sa_mail_body_size_limit and attachments

[Alex]

Hi,

> Finally, Alex reported FP with 8MB file, but didn't answer which rule caused
> it.
> Alex, if you read this, please provide the file (if possible) or which
> SA rules caused the FP, possibly with text they matched.

It was one of the KAM rules. We've addressed it with him, and
determined it's arguably spam anyway.

Can I also ask about legitimate mailer-daemon mail being tagged as
spam? Even mailer-daemon mail should be processed, correct?

This particularly appears to be the result of mail that's being
forwarded through one of our servers by a user with a ~/.forward to a
domain that's processed by Microsoft 365. The bounce is coming back
from their domain to our relay servers responsible for the domain, not
the server with the user's ~/.forward file. Obviously the .forward is
problematic, but not something that can be changed right now.

Because of this, it's failing one of our local rules that checks for
spoofed recipient domains. Perhaps I just need to create an exclusion
for this, based on the empty envelope-from?