Hi everyone, I’d like to share an experience.

As I mentioned before, I migrated my mail server from Windows Server 2019 to Windows Server 2025. Unfortunately, apparently due to an issue on Cyren’s side, the license currently doesn’t reactivate correctly on the new server.

This pushed me to speed up my tests with SpamFoo and to raise its weights.

How I ran the checks

I created a service mailbox testspam that uses plus addressing with “move to folder”, so each variant lands in a different folder.

Then I created 3 events that run on all incoming email:

1. Spam level Low → add recipient testspam+non-spam
2. Spam level Medium → add recipient testspam+medium
3. Spam level High → add recipient testspam+spam-alto

This way I get a copy of all the traffic, already split by spam level.

Finally, I wrote a small tool that connects to this mailbox via IMAP and analyzes the message headers (see screenshots), so I can see exactly how the score is calculated. I also added some filters so I can “play” with the calculations and simulate different weights.

Result

As far as I’m concerned, SpamFoo nails it. I haven’t found any false positives – which are the ones that scare me the most – except for some service messages: when I looked into why, it turned out the senders had no DKIM (I’ve already reported it to the respective providers).

P.S. I still believe the SmarterMail spam filter should allow a two-tier weight for SpamFoo, based on the probability it returns:

• Spam,prob >= 0.90 → weight x
• Spam,prob < 0.90 → weight y

Right now a single flat weight means a 0.55 and a 0.98 count exactly the same, while the confidence behind them is very different.

P.P.S. Bounces coming from other mail servers very often fail both DKIM and SPF, and SpamFoo then gives them a high score.

This is the biggest anomaly I’m seeing. It’s not only SpamFoo’s fault – DSNs are sent with an empty envelope sender and are almost never DKIM-signed, so the checks are bound to fail – and in practice it works as a protection against backscatter.

The downside, of course, is that users end up finding legitimate bounces they actually care about in their Junk folder. Anyone handling DSNs differently?