SpamFilter - Threshold Settings
Overview
As messages are passed through the SpamFilter they are given a score representing their probability of being Spam. The higher the score a message receives, the more likely that it is Spam. The threshold settings are used to determine the probability assigned to messages based on a range of Spam scores. By adjusting, or "tweaking" these threshold scores you can drastically alter the behavior of the SpamFilter. These threshold levels match up with the probability levels and actions specified on the main SpamFilter Settings page.
Configuration
To change the threshold settings go to SpamFilter > Settings > Advanced.
The default values are 5 for Low, 10 for Medium, and 17 for High. With these default settings the message must score between 5 and 10 to be considered a "low probability" Spam message. To be considered a Medium probability of Spam a message must be scored between 10 and 17. To score High the message must receive a score of over 17.
To make the SpamFilter more aggressive, you would typically lower the thresholds. This will decrease the score necessary for a message to fall into a certain probability level. For example, by lowering the Low threshold to 4, you would now be catching any messages that received a score of 4-10. You can also increase these values to decrease false positives; however, this would also allow more Spam to be delivered.
By using the “Defaults” button you can restore the settings back to the eSoft recommended defaults.
Troubleshooting
Often times, you will want to find out why a particular Spam message was delivered. To do this you would use the score the message was given to match the probability level. First, view the headers of the message to find the X-Spam-Status: line that was added by the SpamFilter. This will show something similar to X-Spam-Status: No, hits=1.2 required=5. By viewing the hits you can find what probability the message should have been handled at, and adjust the SpamFilter as needed.
The Whitelist prevents messages from being scanned by SpamFilter. If you are seeing Spam messages being delivered, make sure the local domain or sender address are not in the whitelist. Adding the local domain will exempt all mail from being scanned.
SpamFilter can be tested by using the Gtube string. This string of characters will always get marked as a "high probability" Spam message. Whatever action is specified for high probability Spam will be taken on the message. Follow the URL below for more information.
http://spamassassin.apache.org/gtube/
