I can’t think of a relation between shorewall and domain join. shorewall logs to firewall.log, clues could be found there.
I’m running an enhanced antispam since a couple of days and it seems really effective. I’m going to test your spam against it and let you know how it goes.