From th3penguinwhisperer at gmail.com Thu Jun 9 14:37:13 2022 From: th3penguinwhisperer at gmail.com (PenguinWhispererThe) Date: Thu, 9 Jun 2022 16:37:13 +0200 Subject: Spam with certain size has spam score of 0 Message-ID: Hi all, I am using Mailscanner with Mailwatch. In Mailwatch I see messages are marked as OK while I'd have expected it to be caught (I'm aware not all spam can be caught though). However spam messages get often through. It seems like basically 50% of spam is a false negative. So I looked a bit how I can improve this. In Mailwatch I see at the bottom: Spam Report: Score: "large" Matching Rule: "too" SpamAssassin score is 0. Size is e.g. 257kb. Almost all spam that gets through is like this. The domain in the TO field in the headers is not one of the domains that my mailserver handles which is confusing. (not an open relay though, but I do have some kind of catchall: *@example.com goes to the same mailbox apart from some exceptions) Now from my interpretation of what I see in Mailscanner the message is not being sent through SpamAssassin since the message size is too big and so it uses 0 as the score. Is that correct? I have looked into the Maximum Message Size setting: Maximum Message Size = %rules-dir%/max.message.size.rules And in this rule file I only have this: FromOrTo: default 0 This is the default. I looked at the other samples in that file but they actually do set a limit while 0 seems to be "no limit". So I don't understand why these bigger messages are skipped while for smaller ones SA is invoked and seems to work properly. Anyone who can lead me in the right direction? Suggestions? Ideas? Thanks! -------------- next part -------------- An HTML attachment was scrubbed... URL: From th3penguinwhisperer at gmail.com Mon Jun 13 09:13:35 2022 From: th3penguinwhisperer at gmail.com (PenguinWhispererThe) Date: Mon, 13 Jun 2022 11:13:35 +0200 Subject: Spam with certain size has spam score of 0 In-Reply-To: References: Message-ID: Anyone has ideas about this? On Thu, 9 Jun 2022 at 16:37, PenguinWhispererThe < th3penguinwhisperer at gmail.com> wrote: > Hi all, > > I am using Mailscanner with Mailwatch. > In Mailwatch I see messages are marked as OK while I'd have expected it to > be caught (I'm aware not all spam can be caught though). However spam > messages get often through. It seems like basically 50% of spam is a false > negative. > > So I looked a bit how I can improve this. > > In Mailwatch I see at the bottom: > Spam Report: Score: "large" Matching Rule: "too" > SpamAssassin score is 0. Size is e.g. 257kb. Almost all spam that gets > through is like this. > > The domain in the TO field in the headers is not one of the domains that > my mailserver handles which is confusing. (not an open relay though, but I > do have some kind of catchall: *@example.com goes to the same mailbox > apart from some exceptions) > > Now from my interpretation of what I see in Mailscanner the message is not > being sent through SpamAssassin since the message size is too big and so it > uses 0 as the score. Is that correct? > > I have looked into the Maximum Message Size setting: > Maximum Message Size = %rules-dir%/max.message.size.rules > > And in this rule file I only have this: > FromOrTo: default 0 > > This is the default. I looked at the other samples in that file but they > actually do set a limit while 0 seems to be "no limit". So I don't > understand why these bigger messages are skipped while for smaller ones SA > is invoked and seems to work properly. > > Anyone who can lead me in the right direction? Suggestions? Ideas? > > Thanks! > -------------- next part -------------- An HTML attachment was scrubbed... URL: From shawniverson at summitgrid.com Mon Jun 13 12:19:43 2022 From: shawniverson at summitgrid.com (Shawn Iverson) Date: Mon, 13 Jun 2022 08:19:43 -0400 Subject: Spam with certain size has spam score of 0 In-Reply-To: References: Message-ID: <8324481a-26df-3ab3-0fa7-9c3611ebea75@summitgrid.com> The setting you need is in MailScanner.conf and is "Max Spam Check Size" . On 6/13/22 05:13, PenguinWhispererThe wrote: > Anyone has ideas about this? > > On Thu, 9 Jun 2022 at 16:37, PenguinWhispererThe > wrote: > > Hi all, > > I am using Mailscanner with Mailwatch. > In Mailwatch I see messages are marked as OK while I'd have > expected it to be caught (I'm aware not all spam can be caught > though). However spam messages get often through. It seems like > basically 50% of spam is a false negative. > > So I looked a bit how I can improve this. > > In Mailwatch I see at the bottom: > Spam Report: Score: "large" Matching Rule: "too" > SpamAssassin score is 0. Size is e.g. 257kb. Almost all spam that > gets through is like this. > > The domain in the TO field in the headers is not one of the > domains that my mailserver handles which is confusing. (not an > open relay though, but I do have some kind of catchall: > *@example.com goes to the same mailbox apart > from some exceptions) > > Now from my interpretation of what I see in Mailscanner the > message is not being sent through SpamAssassin since the message > size is too big and so it uses 0 as the score. Is that correct? > > I have looked into the Maximum Message Size setting: > Maximum Message Size = %rules-dir%/max.message.size.rules > > And in this rule file I only have this: > FromOrTo: default ? ? ? ? ? 0 > > This is the default. I looked at the other samples in that file > but they actually do set a limit while 0 seems to be "no limit". > So I don't understand why these bigger messages are skipped while > for smaller ones SA is invoked and seems to work properly. > > Anyone who can lead me in the right direction? Suggestions? Ideas? > > Thanks! > > > -------------- next part -------------- An HTML attachment was scrubbed... URL: