MailScanner filtering out less and less spam

Richard Mealing richard at
Wed May 28 13:17:33 IST 2014

Hit the wrong button and omitted my example..
Anyway, here’s my example –

#Sanesecurity Signature (jurlbl.ndb)
header SPAMVIRUSJurlbl X-YOURORGANISATION-MailScanner-SpamVirus-Report =~ /Sanesecurity.Jurlbl/i
score SPAMVIRUSJurlbl 4.0
describe SPAMVIRUSJurlbl Spam Virus Junk

There are loads of databases you can use, it’s a fantastic ‘bolt on’ to clamd.


From: mailscanner-bounces at [mailto:mailscanner-bounces at] On Behalf Of Richard Mealing
Sent: 27 May 2014 16:51
To: 'mailscanner at'
Subject: RE: MailScanner filtering out less and less spam

If you don’t have mailwatch you can turn on “Log Non Spam”, then you can see the scores in the logs. Maybe your threshold is wrong or you have turned it off altogether?

If you use clamav then you can add the signatured from sanesecurity and then you can treat emails as spam through the “Virus Names Which Are Spam” option.

For example –


From: mailscanner-bounces at<mailto:mailscanner-bounces at> [mailto:mailscanner-bounces at] On Behalf Of Jonathan Horne
Sent: 27 May 2014 15:24
To: mailscanner at<mailto:mailscanner at>
Subject: Re: MailScanner filtering out less and less spam

the only one not enabled as Always Include SpamAssassin Report.  the spam score number format was %d I think, but I tried the setting below, looks like that will be more verbose.

overall, im not seeing rules get skipped, but emails that are obviously spams are just being no scored as such.

thanks for the advice!

From: Martin Hepworth<mailto:maxsec at>
Sent: ‎Friday‎, ‎May‎ ‎23‎, ‎2014 ‎9‎:‎32‎ ‎AM
To: mailscanner at<mailto:mailscanner at>

add the SA info into email headers to see what the score and rule hits are ( helps with debug), in MailScanner.conf make sure the follow are set thus:

Spam Score Number Format = %5.2f

Detailed Spam Report = yes

Include Scores In SpamAssassin Report = yes

Always Include SpamAssassin Report = yes

Spam Score Number Format = %5.2f
This should give you some clue as to whats (not) happening as first step

Martin Hepworth, CISSP
Oxford, UK

On 23 May 2014 06:45, Michael Huntley <michael at<mailto:michael at>> wrote:
I always keep a sizable chunk of recent spam on hand to feed to spamassassin.  I do it on a 45 day or so schedule.  I place the spam in a folder and sa-learn it using the proper user.  This seems to keep things sane.



On 5/22/2014 7:12 PM, Jonathan Horne wrote:

I have several MailScanner installs that lately, have been allowing an increased amount of spam to deliver.  all separate systems, at separate sites, but all behaving the same way.  more and more spam each week is getting thru.  ive been noticing an increase at least over the past 3-4 weeks.

is there anything that can be done?  previously when these systems were deployed (about 9-12 months ago, I forget now) they were incredibly effective.

thanks for any tips,

MailScanner mailing list
mailscanner at<mailto:mailscanner at>

Before posting, read

Support MailScanner development - buy the book off the website!

-------------- next part --------------
An HTML attachment was scrubbed...

More information about the MailScanner mailing list