LuKreme wrote: [snip spam headers] > And 280K of total spam size. > > Of course, SA didn't touch this because of the size. > > Should I increase the size that SA checks? Or assume this is a one > timer?
I would ignore it. I'm not sure where the "don't scan >250K" default came from, but the processing load gets MUCH higher for larger messages. I would bet that the spam included attached images, rather than loading them from a remote webserver. I've seen *maybe* two such messages in three years or so across three different systems. If anything, I would *lower* the maximum message size to ~150K or so; most legit mail of any kind that does not include attached images will be <100K, and just about ALL mail with attached images will be over 150K. -kgd -- Get your mouse off of there! You don't know where that email has been!
