For the last month or so I've noticed a shift in spam content.
Basically still getting a lot of it but there's a new focus on fake jobs offers.
They all look the same, all take to a fake Seek.com payment page.
The main difference though is SpamAssassin on the mail server is Not detecting those as spam (whereas all the usual manhood spam stuff does).
Why do these get not flagged as spam? any tweaks to the server that can help?
Since I started using using Spamhaus's Zen DNSBL and their DROP list it's cut down the e-mail even getting to SA by 99%. Zen is a combination list of IPs that have been blocked because of known open relays, past spam violations, or their netblock owner has policy-listed them. The DROP list is a list of IPs known to be owned by businesses that send spam.
I really like SA, but taking a layered approach to e-mail filtering seems to work best these days. My MTAs also check SPF and strictly follow the record.