It may also help to increase the logging level in Amavis from the Zimbra-set "1" to "2". You can do this by editing as root the following line in /opt/zimbra/conf/amavisd.conf.in and then restarting Amavis.
Originally Posted by rabettle
Note that this file is set to be read-only, so to edit the file you'll need to change the file's permissions first (via the "chmod" command), edit the file, and then (ideally) set the permissions back the way they were before you started.
mail2:~ # cat /opt/zimbra/conf/amavisd.conf.in | grep "log_level ="
$log_level = 2; # verbosity 0..5 - 1 is the minimum for msg tracing
Increasing the logging level to 2 we have found helps answer the question "Why was that email marked as spam?" In /var/log/zimbra.log, Amavis will no report every specific test that added to the score of an email, as well as by how much, like so:
Hope that helps,
Feb 3 10:55:27 mail2 amavis: (25278-06) SPAM-TAG, <email@example.com> -> <legitimate_user@legitimate_domain.com>, Yes, score=6.862 tagged_above=-10 required=5 tests=[BAYES_50=0.8, DKIM_SIGNED=0.1, HTML_IMAGE_RATIO_02=0.437, HTML_MESSAGE=0.001, MIME_HTML_ONLY=0.723, RCVD_IN_BRBL_LASTEXT=1.449, SPF_PASS=-0.001, T_DKIM_INVALID=0.01, T_REMOTE_IMAGE=0.01, T_RP_MATCHES_RCVD=-0.01, T_URIBL_BLACK_OVERLAP=0.01, URIBL_BLACK=1.725, URIBL_WS_SURBL=1.608] autolearn=no