Spam Fighting moved from MUA to MTA - success!

[merlyn]

I had been handling $[e-mail] by letting postfix deliver to my procmailrc, which fired up a separate Perl invocation to sort and deliver the mail for each incoming email. And test for spam.

The problem is the MIRVs. A lot of mail gets addressed to thereto@stonehenge, barney@stonehenge, merlyn@stonehenge, for about 10 addresses in one payload. And this type of spam seems to have greatly increased in the past few months. A burst would come in, and for the next two minutes, I was splitting and forking and Mail::SpamAssassin-ing, and loadav would hit 3 or so, and my sublease customers were complaining.

So yesterday, I bit the bullet, and learned about Amavisd, a preforking Perl daemon built around Net::Server, that could pull in SpamAssassin and some virus checkers. I carefully read the "README.postfix" file included in the distro, and set up everything.

Wow, what a difference. Now my postfix/amavisd MTA checks for spam once for the MIRVs, without forking, instead of 10 times with a lot of forking going on. My loadav has never exceeded 0.9! Hooray. Success.

I'm getting about 1 MIRV a minute. Ouch.

My only concern is that the amavisd is started and stopped outside the normal postfix engine, so I'm concerned about what happens when it goes down. (Postfix will just stop, but I won't be around to notice.) I'm thinking of a cronjob entry to just keep restarting it every half hour or so, just in case it fries.

[Aristotle]

Uhm, am I missing something, or couldn't you simply use spamd/spamc?

[merlyn]

From what I understand, spamc/spamd are command-line tools meant to work on one item at a time. There's no real place to plug those in at an MTA level. They work fine from an MUA level, but at that point, I'd still be calling it 10 times instead of once for each MIRV.

With amavis, I get to make one call to SpamAssassin per incoming MIRV, and that's the big win.

[kal]

You certainly can plug them in at MTA level. I've not much idea about postfix; but I've had it working in exim. You basically set it up as another transport, round-trip everything through that transport and set a flag so that you're not going round in circles.

spamc/spamd certainly are command line tools, but isn't everything?

[Anonymous Monk]

One thing I've noticed about most CUFP, is that typically there's some CODE in them somewhere. Or at least a link to code. This is some code I'd like to see. Where can I find it?