Still not really getting anywhere with this, more spam to multiple mailboxes today going unnoticed. Scoring between 0.5 and 3.29. Pretty much all have the same score, they keep coming and its not picking them up (nor i guess learning as it seems to class them as ham). Previous SA setup caught these all the time.
You have to understand that there is no "allrounder" solution in fighting spam. You have to analyse and understand your mailserver, users and mails you get and adjust it to what works for you. Generally speaking, it might be a good idea to implement DCC into your rspamd configuration, to fight these mails way better. Have a look at https://www.rspamd.com/doc/modules/dcc.html and https://www.dcc-servers.net/dcc/ Have a look into this blog post to get a better understanding of rspamds configuration and default values/scoring: https://www.0xf8.org/2018/05/an-alternative-introduction-to-rspamd-configuration-introduction/
