Spam with certain size has spam score of 0

[PenguinWhispererThe]

Hi all,

I am using Mailscanner with Mailwatch.
In Mailwatch I see messages are marked as OK while I'd have expected it to
be caught (I'm aware not all spam can be caught though). However spam
messages get often through. It seems like basically 50% of spam is a false
negative.

So I looked a bit how I can improve this.

In Mailwatch I see at the bottom:
Spam Report: Score: "large" Matching Rule: "too"
SpamAssassin score is 0. Size is e.g. 257kb. Almost all spam that gets
through is like this.

The domain in the TO field in the headers is not one of the domains that my
mailserver handles which is confusing. (not an open relay though, but I do
have some kind of catchall: *@example.com goes to the same mailbox apart
from some exceptions)

Now from my interpretation of what I see in Mailscanner the message is not
being sent through SpamAssassin since the message size is too big and so it
uses 0 as the score. Is that correct?

I have looked into the Maximum Message Size setting:
Maximum Message Size = %rules-dir%/max.message.size.rules

And in this rule file I only have this:
FromOrTo: default           0

This is the default. I looked at the other samples in that file but they
actually do set a limit while 0 seems to be "no limit". So I don't
understand why these bigger messages are skipped while for smaller ones SA
is invoked and seems to work properly.

Anyone who can lead me in the right direction? Suggestions? Ideas?

Thanks!
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.mailscanner.info/pipermail/mailscanner/attachments/20220609/c267b6d5/attachment.html>