RE: [exim] Reducing Spam Assassin Load

Startseite
Nachricht löschen
Nachricht beantworten
Autor: Herb Martin
Datum:  
To: exim-users
Betreff: RE: [exim] Reducing Spam Assassin Load
Alun
> Sent: Monday, October 03, 2005 10:34 AM
> To: exim-users@???
> Subject: Re: [exim] Reducing Spam Assassin Load
>
> Marc Perkel <marc@???> said, in message
> 433FF09F.1000501@???:
> >
> > But no one has done anything to reduce load processing ham.
>
> Here's what we do. If I send mail to marc@???, my exim
> drops an entry in a database (auj@???,
> marc@???). Any mail from marc@??? to
> auj@??? is whitelisted on the basis that we've already
> swapped mails, and so doesn't go through out spam filters.


Which has the disadvantage of exposing you to
spam under several not too unlikely circumstances:

  1) Someone harvests addressess from a list (e.g.,
    this one) where you are both members and
    sends to some members from another member.


  2) You are both in someone else's email address
    book who becomes a virus/trojan bot and
    shares the lists or sends the spam directly.


3) Your actual correspondent is the victim in #2

  4) Your actual correspondent, especially in the case 
    of a commercian concern, becomes the spammer.


You can overcome #1 and #2 by using schemes like
SPF and the new (3.10) SpamAssassin whitelist_from_rcvd
(as opposed to simple whitelist_from), or the
greylistd (e.g., Python implementation) which can use
singlets, doublets, or triplets (sending_server, from,
rcpt) to whitelist (or blacklist.)

You can ameliorate #3 and #4 by using the whitelist ONLY
to offer a moderate/appropriate score adjustment and
still checking the spam.

But this latter does not reduce load on SpamAssassin.


--
Herb Martin