How to find out *why* email is blocked

[kiddx]

We have a working system for quite sometime and really enjoy it. I was on the demo system and saw a block spam that proxmox added and thought that was a good idea, no sense in quarantining mail with a spam score of 10+.

That seems to be okay but what I notice sometimes is mail showing as a spam score of 2/5 for example, but then being blocked. Im guessing its the Dangerous Files but I cant tell for certain, here is what i show in tracking center, just want to make sure I havent configured something incorrectly, this isnt happening everytime just random as far as I can tell:

Jul 27 08:26:05proxprox8552C4C4ED059746E1: SA score=2/5 time=4.267 bayes=undefined autolearn=disabled
hits=AWL,FH_DATE_PAST_20XX,HTML_FONT_LOW_CONTRAST,HTML_IMAGE_RATIO_02
HTML_MESSAGE,MIME_HTML_ONLY,SPF_PASS Jul 27 08:26:05proxprox8552C4C4ED059746E1: block mail to=****@domain.com

 

[tom]

review your rule system, looks like you got a block rule triggering somewhere.

 

[kiddx]

Thanks, I agree, I have 2 rules that block, one is the default Dangerous Files, and the other is one I added that says Block Spam 10+ which occurs right after the Mark Spam Rule.I mean it seems to be working just fine, the issue is I have a government agency who is trying to email something and its status is 'blocked' but from that above information I cannot tell why. I suppose I could try to whitelist the entire range (24 ips) of mail servers the state has but , just to be sure Im reading right, if the SA 2/5 means the spam score then the only other rule is the attachments one, so by default thats what it would be?

Thanks again