Spam with certain size has spam score of 0

[PenguinWhispererThe]

Anyone has ideas about this?

On Thu, 9 Jun 2022 at 16:37, PenguinWhispererThe <
th3penguinwhisperer at gmail.com> wrote:

> Hi all,
>
> I am using Mailscanner with Mailwatch.
> In Mailwatch I see messages are marked as OK while I'd have expected it to
> be caught (I'm aware not all spam can be caught though). However spam
> messages get often through. It seems like basically 50% of spam is a false
> negative.
>
> So I looked a bit how I can improve this.
>
> In Mailwatch I see at the bottom:
> Spam Report: Score: "large" Matching Rule: "too"
> SpamAssassin score is 0. Size is e.g. 257kb. Almost all spam that gets
> through is like this.
>
> The domain in the TO field in the headers is not one of the domains that
> my mailserver handles which is confusing. (not an open relay though, but I
> do have some kind of catchall: *@example.com goes to the same mailbox
> apart from some exceptions)
>
> Now from my interpretation of what I see in Mailscanner the message is not
> being sent through SpamAssassin since the message size is too big and so it
> uses 0 as the score. Is that correct?
>
> I have looked into the Maximum Message Size setting:
> Maximum Message Size = %rules-dir%/max.message.size.rules
>
> And in this rule file I only have this:
> FromOrTo: default           0
>
> This is the default. I looked at the other samples in that file but they
> actually do set a limit while 0 seems to be "no limit". So I don't
> understand why these bigger messages are skipped while for smaller ones SA
> is invoked and seems to work properly.
>
> Anyone who can lead me in the right direction? Suggestions? Ideas?
>
> Thanks!
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.mailscanner.info/pipermail/mailscanner/attachments/20220613/1be2cff1/attachment.html>