On 2024-09-07 at 08:20:42 UTC-0400 (Sat, 7 Sep 2024 08:20:42 -0400
(EDT))
Wietse Venema via Postfix-users <wie...@porcupine.org>
is rumored to have said:
Only a fool would expose SpamAssassin to the full mail stream.
Speaking as a SpamAssassin contributor: This is (almost) 100% accurate.
A huge fraction of an unfiltered mail stream of any domain with
substantial public exposure is total garbage that can be identified
without attempting to parse the actual message, due to idiosyncratic
SMTP behavior or source info. It is a waste of resources to do content
analysis on them solely to determine whether they are spam. Those
messages also tend to be the most unusual in their content, often
containing wildly malformed messages which break attempts to make sense
of them by "the rules" that normal messages follow. This can make
analysis more resource-intensive for such messages than "normal" mail.
In addition, tools like SA that have a learning component can be
effectively poisoned by examining so much pure garbage.
The only exceptions I see to this are for relatively low-exposure
low-traffic domains where the excessive load of analyzing everything is
manageable, the consequences of false negative spam tests are very low
(i.e. the users are sharp and paranoid,) and you have some basic
research goal behind seeing every message.
--
Bill Cole
b...@scconsult.com or billc...@apache.org
(AKA @grumpybozo@toad.social and many *@billmail.scconsult.com
addresses)
Not Currently Available For Hire
_______________________________________________
Postfix-users mailing list -- postfix-users@postfix.org
To unsubscribe send an email to postfix-users-le...@postfix.org
