You can use the spam thresholds, Preferences->Quarantine Settings items S-100, S-200 and S-300, to control what is done to trapped messages based on their score.
- Messages scoring S-300 or greater but less than S-100 will be trapped in the pending quarantine and, if enabled, will be reported in the notification email.
- Messages scoring S-100 or greater but less than S-200 will be trapped in the spam quarantine. Users will not get notification of these messages but they are available for review and can be accepted for delivery.
- Messages scoring S-200 or greater will be discarded and the only record will be in the CanIt logs.
The default for S-300, the spam threshold, is 5 and this number has been derived a large body of experience by Roaring Penguin. We do not recommend making large deviation from this value. If you do change it we recommend make changes of 0.1 or 0.2 and then waiting to see if it is having the desired effect before making additional changes.
The default S-100 threshold is set to 2000 which is very high. You can likely lower this to good effect. If you look at the mail trapped in pending, if there is a score above which no non-spam has been trapped you can use this for S-100. This way the pending quarantine will not get clogged with message that are very likely spam but just in case you still have access to them if necessary. We typically see clients setting S-100 to between 15 and 30 but you will have to determine what is appropriate for your case.
The default S-200 threshold is set to 1000000, which is beyond which any non-spam message is every likely to achieve. We typically see clients setting this to between 20 and 30 points above the S-100 threshold. Once again you have to consider what you are comfortable with in your situation because once a message scores above s-200 the message is gone.