You can see a breakdown of any matched rules under the Tests: line when clicking on the plus icon for a message entry in the message log. Message scan times will also be included at the end of each log entry (in milliseconds). This is useful for performance debugging.
Example:
Passed SPAMMY {AcceptedInbound}
AM.PDP-SOCK [167.89.95.154] [167.89.95.154] /AM.PDP <bounces+3190231-9d63-mel.t=example.ca@email.marketing.example.com> -> <mel.t@test.com>
(167.89.95.154)
Queue-ID: 8B6A6405AC174
Message-ID: <WVQF-ccBSEW7qvSZeUwJ6A@geopod-ismtpd-0>
mail_id: On8b6VlSO_BP
b: jilxoWz0u
Hits: 9.667
size: 17080
Subject: "Wow
you got 2 clicks – see who! (raw: Wow
you got 2 clicks =?UTF-8?B?4oCT?= see who!)"
From: <membersuccess@example.com>
helo=o5.sg.marketing.example.com
Tests: [BAYES_00=-1.9,DCC_CHECK=2,DCC_REPUT_13_19=-0.1,DKIMWL_WL_HIGH=-0.687,DKIM_SIGNED=0.1,DKIM_VALID=-0.1,HTML_FONT_LOW_CONTRAST=0.001,HTML_MESSAGE=0.001,KAM_BODY_URIBL_PCCC=9,KAM_FROM_URIBL_PCCC=9,RCVD_IN_MSPIKE_H2=-0.001,SPF_HELO_NONE=0.001,SPF_PASS=-0.001,TXREP=-7.638,T_SCC_BODY_TEXT_LINE=-0.01,URIBL_BLOCKED=0.001]
autolearn=no autolearn_force=no
autolearnscore=19.205
languages=en
relaycountry=US
asn=AS11377_167.89.64.0/19
dkim_i=@marketing.example.com
dkim_sd=s1:marketing.example.com
3125 msRule Scoring
When looking at the Tests: line negative scores means that the rule is treating the mail as HAM (good email) while positive scoring adds to the final spam score treating the message as SPAM (bad email) if it goes over the policy spam level.
Tests: [BAYES_00=-1.9,DCC_CHECK=2,DCC_REPUT_13_19=-0.1,DKIMWL_WL_HIGH=-0.687,DKIM_SIGNED=0.1,DKIM_VALID=-0.1,HTML_FONT_LOW_CONTRAST=0.001,HTML_MESSAGE=0.001,KAM_BODY_URIBL_PCCC=9,KAM_FROM_URIBL_PCCC=9,RCVD_IN_MSPIKE_H2=-0.001,SPF_HELO_NONE=0.001,SPF_PASS=-0.001,TXREP=-7.638,T_SCC_BODY_TEXT_LINE=-0.01,URIBL_BLOCKED=0.001]