Chris Turan wrote:
Terry Carmen wrote:
To eliminate *sending* backscatter, all you need to do is not accept
mail you won't be able to deliver:
I am rejecting unknown recipients but the bounces are coming from
messages with a spamassassin score above 12.
Don't do that.
Once you've accepted a message, it's yours. Aside from anything else, it
makes you look bad when someone sends a legitimate email that happens to
"look" spammy and you bounce it back as spam.
One of my clients HOLDs spammy messages for manual inspection by the
postmaster, then releases or deletes it. Another one lets the users
email application deal with the messages based on the spamassassin header.
Unfortunately, there's still no such thing as a "free lunch" and both
the virus and spam scanning are not exactly speedy, regardless of how
fast amavis is. The trick is to reject everything possible using
other means (blacklists, regular expressions, other tests) before
finally sending the message to the scanners.
Hmmm. I did get a suggestion about checking the headers against RBL's
using builtin postfix content filters. After that, it can be passed
onto the real scanners.
You just about have to use an RBL or you'll get creamed. However before
sending it to the RBL, reject everything possible using less
(processor/network) expensive methods like rdns verification and regular
expressions. See "Re:RBL" on this list for more information.
That said, it depends very much on your mail volume and how much is
spam and how much is ham. I have a small (2 processor, 512M/RAM) mail
server that runs anywhere from 30K-60K connections/day, rejects way
over 90% of the attempts and still only runs at less than 2%
utilization until the spam/AV scanners are started, at which point it
runs around 50% for a few seconds, then goes back to 0.
I get 10K emails per day, so its still fairly small. Do you have a
before-queue scanner installed? There are warnings all over
amavisd-new's documentation saying not to use it as a before queue
scanner and rightly so.
I have no before-queue scanner. I reject everything possible based on
the senders IP, existence of an rdns entry and some regular expressions
(see Re:RBL"). Anything that makes it past there is never rejected or
bounced, no matter what. It either goes to the final recipient or is
deleted based on corporate policy (chain letters, porn, etc.)
Back to your actual problem, if you can post the output from postconf
-n, someone can probably tell you what's wrong.
Terry
