What is the difference between /var/mail/XXX and /var/spool/mail/XXX

/var/spool/mail is a symbolic link to /var/mail on my Debian/Sid system:

 % ls -ld /var/mail /var/spool/mail
 drwxrwsr-x 2 root mail 4096 Dec 31 17:46 /var/mail
 lrwxrwxrwx 1 root root    7 May 12  2011 /var/spool/mail -> ../mail

What you ask is really a matter of preferences; meaning: whatever mail delivery daemon you have in use on your system can use either or.

More specifically, it's a mere matter of preference of options laid out by the FHS.

• http://www.pathname.com/fhs/pub/fhs-2.3.html#VARMAILUSERMAILBOXFILES
• http://www.pathname.com/fhs/pub/fhs-2.3.html#VARSPOOLAPPLICATIONSPOOLDATA

Typically, on more complex mail configurations, things like mail queue, deferred messages, etc are stored in a structure in /var/spool/, independent of /var/mail.

You can see /var/mail used separately from /var/spool/mail (AKA: not symlinked). Local mail will end up in /var/mail - while SMTP daemon handling email for virtual mailboxes, etc will happen in /var/spool/mail