[TriLUG] Another seal broken... thinking of installing a C/R anti-spam system

[Brad Jorsch]

On Mon, Jan 29, 2007 at 08:58:41AM -0500, David McDowell wrote:
> In this thread we've seen some metrics and performance opinions on
> greylisting... what about the latest spamassassin working with
> sa-update?

It's hard to say, since so many spammers get caught before they even get
to SA. Last week we had 9.5K connections, 1.2K successful MAIL FROM
commands, and 894 messages actually got delivered. Yeah, we're not very
big.

SA logs report 956 messages checked. Scores ranged from -3 to 9048 [1],
and anything over 12.0 gets rejected immediately. 70% of messages are
scored less than 1, 83% less than 5.

Just using the spamassassin.org rules here. Haven't had a chance to
really look for extra rulesets I might want to include.


[1] I have one local rule scored 9000, along the lines of the
FORGED_*_RCVD rules. I also blacklist any host that hits this rule,
which further throws off the numbers.