diff --git a/src/config.h b/src/config.h
index e973bf28..9d11a52b 100644
--- a/src/config.h
+++ b/src/config.h
@@ -14,7 +14,7 @@
 
 #define VERSION "0.1.24-master-branch"
 
-#define BUILD 825
+#define BUILD 827
 
 #define HOSTID "mailarchiver"
 
diff --git a/src/defs.h b/src/defs.h
index 09e61a62..0e5f4ceb 100644
--- a/src/defs.h
+++ b/src/defs.h
@@ -107,6 +107,9 @@ struct rule {
    int attachment_size;
    char _attachment_size[4];
 
+   char *domain;
+   int domainlen;
+
    int days;
 
    char *rulestr;
diff --git a/src/message.c b/src/message.c
index eecbd4af..881033b1 100644
--- a/src/message.c
+++ b/src/message.c
@@ -283,7 +283,7 @@ int process_message(struct session_data *sdata, struct _state *state, struct __d
    }
 
 
-   sdata->retained += query_retain_period(data->retention_rules, state, sdata->tot_len, sdata->spam_message, cfg);
+   sdata->retained += query_retain_period(data, state, sdata->tot_len, sdata->spam_message, cfg);
 
    rc = store_meta_data(sdata, state, data, cfg);
    if(cfg->verbosity >= _LOG_DEBUG) syslog(LOG_PRIORITY, "%s: stored metadata, rc=%d",  sdata->ttmpfile, rc);
diff --git a/src/rules.c b/src/rules.c
index 84003eef..84d41c62 100644
--- a/src/rules.c
+++ b/src/rules.c
@@ -12,9 +12,10 @@
 
 void load_rules(struct session_data *sdata, struct __data *data, struct rule **rules, char *table){
    char s[SMALLBUFSIZE];
-   char from[SMALLBUFSIZE], to[SMALLBUFSIZE], subject[SMALLBUFSIZE], _size[SMALLBUFSIZE], attachment_type[SMALLBUFSIZE], _attachment_size[SMALLBUFSIZE];
+   char domain[SMALLBUFSIZE], from[SMALLBUFSIZE], to[SMALLBUFSIZE], subject[SMALLBUFSIZE], _size[SMALLBUFSIZE], attachment_type[SMALLBUFSIZE], _attachment_size[SMALLBUFSIZE];
    int size=0, attachment_size=0, spam=0, days=0;
 
+   memset(domain, 0, sizeof(domain));
    memset(from, 0, sizeof(from));
    memset(to, 0, sizeof(to));
    memset(subject, 0, sizeof(subject));
@@ -23,7 +24,7 @@ void load_rules(struct session_data *sdata, struct __data *data, struct rule **r
    memset(_attachment_size, 0, sizeof(_attachment_size));
 
 
-   snprintf(s, sizeof(s)-1, "SELECT `from`, `to`, `subject`, `_size`, `size`, `attachment_type`, `_attachment_size`, `attachment_size`, `spam`, `days` FROM `%s`", table);
+   snprintf(s, sizeof(s)-1, "SELECT `domain`, `from`, `to`, `subject`, `_size`, `size`, `attachment_type`, `_attachment_size`, `attachment_size`, `spam`, `days` FROM `%s`", table);
 
    if(prepare_sql_statement(sdata, &(data->stmt_generic), s) == ERR) return;
 
@@ -36,6 +37,7 @@ void load_rules(struct session_data *sdata, struct __data *data, struct rule **r
 
    p_bind_init(data);
 
+   data->sql[data->pos] = &domain[0]; data->type[data->pos] = TYPE_STRING; data->len[data->pos] = sizeof(domain)-2; data->pos++;
    data->sql[data->pos] = &from[0]; data->type[data->pos] = TYPE_STRING; data->len[data->pos] = sizeof(from)-2; data->pos++;
    data->sql[data->pos] = &to[0]; data->type[data->pos] = TYPE_STRING; data->len[data->pos] = sizeof(to)-2; data->pos++;
    data->sql[data->pos] = &subject[0]; data->type[data->pos] = TYPE_STRING; data->len[data->pos] = sizeof(subject)-2; data->pos++;
@@ -52,8 +54,9 @@ void load_rules(struct session_data *sdata, struct __data *data, struct rule **r
    p_store_results(sdata, data->stmt_generic, data);
 
    while(p_fetch_results(data->stmt_generic) == OK){
-      append_rule(rules, from, to, subject, _size, size, attachment_type, _attachment_size, attachment_size, spam, days);
+      append_rule(rules, domain, from, to, subject, _size, size, attachment_type, _attachment_size, attachment_size, spam, days);
 
+      memset(domain, 0, sizeof(domain));
       memset(from, 0, sizeof(from));
       memset(to, 0, sizeof(to));
       memset(subject, 0, sizeof(subject));
@@ -72,7 +75,7 @@ ENDE:
 }
 
 
-int append_rule(struct rule **rule, char *from, char *to, char *subject, char *_size, int size, char *attachment_type, char *_attachment_size, int attachment_size, int spam, int days){
+int append_rule(struct rule **rule, char *domain, char *from, char *to, char *subject, char *_size, int size, char *attachment_type, char *_attachment_size, int attachment_size, int spam, int days){
    struct rule *q, *t, *u=NULL;
 
    q = *rule;
@@ -82,7 +85,7 @@ int append_rule(struct rule **rule, char *from, char *to, char *subject, char *_
       q = q->r;
    }
 
-   t = create_rule_item(from, to, subject, _size, size, attachment_type, _attachment_size, attachment_size, spam, days);
+   t = create_rule_item(domain, from, to, subject, _size, size, attachment_type, _attachment_size, attachment_size, spam, days);
    if(t){
       if(*rule == NULL)
          *rule = t;
@@ -96,7 +99,7 @@ int append_rule(struct rule **rule, char *from, char *to, char *subject, char *_
 }
 
 
-struct rule *create_rule_item(char *from, char *to, char *subject, char *_size, int size, char *attachment_type, char *_attachment_size, int attachment_size, int spam, int days){
+struct rule *create_rule_item(char *domain, char *from, char *to, char *subject, char *_size, int size, char *attachment_type, char *_attachment_size, int attachment_size, int spam, int days){
    struct rule *h=NULL;
    char empty = '\0';
    int len;
@@ -107,6 +110,18 @@ struct rule *create_rule_item(char *from, char *to, char *subject, char *_size,
 
    h->compiled = 1;
 
+   h->domain = NULL;
+   h->domainlen = strlen(domain);
+
+   if(h->domainlen > 2){
+      h->domain = malloc(h->domainlen+2);
+      if(h->domain) snprintf(h->domain, h->domainlen, "%s", domain);
+      else {
+         h->compiled = 0;
+         syslog(LOG_INFO, "malloc error in create_rule_item() for '%s'", domain);
+      }
+   }
+
    if(!from) from = ∅
    if(regcomp(&(h->from), from, REG_ICASE | REG_EXTENDED)) h->compiled = 0;
 
@@ -134,12 +149,12 @@ struct rule *create_rule_item(char *from, char *to, char *subject, char *_size,
    if(!_attachment_size) _attachment_size = ∅
    snprintf(h->_attachment_size, 3, "%s", _attachment_size);
 
-   len = strlen(from)+6 + strlen(to)+4 + strlen(subject)+9 + strlen(_size)+6 + strlen(attachment_type)+10 + strlen(_attachment_size)+10 + 8 + 15 + 15;
+   len = strlen(domain)+8 + strlen(from)+6 + strlen(to)+4 + strlen(subject)+9 + strlen(_size)+6 + strlen(attachment_type)+10 + strlen(_attachment_size)+10 + 9 + 15 + 15;
    h->rulestr = malloc(len);
 
 
 
-   if(h->rulestr) snprintf(h->rulestr, len-1, "from=%s,to=%s,subject=%s,size%s%d,att.type=%s,att.size%s%d,spam=%d", from, to, subject, _size, size, attachment_type, _attachment_size, attachment_size, spam);
+   if(h->rulestr) snprintf(h->rulestr, len-1, "domain=%s,from=%s,to=%s,subject=%s,size%s%d,att.type=%s,att.size%s%d,spam=%d", domain, from, to, subject, _size, size, attachment_type, _attachment_size, attachment_size, spam);
    else h->compiled = 0;
 
    h->r = NULL;
@@ -175,15 +190,21 @@ char *check_againt_ruleset(struct rule *rule, struct _state *state, int size, in
 }
 
 
-unsigned long query_retain_period(struct rule *rule, struct _state *state, int size, int spam, struct __config *cfg){
+unsigned long query_retain_period(struct __data *data, struct _state *state, int size, int spam, struct __config *cfg){
    size_t nmatch=0;
    struct rule *p;
 
-   p = rule;
+   p = data->retention_rules;
 
    while(p != NULL){
 
-      if(
+      if(p->domainlen > 2){
+         if(strcasestr(state->b_to_domain, p->domain) || strcasestr(state->b_from_domain, p->domain)){
+            if(cfg->verbosity >= _LOG_INFO) syslog(LOG_INFO, "from domain: '%s', to domain: '%s', retention days: %d", state->b_from_domain, state->b_to_domain, p->days);
+            return p->days * 86400;
+         }
+      }
+      else if (
          p->compiled == 1 &&
          regexec(&(p->from), state->b_from, nmatch, NULL, 0) == 0 &&
          regexec(&(p->to), state->b_to, nmatch, NULL, 0) == 0 &&
@@ -192,6 +213,7 @@ unsigned long query_retain_period(struct rule *rule, struct _state *state, int s
          check_attachment_rule(state, p) == 1 &&
          check_spam_rule(spam, p->spam) == 1
       ){
+         if(cfg->verbosity >= _LOG_INFO) syslog(LOG_INFO, "from domain: '%s', to domain: '%s', retention days: %d", state->b_from_domain, state->b_to_domain, p->days);
          return p->days * 86400;
       }
 
@@ -255,6 +277,8 @@ void free_rule(struct rule *rule){
 
          free(p->rulestr);
 
+         if(p->domain) free(p->domain);
+
          free(p);
       }
 
diff --git a/src/rules.h b/src/rules.h
index fd2dd555..a9996f0b 100644
--- a/src/rules.h
+++ b/src/rules.h
@@ -8,10 +8,10 @@
 #include "defs.h"
 
 void load_rules(struct session_data *sdata, struct __data *data, struct rule **rules, char *table);
-int append_rule(struct rule **rule, char *from, char *to, char *subject, char *_size, int size, char *attachment_type, char *_attachment_size, int attachment_size, int spam, int days);
-struct rule *create_rule_item(char *from, char *to, char *subject, char *_size, int size, char *attachment_type, char *_attachment_size, int attachment_size, int spam, int days);
+int append_rule(struct rule **rule, char *domain, char *from, char *to, char *subject, char *_size, int size, char *attachment_type, char *_attachment_size, int attachment_size, int spam, int days);
+struct rule *create_rule_item(char *domain, char *from, char *to, char *subject, char *_size, int size, char *attachment_type, char *_attachment_size, int attachment_size, int spam, int days);
 char *check_againt_ruleset(struct rule *rule, struct _state *state, int size, int spam);
-unsigned long query_retain_period(struct rule *rule, struct _state *state, int size, int spam, struct __config *cfg);
+unsigned long query_retain_period(struct __data *data, struct _state *state, int size, int spam, struct __config *cfg);
 int check_size_rule(int message_size, int size, char *_size);
 int check_spam_rule(int is_spam, int spam);
 int check_attachment_rule(struct _state *state, struct rule *rule);
diff --git a/src/test.c b/src/test.c
index 4e614c12..bd88431d 100644
--- a/src/test.c
+++ b/src/test.c
@@ -35,6 +35,8 @@ int main(int argc, char **argv){
       return 0;
    }
 
+   (void) openlog("test", LOG_PID, LOG_MAIL);
+
    cfg = read_config(CONFIG_FILE);
 
    if(open_database(&sdata, &cfg) == ERR) return 0;
@@ -90,7 +92,7 @@ int main(int argc, char **argv){
 
    printf("rules check: %s\n", rule);
 
-   sdata.retained = sdata.now + query_retain_period(data.retention_rules, &state, st.st_size, sdata.spam_message, &cfg);
+   sdata.retained = sdata.now + query_retain_period(&data, &state, st.st_size, sdata.spam_message, &cfg);
 
    printf("retention period: %ld\n", sdata.retained);
 
diff --git a/util/db-mysql.sql b/util/db-mysql.sql
index 171cac40..02ea7c68 100644
--- a/util/db-mysql.sql
+++ b/util/db-mysql.sql
@@ -105,6 +105,7 @@ create table if not exists `tag` (
 
 create table if not exists `archiving_rule` (
    `id` bigint unsigned not null auto_increment,
+   `domain` varchar(255) default null,
    `from` char(128) default null,
    `to` char(255) default null,
    `subject` char(255) default null,
@@ -122,6 +123,7 @@ create table if not exists `archiving_rule` (
 
 create table if not exists `retention_rule` (
    `id` bigint unsigned not null auto_increment,
+   `domain` varchar(255) default null,
    `from` char(128) default null,
    `to` char(255) default null,
    `subject` char(255) default null,
diff --git a/util/db-upgrade-0.1.23-vs-0.1.24.sql b/util/db-upgrade-0.1.23-vs-0.1.24.sql
index 42ad4c28..3364baed 100644
--- a/util/db-upgrade-0.1.23-vs-0.1.24.sql
+++ b/util/db-upgrade-0.1.23-vs-0.1.24.sql
@@ -4,6 +4,10 @@ alter table `audit` add column `domain` varchar(128) not null;
 
 create index `audit_idx5` on `audit`(`domain`);
 
+alter table archiving_rule add column domain varchar(255) default null;
+alter table retention_rule add column domain varchar(255) default null;
+
+
 create table if not exists `ldap` (
    `id` int not null auto_increment primary key,
    `description` varchar(255) not null,