My recent approach which appears to be working well is to rely on routing rules first then custom spam filters 2nd.
My rules are
so rules top to bottom...
ignore first two, they are for inhouse auditing
OKOKOK... these are domain and emails that are known safe senders. Rule bypasses the rest of the filters
BOPBOPBOP... uses common phrases that the end users will send. rule bypasses the rest of the filters
CNN - currently experimental
delete - this is the known bad phrases and keywords, such as walmat steak CVS lowes Sams etc. instant delete
delete1 - testing out phrases until they are known to work without false positives then are moved to 'delete'
bounce - our use
last three, general phrases / domain names / emails etc to go to quarantine
Reason I have some rules in CAPs is that they stand out better in the routing rules logs.
so now I have a quarantine folder filling up...
I have requested a feature to add a subject line column to make search easier, but for the time being, I use Thunderbird and the "ImportExportToolsNG" addin to export the quarantine folder to the spam mailbox. I can import either by day or all folders. I tend to just go by day
which imports the emails
from here, I can see any false positives. If any are found, they are added the OKOKOK rule and then are resent from the quarantine. if the OKOKOK rule is set correctly, the email will continue to the end user.
Anything that still gets through then hit the spam checks..
again, trusted senders are given a very high weight to counter any RspamD weights and to also add weight where needed.
Next, the content filters look at the emails weight and if it's high, it's redirected to the spam@ mailbox. If it's medium, it goes to the end user with the subject prepended with [Junk E-Mail]
we are a low volume of emails, maybe 5000 or so a day across 103 mailboxes. The number of spam emails that get all the way to the end users are maybe 10 per week and they fwd those to me so that I update the filters.
However, my approach is still hands on. I need to check the quarantine daily, but it's a 5 minute job to review and update.