Spam not marked as [-SPAM-]

[#1]

Thank you, gashouse, for letting me know.

[#2]

Maybe I spoke too soon, more unmarked spam arrived today.

[#3]

Since about 10:00 on 19-Nov-2025, Spam / Junk emails have not been marked with "X-SPAM  Yes"

It looks like the PN Spam filter is present but detection failed as we have :

X-pn-pstn-db:" Spam 99
X-PN-Virus-Filtered: by PlusNet MXCore (v5.00)
X-PN-Spam-Filtered: by PlusNet MXCore (v5.00)

[#4]

Yes, i have had lots of X-pn-pstn-db:" Spam 99 without the X-SPAM  Yes, but i was not sure what the 99 means!

[#5]

X-pn-pstn-db:" Spam 99 also exists in our genuine emails.

A spam handling Rule or Filter based on this would have too many false positives.

[#6]

I agree that filtering without x-spam Yes would not work ok.

The question is why is it missing.

[#7]

X-SPAM along with the Plusnet Members Centre are both AWOL

[#8]

Looks like Plusnet has changed the spam filtering, maybe related to the Greenby migration?

Cause of missing X-Spam header:

➡️ Plusnet upgraded your filtering backend to MXCore v5, which uses X-PN-* headers instead of X-Spam ones.

The new headers you see are correct and mean spam filtering is active.

The closest equivalent to “X-Spam: Yes”

Rule 1 – Match any message identified as spam by Plusnet

Header contains: X-PN-Pstn-Db: Spam

This will catch all messages classified as spam (whether 80, 90, 99, etc.).

Use when: You want the same behaviour as “X-Spam: Yes”.


---

🔥 More strict (top-level spam only)

If you only want definite spam (like the old >95% spam confidence):

Header contains: X-PN-Pstn-Db: Spam 9

This will match:

Spam 90

Spam 95

Spam 99
(and anything above 90)



---

🛡 Equivalent “safe catch-all”: filter any message processed as spam**

If your client is simple (e.g., Outlook rule based on “with specific words in the message header”), use:

Header contains: X-PN-Spam-Filtered: by PlusNet MXCore

This fires on every message that the spam engine examined, including those scored as spam.

(Good fallback for Outlook users.)


---

👍 Recommended Best Practice (most accurate)

Use both conditions:

Header contains: X-PN-Spam-Filtered: by PlusNet MXCore
AND
Header contains: X-PN-Pstn-Db: Spam

This guarantees:

The spam scanner ran

The message was actually classified as spam


This is the closest behavioural match to X-Spam: Yes


Question is mail flagged [-SPAM-] with the new filters?

[#9]

X-pn-pstn-db:" Spam 99 also exists in genuine emails - i.e. is not usable

[-SPAM-] still does not appear in the Subject.

[#10]

Ok try this
Equivalent rule — matches ONLY actual spam

This is the closest possible equivalent to X-Spam: Yes:

Header contains: X-PN-Spam-Filtered: by PlusNet MXCore

This header is only present when Plusnet itself has classified the email as spam, and will NOT appear in legitimate emails even if they have Spam 99.


---

🧠 Why this works

The score (Spam 99) is raw data, not the result.

The Filtered header is the final verdict.

Only emails that Plusnet has decided are spam get the X-PN-Spam-Filtered header.

HTH

[#11]

From a review of recent emails, these are headers showing the version of the spam filter,
not spam rating of the content of the message or the detection of a virus.

This is from a spam message :

X-pn-pstn-db:" Spam 99
X-PN-Virus-Filtered: by PlusNet MXCore (v5.00)
X-PN-Spam-Filtered: by PlusNet MXCore (v5.00)
Subject: Exclusive Costco Offer: Free Ninja Creami Ice Cream Maker!

This is from a genuine email ( we are a VM customer ) :

X-pn-pstn-db:" Spam 99
X-PN-Virus-Filtered: by PlusNet MXCore (v5.00)
X-PN-Spam-Filtered: by PlusNet MXCore (v5.00)
Subject: Your Virgin Media bill is ready 

 
This is from an email I sent to myself :

X-pn-pstn-db:" Spam 99
X-PN-Virus-Filtered: by PlusNet MXCore (v5.00)
X-PN-Spam-Filtered: by PlusNet MXCore (v5.00)
Subject: SPAM filter test

[#12]

@PhilipHeyes

Can you post up the full header from your known non spam email, redacting any personal information.

[#13]

This header is for the message sent to myself, the sender and recipient have been redacted.

Attached as a PDF ...

[#14]

It's looking like the Plusnet / Cloudmark spam scoring has been tightened up , not surprising in the current circumstances.
However that doesn't answer your original question. @Townman flagged this to the business in an earlier post

[#15]

It just looks very broken to me !