efa-project.org

Dear readers,

Our max message size is 25MB. If a message exceeds this limit, the sender receives an error message. However, sometimes a message is accepted by EFA, but internally dropped by SPAM filter. In the webportal i see something like "too large". In this rarely case no-one receives a mail; so the sender believes his mail is sent and the receiver doesn't know about anything.

In my opinion, the error is a configuration somewhere in the SPAM check proces: how can i change the max. message size for the spam scanner? Or do you have tips to troubleshoot this problem?

Regards,
Heronimus

In /var/log/messages is see this error line. (Its around that time that mailscanner reports "too large".)

I don't know if this has something to do with it.

Jan 5 12:20:13 mail2 clamd[1460]: lstat() failed on: /var/spool/MailScanner/incoming/25942/1387E12085F.AF86F/tnefwqveiq

I wonder if something else is triggering this problem...

By default MailScanner bypasses spam checking when a message exceeds a certain size (typically 2mb) since most spam is small in size because large spams are costly for spammers. Also, by default, no rules are defined in /etc/MailScanner/rules/max.message.size.rules, so there shouldn't be a limit imposed. Hence the message "too large."

So, do you happen to have a full spam report of a blocked message you can share?

Also, by default, no rules are defined in /etc/MailScanner/rules/max.message.size.rules, so there shouldn't be a limit imposed

Just to be sure, i examined the config file, it has only 1 rule:

So, do you happen to have a full spam report of a blocked message you can share?

In this case, i can't share any details. When it happens again and the message is not sensitive, i will PM you.
What do you mean with a full spam report? Where can i get it in EFA?

Regards, Heronimus

Drop that rule or increase it

What do you mean with a full spam report? Where can i get it in EFA?

Same question here, waht exactly do you mean by spam report and where is it hidden?