SPAM report : too large

Questions and answers about how to do stuff
Post Reply
heronimus
Posts: 24
Joined: 11 Sep 2015 10:19
Location: Netherlands

SPAM report : too large

Post by heronimus »

Dear readers,

Our max message size is 25MB. If a message exceeds this limit, the sender receives an error message. However, sometimes a message is accepted by EFA, but internally dropped by SPAM filter. In the webportal i see something like "too large". In this rarely case no-one receives a mail; so the sender believes his mail is sent and the receiver doesn't know about anything.

In my opinion, the error is a configuration somewhere in the SPAM check proces: how can i change the max. message size for the spam scanner? Or do you have tips to troubleshoot this problem?

Regards,
Heronimus
heronimus
Posts: 24
Joined: 11 Sep 2015 10:19
Location: Netherlands

Re: SPAM report : too large

Post by heronimus »

In /var/log/messages is see this error line. (Its around that time that mailscanner reports "too large".)

I don't know if this has something to do with it.

Jan 5 12:20:13 mail2 clamd[1460]: lstat() failed on: /var/spool/MailScanner/incoming/25942/1387E12085F.AF86F/tnefwqveiq
User avatar
shawniverson
Posts: 3644
Joined: 13 Jan 2014 23:30
Location: Indianapolis, Indiana USA
Contact:

Re: SPAM report : too large

Post by shawniverson »

I wonder if something else is triggering this problem...

By default MailScanner bypasses spam checking when a message exceeds a certain size (typically 2mb) since most spam is small in size because large spams are costly for spammers. Also, by default, no rules are defined in /etc/MailScanner/rules/max.message.size.rules, so there shouldn't be a limit imposed. Hence the message "too large."

So, do you happen to have a full spam report of a blocked message you can share?
heronimus
Posts: 24
Joined: 11 Sep 2015 10:19
Location: Netherlands

Re: SPAM report : too large

Post by heronimus »

Also, by default, no rules are defined in /etc/MailScanner/rules/max.message.size.rules, so there shouldn't be a limit imposed
Just to be sure, i examined the config file, it has only 1 rule:

Code: Select all

FromOrTo:       default                 20480000
So, do you happen to have a full spam report of a blocked message you can share?
In this case, i can't share any details. When it happens again and the message is not sensitive, i will PM you.
What do you mean with a full spam report? :oops: Where can i get it in EFA?

Regards, Heronimus
User avatar
shawniverson
Posts: 3644
Joined: 13 Jan 2014 23:30
Location: Indianapolis, Indiana USA
Contact:

Re: SPAM report : too large

Post by shawniverson »

Drop that rule or increase it
ovizii
Posts: 463
Joined: 11 May 2016 08:08

Re: SPAM report : too large

Post by ovizii »

What do you mean with a full spam report? :oops: Where can i get it in EFA?
Same question here, waht exactly do you mean by spam report and where is it hidden?
Post Reply