delaying mail before passing to next hop

2014-11-13 Thread btb
hi-

short version:
i have an mx which, after doing the initial handling [postscreen, etc] of 
messages arriving from the internet, relays mail to another computer for 
content filtering [amavis/spamassassin]:

relay_transport = lmtp-filter:[mfa.example.com]:lmtp-filter-external

after a message has been accepted, i'd like to delay its relay to the content 
filter for five minutes.  can postfix do this?

longer version:
i've noticed a recent trend in which a message arrives, passes 
postscreen/various smtpd_*_restrictions, and is passed to the content filter, 
which passes it as clean, having not matched many rules [in particular, network 
tests like uri dnsbls, razor/pyzor, etc].

minutes later, the same message arrives [timestamps, message ids, etc differ], 
in that time has made its way into the results of various network tests, and is 
then marked is spam.

e.g. my consideration for this approach.  i'd also be interested in general 
thoughts on this problem, and other possibilities.  i'm not particularly fond 
of artificial delays, and the various implications [e.g. queue sizes, user 
expectations, etc], but in the context of a controlled environment [e.g. after 
postfix has accepted the message, i'm willing to at least entertain the 
possibility.

thanks-ben

Re: delaying mail before passing to next hop

2014-11-13 Thread Robert Schetterer
Am 13.11.2014 um 18:14 schrieb b...@bitrate.net:
 hi-
 
 short version:
 i have an mx which, after doing the initial handling [postscreen, etc] of 
 messages arriving from the internet, relays mail to another computer for 
 content filtering [amavis/spamassassin]:
 
 relay_transport = lmtp-filter:[mfa.example.com]:lmtp-filter-external
 
 after a message has been accepted, i'd like to delay its relay to the content 
 filter for five minutes.  can postfix do this?
 
 longer version:
 i've noticed a recent trend in which a message arrives, passes 
 postscreen/various smtpd_*_restrictions, and is passed to the content filter, 
 which passes it as clean, having not matched many rules [in particular, 
 network tests like uri dnsbls, razor/pyzor, etc].
 
 minutes later, the same message arrives [timestamps, message ids, etc 
 differ], in that time has made its way into the results of various network 
 tests, and is then marked is spam.
 
 e.g. my consideration for this approach.  i'd also be interested in general 
 thoughts on this problem, and other possibilities.  i'm not particularly fond 
 of artificial delays, and the various implications [e.g. queue sizes, user 
 expectations, etc], but in the context of a controlled environment [e.g. 
 after postfix has accepted the message, i'm willing to at least entertain the 
 possibility.
 
 thanks-ben
 

interesting, didnt notice such yet

you might hold mail, and release it by cron etc





Best Regards
MfG Robert Schetterer

-- 
[*] sys4 AG

http://sys4.de, +49 (89) 30 90 46 64
Franziskanerstraße 15, 81669 München

Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263
Vorstand: Patrick Ben Koetter, Marc Schiffbauer
Aufsichtsratsvorsitzender: Florian Kirstein


Re: delaying mail before passing to next hop

2014-11-13 Thread Noel Jones
On 11/13/2014 11:14 AM, b...@bitrate.net wrote:
 hi-
 
 short version:
 i have an mx which, after doing the initial handling [postscreen, etc] of 
 messages arriving from the internet, relays mail to another computer for 
 content filtering [amavis/spamassassin]:
 
 relay_transport = lmtp-filter:[mfa.example.com]:lmtp-filter-external
 
 after a message has been accepted, i'd like to delay its relay to the content 
 filter for five minutes.  can postfix do this?
 
 longer version:
 i've noticed a recent trend in which a message arrives, passes 
 postscreen/various smtpd_*_restrictions, and is passed to the content filter, 
 which passes it as clean, having not matched many rules [in particular, 
 network tests like uri dnsbls, razor/pyzor, etc].
 
 minutes later, the same message arrives [timestamps, message ids, etc 
 differ], in that time has made its way into the results of various network 
 tests, and is then marked is spam.
 
 e.g. my consideration for this approach.  i'd also be interested in general 
 thoughts on this problem, and other possibilities.  i'm not particularly fond 
 of artificial delays, and the various implications [e.g. queue sizes, user 
 expectations, etc], but in the context of a controlled environment [e.g. 
 after postfix has accepted the message, i'm willing to at least entertain the 
 possibility.
 
 thanks-ben
 


This is exactly why greylisting was invented.  Have you tried that?



  -- Noel Jones


Re: delaying mail before passing to next hop

2014-11-13 Thread LuKreme
On Nov 13, 2014, at 1:02 PM, Noel Jones njo...@megan.vbhcs.org wrote:
 This is exactly why greylisting was invented.  Have you tried that?

Greylisting has a host of problems of its own though. Even with a dedicated 
mail admin who is really trying to keep up on all the mail coming in, you 
*will* lose mail with greylisting.

-- 
Otto: Apes don't read philosophy.
Wanda: Yes, they do Otto, they just don't understand it.



Re: delaying mail before passing to next hop

2014-11-13 Thread btb
On Nov 13, 2014, at 15.02, Noel Jones njo...@megan.vbhcs.org wrote:
 
 On 11/13/2014 11:14 AM, b...@bitrate.net wrote:
 hi-
 
 short version:
 i have an mx which, after doing the initial handling [postscreen, etc] of 
 messages arriving from the internet, relays mail to another computer for 
 content filtering [amavis/spamassassin]:
 
 relay_transport = lmtp-filter:[mfa.example.com]:lmtp-filter-external
 
 after a message has been accepted, i'd like to delay its relay to the 
 content filter for five minutes.  can postfix do this?
 
 longer version:
 i've noticed a recent trend in which a message arrives, passes 
 postscreen/various smtpd_*_restrictions, and is passed to the content 
 filter, which passes it as clean, having not matched many rules [in 
 particular, network tests like uri dnsbls, razor/pyzor, etc].
 
 minutes later, the same message arrives [timestamps, message ids, etc 
 differ], in that time has made its way into the results of various network 
 tests, and is then marked is spam.
 
 e.g. my consideration for this approach.  i'd also be interested in general 
 thoughts on this problem, and other possibilities.  i'm not particularly 
 fond of artificial delays, and the various implications [e.g. queue sizes, 
 user expectations, etc], but in the context of a controlled environment 
 [e.g. after postfix has accepted the message, i'm willing to at least 
 entertain the possibility.
 
 thanks-ben
 
 
 This is exactly why greylisting was invented.  Have you tried that?

i don't know about exactly, but yes, i did briefly consider that greylisting 
would have a somewhat similar effect.  it would introduce a delay, but at the 
cost of all of the other side effects of greylisting, which would likely cause 
more problems than it would solve, imho.  that's why i wanted to do it after 
the message was accepted, where the onus can be fully on me regarding its fate.

-ben

Re: delaying mail before passing to next hop

2014-11-13 Thread btb
 On Nov 13, 2014, at 13.00, Robert Schetterer r...@sys4.de wrote:
 
 Am 13.11.2014 um 18:14 schrieb b...@bitrate.net:
 hi-
 
 short version:
 i have an mx which, after doing the initial handling [postscreen, etc] of 
 messages arriving from the internet, relays mail to another computer for 
 content filtering [amavis/spamassassin]:
 
 relay_transport = lmtp-filter:[mfa.example.com]:lmtp-filter-external
 
 after a message has been accepted, i'd like to delay its relay to the 
 content filter for five minutes.  can postfix do this?
 
 longer version:
 i've noticed a recent trend in which a message arrives, passes 
 postscreen/various smtpd_*_restrictions, and is passed to the content 
 filter, which passes it as clean, having not matched many rules [in 
 particular, network tests like uri dnsbls, razor/pyzor, etc].
 
 minutes later, the same message arrives [timestamps, message ids, etc 
 differ], in that time has made its way into the results of various network 
 tests, and is then marked is spam.
 
 e.g. my consideration for this approach.  i'd also be interested in general 
 thoughts on this problem, and other possibilities.  i'm not particularly 
 fond of artificial delays, and the various implications [e.g. queue sizes, 
 user expectations, etc], but in the context of a controlled environment 
 [e.g. after postfix has accepted the message, i'm willing to at least 
 entertain the possibility.
 
 thanks-ben
 
 
 interesting, didnt notice such yet
 
 you might hold mail, and release it by cron etc

thanks - cron came to mind initially for me too.  i wondered though if postfix 
might offer a mechanism of its own.