Are you setting mailscanner.conf so every email gets its spam scores in the header? Could be somethings missfiring like autowhitelisting (which i always disable anyway)<div><br></div><div>Make sure following are set so youll get that in the headers</div>
<div><br></div><div><p style="text-align:start;padding:0px;margin:0px 0px 1em"><br></p><p style="text-align:start;padding:0px;margin:0px 0px 1em"><code style="background-color:rgba(255,255,255,0)"><font face="Helvetica Neue, Helvetica, Arial, sans-serif" size="3">Detailed Spam Report = yes</font></code></p>
<p style="text-align:start;padding:0px;margin:0px 0px 1em"><code style="background-color:rgba(255,255,255,0)"><font face="Helvetica Neue, Helvetica, Arial, sans-serif" size="3">Include Scores In SpamAssassin Report = yes</font></code></p>
<p style="text-align:start;padding:0px;margin:0px 0px 1em"><code style="background-color:rgba(255,255,255,0)"><font face="Helvetica Neue, Helvetica, Arial, sans-serif" size="3">Always Include SpamAssassin Report = yes</font></code></p>
<p style="text-align:start;padding:0px;margin:0px 0px 1em"><code style="background-color:rgba(255,255,255,0)"><font face="Helvetica Neue, Helvetica, Arial, sans-serif" size="3">Spam Score Number Format = %5.2f</font></code></p>
<p style="text-align:start;padding:0px;margin:0px 0px 1em"><code style="background-color:rgba(255,255,255,0)"><font face="Helvetica Neue, Helvetica, Arial, sans-serif" size="3"><br></font></code></p><p style="text-align:start;padding:0px;margin:0px 0px 1em">
<code style="background-color:rgba(255,255,255,0)"><font face="Helvetica Neue, Helvetica, Arial, sans-serif" size="3"><br></font></code></p><br>On Friday, 27 June 2014, Paul A Sand <<a href="mailto:pas@unh.edu">pas@unh.edu</a>> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">* Max Kipness <<a href="javascript:;" onclick="_e(event, 'cvml', 'max@inmindlabs.com')">max@inmindlabs.com</a>> [2014-06-27 12:35]:<br>
> MailScanner is indeed blocking the SCR and sending a report about the<br>
> attachment. The problem is, this email was a spam message, it's score<br>
> was 3.7(bayes 999 only) so it still got through (but with the SCR<br>
> stripped).<br>
><br>
> So I'm looking to add a score on the SCR, adding 1.0. In reality you<br>
> could add 20.0 for SCR because I don't ever see a legitimate need to<br>
> send these. If I had an extra score to add to the bayes 999 it would not<br>
> have gotten through.<br>
><br>
> Or better yet, how about adding a score on (Filename?) attachment<br>
> warning? That would probably be best. Add 1.0 score to any of those.<br>
<br>
Sorry for misunderstanding. How about adapting the scheme here<br>
(which adds a score on zip file attachment) :<br>
<br>
<a href="http://jrs-s.net/2013/06/14/block-common-trojans-in-spamassassin/" target="_blank">http://jrs-s.net/2013/06/14/block-common-trojans-in-spamassassin/</a><br>
<br>
I haven’t tried this myself.<br>
<br>
--<br>
-- Paul A Sand <<a href="javascript:;" onclick="_e(event, 'cvml', 'pas@unh.edu')">pas@unh.edu</a>><br>
-- Information Technology / University of New Hampshire<br>
-- <a href="http://pubpages.unh.edu/~pas" target="_blank">http://pubpages.unh.edu/~pas</a><br>
-- Contents may have settled during shipment.<br>
--<br>
MailScanner mailing list<br>
<a href="javascript:;" onclick="_e(event, 'cvml', 'mailscanner@lists.mailscanner.info')">mailscanner@lists.mailscanner.info</a><br>
<a href="http://lists.mailscanner.info/mailman/listinfo/mailscanner" target="_blank">http://lists.mailscanner.info/mailman/listinfo/mailscanner</a><br>
<br>
Before posting, read <a href="http://wiki.mailscanner.info/posting" target="_blank">http://wiki.mailscanner.info/posting</a><br>
<br>
Support MailScanner development - buy the book off the website!<br>
</blockquote></div><br><br>-- <br>-- <br>Martin Hepworth, CISSP<br>Oxford, UK<br>