {
-  uschar temp[16];
-  sprintf(CS temp, "msglog/%s", message_subdir);
-  if (message_subdir[0] == 0) temp[6] = 0;
+  uschar * temp = string_sprintf("msglog%s%s%s%s",
+		    *queue_name ? "/" : "", queue_name,
+		    *message_subdir ? "/" : "", message_subdir);
   (void)directory_make(spool_directory, temp, MSGLOG_DIRECTORY_MODE, TRUE);
   fd = Uopen(filename, O_WRONLY|O_APPEND|O_CREAT, mode);
   }
@@ -1946,7 +1946,8 @@ if (  !shadowing
   {
   uschar *error;
   addr->return_filename =
-    string_sprintf("%s/msglog/%s/%s-%d-%d", spool_directory, message_subdir,
+    string_sprintf("%s/msglog/%s/%s/%s-%d-%d",
+      spool_directory, queue_name, message_subdir,
       message_id, getpid(), return_count++);
   addr->return_file = open_msglog_file(addr->return_filename, 0400, &error);
   if (addr->return_file < 0)
@@ -4372,11 +4373,10 @@ for (delivery_count = 0; addr_remote; delivery_count++)
     a dup-with-new-file-pointer. */
 
     (void)close(deliver_datafile);
-    sprintf(CS spoolname, "%s/input/%s/%s-D", spool_directory, message_subdir,
-      message_id);
-    deliver_datafile = Uopen(spoolname, O_RDWR | O_APPEND, 0);
+    snprintf(CS spoolname, sizeof(spoolname), "%s/input/%s/%s/%s-D",
+      spool_directory, queue_name, message_subdir, message_id);
 
-    if (deliver_datafile < 0)
+    if ((deliver_datafile = Uopen(spoolname, O_RDWR | O_APPEND, 0)) < 0)
       log_write(0, LOG_MAIN|LOG_PANIC_DIE, "Failed to reopen %s for remote "
         "parallel delivery: %s", spoolname, strerror(errno));
 
@@ -5231,8 +5231,8 @@ if ((rc = spool_read_header(spoolname, TRUE, TRUE)) != spool_read_OK)
   if (errno == ERRNO_SPOOLFORMAT)
     {
     struct stat statbuf;
-    sprintf(CS big_buffer, "%s/input/%s/%s", spool_directory, message_subdir,
-      spoolname);
+    sprintf(CS big_buffer, "%s/input/%s/%s/%s",
+      spool_directory, queue_name, message_subdir, spoolname);
     if (Ustat(big_buffer, &statbuf) == 0)
       log_write(0, LOG_MAIN, "Format error in spool file %s: "
         "size=" OFF_T_FMT, spoolname, statbuf.st_size);
@@ -5257,13 +5257,17 @@ if ((rc = spool_read_header(spoolname, TRUE, TRUE)) != spool_read_OK)
 
   if (now - received_time > keep_malformed)
     {
-    sprintf(CS spoolname, "%s/msglog/%s/%s", spool_directory, message_subdir, id);
+    snprintf(CS spoolname, sizeof(spoolname), "%s/msglog/%s/%s/%s",
+      spool_directory, queue_name, message_subdir, id);
     Uunlink(spoolname);
-    sprintf(CS spoolname, "%s/input/%s/%s-D", spool_directory, message_subdir, id);
+    snprintf(CS spoolname, sizeof(spoolname), "%s/input/%s/%s/%s-D",
+      spool_directory, queue_name, message_subdir, id);
     Uunlink(spoolname);
-    sprintf(CS spoolname, "%s/input/%s/%s-H", spool_directory, message_subdir, id);
+    snprintf(CS spoolname, sizeof(spoolname), "%s/input/%s/%s/%s-H",
+      spool_directory, queue_name, message_subdir, id);
     Uunlink(spoolname);
-    sprintf(CS spoolname, "%s/input/%s/%s-J", spool_directory, message_subdir, id);
+    snprintf(CS spoolname, sizeof(spoolname), "%s/input/%s/%s/%s-J",
+      spool_directory, queue_name, message_subdir, id);
     Uunlink(spoolname);
     log_write(0, LOG_MAIN, "Message removed because older than %s",
       readconf_printtime(keep_malformed));
@@ -5283,9 +5287,10 @@ existence, as it will get further successful deliveries added to it in this
 run, and it will be deleted if this function gets to its end successfully.
 Otherwise it might be needed again. */
 
-sprintf(CS spoolname, "%s/input/%s/%s-J", spool_directory, message_subdir, id);
-jread = Ufopen(spoolname, "rb");
-if (jread)
+snprintf(CS spoolname, sizeof(spoolname), "%s/input/%s/%s/%s-J",
+  spool_directory, queue_name, message_subdir, id);
+
+if ((jread = Ufopen(spoolname, "rb")))
   {
   while (Ufgets(big_buffer, big_buffer_size, jread))
     {
@@ -5404,10 +5409,10 @@ if (message_logs)
   uschar *error;
   int fd;
 
-  sprintf(CS spoolname, "%s/msglog/%s/%s", spool_directory, message_subdir, id);
-  fd = open_msglog_file(spoolname, SPOOL_MODE, &error);
-
-  if (fd < 0)
+  snprintf(CS spoolname, sizeof(spoolname), "%s/msglog/%s/%s/%s",
+    spool_directory, queue_name, message_subdir, id);
+  
+  if ((fd = open_msglog_file(spoolname, SPOOL_MODE, &error)) < 0)
     {
     log_write(0, LOG_MAIN|LOG_PANIC, "Couldn't %s message log %s: %s", error,
       spoolname, strerror(errno));
@@ -6638,10 +6643,10 @@ therein are added to the non-recipients. */
 
 if (addr_local || addr_remote)
   {
-  sprintf(CS spoolname, "%s/input/%s/%s-J", spool_directory, message_subdir, id);
-  journal_fd = Uopen(spoolname, O_WRONLY|O_APPEND|O_CREAT, SPOOL_MODE);
-
-  if (journal_fd < 0)
+  snprintf(CS spoolname, sizeof(spoolname), "%s/input/%s/%s/%s-J",
+    spool_directory, queue_name, message_subdir, id);
+  
+  if ((journal_fd = Uopen(spoolname, O_WRONLY|O_APPEND|O_CREAT, SPOOL_MODE)) <0)
     {
     log_write(0, LOG_MAIN|LOG_PANIC, "Couldn't open journal file %s: %s",
       spoolname, strerror(errno));
@@ -7505,12 +7510,13 @@ if (!addr_defer)
   {
   if (message_logs)
     {
-    sprintf(CS spoolname, "%s/msglog/%s/%s", spool_directory, message_subdir,
-      id);
+    snprintf(CS spoolname, sizeof(spoolname), "%s/msglog/%s/%s/%s",
+      spool_directory, queue_name, message_subdir, id);
     if (preserve_message_logs)
       {
       int rc;
-      sprintf(CS big_buffer, "%s/msglog.OLD/%s", spool_directory, id);
+      sprintf(CS big_buffer, "%s/msglog.OLD/%s/%s",
+	spool_directory, queue_name, id);
       if ((rc = Urename(spoolname, big_buffer)) < 0)
         {
         (void)directory_make(spool_directory, US"msglog.OLD",
@@ -7529,11 +7535,13 @@ if (!addr_defer)
 
   /* Remove the two message files. */
 
-  sprintf(CS spoolname, "%s/input/%s/%s-D", spool_directory, message_subdir, id);
+  snprintf(CS spoolname, sizeof(spoolname), "%s/input/%s/%s/%s-D",
+    spool_directory, queue_name, message_subdir, id);
   if (Uunlink(spoolname) < 0)
     log_write(0, LOG_MAIN|LOG_PANIC_DIE, "failed to unlink %s: %s",
       spoolname, strerror(errno));
-  sprintf(CS spoolname, "%s/input/%s/%s-H", spool_directory, message_subdir, id);
+  snprintf(CS spoolname, sizeof(spoolname), "%s/input/%s/%s/%s-H",
+    spool_directory, queue_name, message_subdir, id);
   if (Uunlink(spoolname) < 0)
     log_write(0, LOG_MAIN|LOG_PANIC_DIE, "failed to unlink %s: %s",
       spoolname, strerror(errno));
@@ -8003,7 +8011,8 @@ if (journal_fd >= 0) (void)close(journal_fd);
 
 if (remove_journal)
   {
-  sprintf(CS spoolname, "%s/input/%s/%s-J", spool_directory, message_subdir, id);
+  snprintf(CS spoolname, sizeof(spoolname), "%s/input/%s/%s/%s-J",
+    spool_directory, queue_name, message_subdir, id);
   if (Uunlink(spoolname) < 0 && errno != ENOENT)
     log_write(0, LOG_MAIN|LOG_PANIC_DIE, "failed to unlink %s: %s", spoolname,
       strerror(errno));
diff --git a/src/src/globals.c b/src/src/globals.c
index be1fae849..8b2287aca 100644
--- a/src/src/globals.c
+++ b/src/src/globals.c
@@ -1020,6 +1020,7 @@ BOOL    queue_2stage           = FALSE;
 uschar *queue_domains          = NULL;
 int     queue_interval         = -1;
 BOOL    queue_list_requires_admin = TRUE;
+uschar *queue_name             = US"";
 BOOL    queue_only             = FALSE;
 uschar *queue_only_file        = NULL;
 int     queue_only_load        = -1;
diff --git a/src/src/globals.h b/src/src/globals.h
index 72bb13919..bd7518074 100644
--- a/src/src/globals.h
+++ b/src/src/globals.h
@@ -669,6 +669,7 @@ extern BOOL    queue_running;          /* TRUE for queue running process and */
 extern pid_t   queue_run_pid;          /* PID of the queue running process or 0 */
 extern int     queue_run_pipe;         /* Pipe for synchronizing */
 extern int     queue_interval;         /* Queue running interval */
+extern uschar *queue_name;             /* Name of queue, if nondefault spooling */
 extern BOOL    queue_only;             /* TRUE to disable immediate delivery */
 extern int     queue_only_load;        /* Max load before auto-queue */
 extern BOOL    queue_only_load_latch;  /* Latch queue_only_load TRUE */
diff --git a/src/src/queue.c b/src/src/queue.c
index cc8d36b23..c97179092 100644
--- a/src/src/queue.c
+++ b/src/src/queue.c
@@ -142,7 +142,8 @@ else i = subdiroffset;
 
 /* Set up prototype for the directory name. */
 
-sprintf(CS buffer, "%s/input", spool_directory);
+snprintf(CS buffer, sizeof(buffer), "%s/input/%s", spool_directory, queue_name);
+buffer[sizeof(buffer) - 3] = 0;
 subptr = Ustrlen(buffer);
 buffer[subptr+2] = 0;               /* terminator for lengthened name */
 
@@ -161,8 +162,8 @@ for (; i <= *subcount; i++)
     buffer[subptr+1] = subdirchar;
     }
 
-  dd = opendir(CS buffer);
-  if (dd == NULL) continue;
+  if (!(dd = opendir(CS buffer)))
+    continue;
 
   /* Now scan the directory. */
 
@@ -265,7 +266,8 @@ for (; i <= *subcount; i++)
     if (!split_spool_directory && count <= 2)
       {
       rmdir(CS buffer);
-      sprintf(CS big_buffer, "%s/msglog/%c", spool_directory, subdirchar);
+      sprintf(CS big_buffer, "%s/msglog/%s/%c",
+	       	spool_directory, queue_name, subdirchar);
       rmdir(CS big_buffer);
       }
     if (subdiroffset > 0) break;    /* Single sub-directory */
@@ -476,8 +478,8 @@ for (i  = (queue_run_in_order? -1 : 0);
     /* Check that the message still exists */
 
     message_subdir[0] = f->dir_uschar;
-    sprintf(CS buffer, "%s/input/%s/%s", spool_directory, message_subdir,
-      f->text);
+    snprintf(CS buffer, sizeof(buffer), "%s/input/%s/%s/%s",
+      spool_directory, queue_name, message_subdir, f->text);
     if (Ustat(buffer, &statbuf) < 0) continue;
 
     /* There are some tests that require the reading of the header file. Ensure
@@ -842,8 +844,8 @@ for (; f != NULL; f = f->next)
     FILE *jread;
     struct stat statbuf;
 
-    sprintf(CS big_buffer, "%s/input/%s/%s", spool_directory, message_subdir,
-      f->text);
+    sprintf(CS big_buffer, "%s/input/%s/%s/%s",
+      spool_directory, queue_name, message_subdir, f->text);
     ptr = Ustrlen(big_buffer)-1;
     big_buffer[ptr] = 'D';
 
@@ -892,8 +894,8 @@ for (; f != NULL; f = f->next)
     if (save_errno == ERRNO_SPOOLFORMAT)
       {
       struct stat statbuf;
-      sprintf(CS big_buffer, "%s/input/%s/%s", spool_directory, message_subdir,
-        f->text);
+      sprintf(CS big_buffer, "%s/input/%s/%s/%s",
+        spool_directory, queue_name, message_subdir, f->text);
       if (Ustat(big_buffer, &statbuf) == 0)
         printf("*** spool format error: size=" OFF_T_FMT " ***",
           statbuf.st_size);
@@ -1004,12 +1006,15 @@ if (action >= MSG_SHOW_BODY)
 
   for (i = 0; i < 2; i++)
     {
-    message_subdir[0] = (split_spool_directory == (i == 0))? id[5] : 0;
-    sprintf(CS spoolname, "%s/%s/%s/%s%s", spool_directory, subdirectory,
-      message_subdir, id, suffix);
-    fd = Uopen(spoolname, O_RDONLY, 0);
-    if (fd >= 0) break;
-    if (i == 0) continue;
+    message_subdir[0] = split_spool_directory == (i == 0) ? id[5] : 0;
+    snprintf(CS spoolname, sizeof(spoolname), "%s/%s/%s/%s/%s%s",
+	      spool_directory, subdirectory, queue_name,
+	      message_subdir, id, suffix);
+    if ((fd = Uopen(spoolname, O_RDONLY, 0)) >= 0)
+      break;
+    if (i == 0)
+      continue;
+
     printf("Failed to open %s file for %s%s: %s\n", subdirectory, id, suffix,
       strerror(errno));
     if (action == MSG_SHOW_LOG && !message_logs)
@@ -1162,7 +1167,8 @@ switch(action)
   message_subdir[0] = id[5];
   for (j = 0; j < 2; message_subdir[0] = 0, j++)
     {
-    sprintf(CS spoolname, "%s/msglog/%s/%s", spool_directory, message_subdir, id);
+    snprintf(CS spoolname, sizeof(spoolname), "%s/msglog/%s/%s/%s",
+      spool_directory, queue_name, message_subdir, id);
     if (Uunlink(spoolname) < 0)
       {
       if (errno != ENOENT)
@@ -1176,8 +1182,8 @@ switch(action)
 
     for (i = 0; i < 3; i++)
       {
-      sprintf(CS spoolname, "%s/input/%s/%s-%c", spool_directory, message_subdir,
-        id, "DHJ"[i]);
+      snprintf(CS spoolname, sizeof(spoolname), "%s/input/%s/%s/%s-%c",
+        spool_directory, queue_name, message_subdir, id, "DHJ"[i]);
       if (Uunlink(spoolname) < 0)
         {
         if (errno != ENOENT)
diff --git a/src/src/receive.c b/src/src/receive.c
index 2628570d8..ea99cfb2b 100644
--- a/src/src/receive.c
+++ b/src/src/receive.c
@@ -2471,7 +2471,7 @@ it will fit. */
 to be the least significant base-62 digit of the time of arrival. Otherwise
 ensure that it is an empty string. */
 
-message_subdir[0] = split_spool_directory? message_id[5] : 0;
+message_subdir[0] = split_spool_directory ? message_id[5] : 0;
 
 /* Now that we have the message-id, if there is no message-id: header, generate
 one, but only for local (without suppress_local_fixups) or submission mode
@@ -2863,16 +2863,17 @@ to access it both via a file descriptor and a stream. Try to make the
 directory if it isn't there. Note re use of sprintf: spool_directory
 is checked on input to be < 200 characters long. */
 
-sprintf(CS spool_name, "%s/input/%s/%s-D", spool_directory, message_subdir,
-  message_id);
-data_fd = Uopen(spool_name, O_RDWR|O_CREAT|O_EXCL, SPOOL_MODE);
-if (data_fd < 0)
+snprintf(CS spool_name, sizeof(spool_name), "%s/input/%s/%s/%s-D",
+  spool_directory, queue_name, message_subdir, message_id);
+DEBUG(D_receive) debug_printf("Data file name: %s\n", spool_name);
+
+if ((data_fd = Uopen(spool_name, O_RDWR|O_CREAT|O_EXCL, SPOOL_MODE)) < 0)
   {
   if (errno == ENOENT)
     {
-    uschar temp[16];
-    sprintf(CS temp, "input/%s", message_subdir);
-    if (message_subdir[0] == 0) temp[5] = 0;
+    uschar * temp = string_sprintf("input%s%s%s%s",
+	    *queue_name ? "/" : "", queue_name,
+	    *message_subdir ? "/" : "", message_subdir);
     (void)directory_make(spool_directory, temp, INPUT_DIRECTORY_MODE, TRUE);
     data_fd = Uopen(spool_name, O_RDWR|O_CREAT|O_EXCL, SPOOL_MODE);
     }
@@ -3649,11 +3650,11 @@ signal(SIGINT, SIG_IGN);
 deliver_firsttime = TRUE;
 
 #ifdef EXPERIMENTAL_BRIGHTMAIL
-if (bmi_run == 1) {
-  /* rewind data file */
+if (bmi_run == 1)
+  { /* rewind data file */
   lseek(data_fd, (long int)SPOOL_DATA_START_OFFSET, SEEK_SET);
   bmi_verdicts = bmi_process_message(header_list, data_fd);
-};
+  }
 #endif
 
 /* Update the timstamp in our Received: header to account for any time taken by
@@ -3691,7 +3692,6 @@ if (host_checking || blackholed_by != NULL)
 /* Write the -H file */
 
 else
-  {
   if ((msg_size = spool_write_header(message_id, SW_RECEIVING, &errmsg)) < 0)
     {
     log_write(0, LOG_MAIN, "Message abandoned: %s", errmsg);
@@ -3711,7 +3711,6 @@ else
       /* Does not return */
       }
     }
-  }
 
 
 /* The message has now been successfully received. */
@@ -3859,15 +3858,16 @@ if (message_logs && blackholed_by == NULL)
   {
   int fd;
 
-  sprintf(CS spool_name, "%s/msglog/%s/%s", spool_directory, message_subdir,
-    message_id);
-  fd = Uopen(spool_name, O_WRONLY|O_APPEND|O_CREAT, SPOOL_MODE);
-
-  if (fd < 0 && errno == ENOENT)
+  snprintf(CS spool_name, sizeof(spool_name), "%s/msglog/%s/%s/%s",
+    spool_directory, queue_name, message_subdir, message_id);
+  
+  if (  (fd = Uopen(spool_name, O_WRONLY|O_APPEND|O_CREAT, SPOOL_MODE)) < 0
+     && errno == ENOENT
+     )
     {
-    uschar temp[16];
-    sprintf(CS temp, "msglog/%s", message_subdir);
-    if (message_subdir[0] == 0) temp[6] = 0;
+    uschar * temp = string_sprintf("msglog%s%s%s%s",
+			*queue_name ? "/" : "", queue_name,
+			*message_subdir ? "/" : "", message_subdir);
     (void)directory_make(spool_directory, temp, MSGLOG_DIRECTORY_MODE, TRUE);
     fd = Uopen(spool_name, O_WRONLY|O_APPEND|O_CREAT, SPOOL_MODE);
     }
@@ -3953,16 +3953,16 @@ if (smtp_input && sender_host_address != NULL && !sender_host_notsocket &&
 
       /* Delete the files for this aborted message. */
 
-      sprintf(CS spool_name, "%s/input/%s/%s-D", spool_directory,
-        message_subdir, message_id);
+      snprintf(CS spool_name, sizeof(spool_name), "%s/input/%s/%s/%s-D",
+	spool_directory, queue_name, message_subdir, message_id);
       Uunlink(spool_name);
 
-      sprintf(CS spool_name, "%s/input/%s/%s-H", spool_directory,
-        message_subdir, message_id);
+      snprintf(CS spool_name, sizeof(spool_name), "%s/input/%s/%s/%s-H",
+	spool_directory, queue_name, message_subdir, message_id);
       Uunlink(spool_name);
 
-      sprintf(CS spool_name, "%s/msglog/%s/%s", spool_directory,
-        message_subdir, message_id);
+      snprintf(CS spool_name, sizeof(spool_name), "%s/msglog/%s/%s/%s",
+	spool_directory, queue_name, message_subdir, message_id);
       Uunlink(spool_name);
 
       goto TIDYUP;
@@ -4118,14 +4118,14 @@ if (smtp_input)
       {
       case ACCEPTED: log_write(0, LOG_MAIN, "Completed");/* Delivery was done */
       case PERM_REJ: {					/* Delete spool files */
-	      sprintf(CS spool_name, "%s/input/%s/%s-D", spool_directory,
-	        message_subdir, message_id);
+	      snprintf(CS spool_name, sizeof(spool_name), "%s/input/%s/%s/%s-D",
+		spool_directory, queue_name, message_subdir, message_id);
 	      Uunlink(spool_name);
-	      sprintf(CS spool_name, "%s/input/%s/%s-H", spool_directory,
-	        message_subdir, message_id);
+	      snprintf(CS spool_name, sizeof(spool_name), "%s/input/%s/%s/%s-H",
+		spool_directory, queue_name, message_subdir, message_id);
 	      Uunlink(spool_name);
-	      sprintf(CS spool_name, "%s/msglog/%s/%s", spool_directory,
-	        message_subdir, message_id);
+	      snprintf(CS spool_name, sizeof(spool_name), "%s/msglog/%s/%s/%s",
+		spool_directory, queue_name, message_subdir, message_id);
 	      Uunlink(spool_name);
 	      }
       case TMP_REJ: message_id[0] = 0;	  /* Prevent a delivery from starting */
diff --git a/src/src/spool_in.c b/src/src/spool_in.c
index cafca603d..6341387a2 100644
--- a/src/src/spool_in.c
+++ b/src/src/spool_in.c
@@ -50,8 +50,11 @@ splitting state. */
 for (i = 0; i < 2; i++)
   {
   int save_errno;
-  message_subdir[0] = (split_spool_directory == (i == 0))? id[5] : 0;
-  sprintf(CS spoolname, "%s/input/%s/%s-D", spool_directory, message_subdir, id);
+  message_subdir[0] = split_spool_directory == (i == 0) ? id[5] : 0;
+  snprintf(CS spoolname, sizeof(spoolname), "%s/input/%s/%s/%s-D",
+	    spool_directory, queue_name, message_subdir, id);
+  DEBUG(D_deliver) debug_printf("Trying spool file %s\n", spoolname);
+
   if ((fd = Uopen(spoolname, O_RDWR | O_APPEND, 0)) >= 0)
     break;
   save_errno = errno;
@@ -318,11 +321,10 @@ and unsplit directories, as for the data file above. */
 for (n = 0; n < 2; n++)
   {
   if (!subdir_set)
-    message_subdir[0] = (split_spool_directory == (n == 0))? name[5] : 0;
-  sprintf(CS big_buffer, "%s/input/%s/%s", spool_directory, message_subdir,
-    name);
-  f = Ufopen(big_buffer, "rb");
-  if (f != NULL) break;
+    message_subdir[0] = split_spool_directory == (n == 0) ? name[5] : 0;
+  sprintf(CS big_buffer, "%s/input/%s/%s/%s",
+	  spool_directory, queue_name, message_subdir, name);
+  if ((f = Ufopen(big_buffer, "rb"))) break;
   if (n != 0 || subdir_set || errno != ENOENT) return spool_read_notopen;
   }
 
diff --git a/src/src/spool_mbox.c b/src/src/spool_mbox.c
index ada3f3693..7ee34b551 100644
--- a/src/src/spool_mbox.c
+++ b/src/src/spool_mbox.c
@@ -113,17 +113,16 @@ if (!spool_mbox_ok)
     message_subdir[1] = '\0';
     for (i = 0; i < 2; i++)
       {
-      message_subdir[0] = (split_spool_directory == (i == 0))? message_id[5] : 0;
-      temp_string = string_sprintf("%s/input/%s/%s-D", spool_directory,
-	message_subdir, message_id);
-      data_file = Ufopen(temp_string, "rb");
-      if (data_file != NULL) break;
+      message_subdir[0] = split_spool_directory == (i == 0) ? message_id[5] : 0;
+      temp_string = string_sprintf("%s/input/%s/%s/%s-D",
+	    spool_directory, queue_name, message_subdir, message_id);
+      if ((data_file = Ufopen(temp_string, "rb"))) break;
       }
     }
   else
     data_file = Ufopen(source_file_override, "rb");
 
-  if (data_file == NULL)
+  if (!data_file)
     {
     log_write(0, LOG_MAIN|LOG_PANIC, "Could not open datafile for message %s",
       message_id);
diff --git a/src/src/spool_out.c b/src/src/spool_out.c
index e960907db..c7a0043f5 100644
--- a/src/src/spool_out.c
+++ b/src/src/spool_out.c
@@ -137,12 +137,13 @@ struct stat statbuf;
 uschar name[256];
 uschar temp_name[256];
 
-sprintf(CS temp_name, "%s/input/%s/hdr.%d", spool_directory, message_subdir,
-  (int)getpid());
-fd = spool_open_temp(temp_name);
-if (fd < 0) return spool_write_error(where, errmsg, US"open", NULL, NULL);
+snprintf(CS temp_name, sizeof(temp_name), "%s/input/%s/%s/hdr.%d",
+  spool_directory, queue_name, message_subdir, (int)getpid());
+
+if ((fd = spool_open_temp(temp_name)) < 0)
+  return spool_write_error(where, errmsg, US"open", NULL, NULL);
 f = fdopen(fd, "wb");
-DEBUG(D_receive|D_deliver) debug_printf("Writing spool header file\n");
+DEBUG(D_receive|D_deliver) debug_printf("Writing spool header file: %s\n", temp_name);
 
 /* We now have an open file to which the header data is to be written. Start
 with the file's leaf name, to make the file self-identifying. Continue with the
@@ -342,7 +343,9 @@ if (fclose(f) != 0)
 /* Rename the file to its correct name, thereby replacing any previous
 incarnation. */
 
-sprintf(CS name, "%s/input/%s/%s-H", spool_directory, message_subdir, id);
+snprintf(CS name, sizeof(name), "%s/input/%s/%s/%s-H",
+  spool_directory, queue_name, message_subdir, id);
+DEBUG(D_receive|D_deliver) debug_printf("Renaming spool header file: %s\n", name);
 
 if (Urename(temp_name, name) < 0)
   return spool_write_error(where, errmsg, US"rename", temp_name, NULL);
@@ -359,7 +362,8 @@ these cases. One hack on top of another... but that's life. */
 
 #ifdef NEED_SYNC_DIRECTORY
 
-sprintf(CS temp_name, "%s/input/%s/.", spool_directory, message_subdir);
+snprintf(CS temp_name, sizeof(temp_name), "%s/input/%s/%s/.",
+  spool_directory, queue_name, message_subdir);
 
 #ifndef O_DIRECTORY
 #define O_DIRECTORY 0
diff --git a/src/src/transport.c b/src/src/transport.c
index 86350ba9d..0fc2b2e09 100644
--- a/src/src/transport.c
+++ b/src/src/transport.c
@@ -1027,8 +1027,9 @@ if (!(dkim_private_key && dkim_domain && dkim_selector))
 	    check_string, escape_string, rewrite_rules,
 	    rewrite_existflags);
 
-(void)string_format(dkim_spool_name, 256, "%s/input/%s/%s-%d-K",
-	spool_directory, message_subdir, message_id, (int)getpid());
+(void)string_format(dkim_spool_name, sizeof(dkim_spool_name),
+	"%s/input/%s/%s/%s-%d-K",
+	spool_directory, queue_name, message_subdir, message_id, (int)getpid());
 
 if ((dkim_fd = Uopen(dkim_spool_name, O_RDWR|O_CREAT|O_TRUNC, SPOOL_MODE)) < 0)
   {
@@ -1755,10 +1756,11 @@ while (1)
   for (i = msgq_count - 1; i >= 0; --i) if (msgq[i].bKeep)
     {
     if (split_spool_directory)
-	sprintf(CS spool_file, "%s%c/%s-D",
-		      spool_dir, msgq[i].message_id[5], msgq[i].message_id);
+	snprintf(CS spool_file, sizeof(spool_file), "%s/%s/%c/%s-D",
+	      spool_dir, queue_name, msgq[i].message_id[5], msgq[i].message_id);
     else
-	sprintf(CS spool_file, "%s%s-D", spool_dir, msgq[i].message_id);
+	snprintf(CS spool_file, sizeof(spool_file), "%s/%s/%s-D",
+	      spool_dir, queue_name, msgq[i].message_id);
 
     if (Ustat(spool_file, &statbuf) != 0)
       msgq[i].bKeep = FALSE;