Email marked as SPAM - How to know why?

Question

Hello guys, 
 We currently have one Sophos SG210 with Email protection activated. 
 SPAM filter (in Antispam tab) is on and behavior is to warn our users with a [SPAM] tag. 
 However, a user reported me that several emails from DHL (shipment confirmation - no attachment / only text) were on her "Junk email" folder. 
 Is there a way to have an information why these emails were marked as [SPAM] by SPAM filter? I tried to consult the logs but don't see these mails as SPAM and in the mail manager, there are marked as delivered (which is true in fact but they were tagged) however. 
 Kind Regards, 
 DeltaSM

DouglasFoster · Accepted Answer

For most items, the answer is No. UTM forwards a hash of the message to the spam service and gets back a result. As a result, the inner workings of the spam engine decision process is not visible. In the logs, you can look for dkim_status="value" (dkim result), ctasd_status="value" (spam engine result) and reason="value". Most likely, you will simply see ctasd_status="confirmed". 
 There is also a token for ctasd_params="value", but I have not found it to contain anything useful.