Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I just wonder what their pros and cons are, and which is better for production use. Thanks~

share|improve this question
add comment

migrated from stackoverflow.com Oct 27 '10 at 0:35

This question came from our site for professional and enthusiast programmers.

3 Answers

I used to run Spamassassin and moved away from it. In my experience its problems are:

  • Extremely high memory requirement - it was using over 40MB per process which isn't great on a low-memory (512MB at the time) VPS. This overhead was probably mainly Perl, and probably highly sharable memory, but still.

  • Default scores do not reject much mail, needs a lot of manual tuning. So many of Spamassassin's manual spam scores were too conservative to block very much of the spam I was getting. I found myself constantly buffing the scores for individual rules to tip specific spam messages over my threshold. The default scores for the Bayes component pretty much cripple its usefulness; a well trained Bayes database on its own will never come close to being able to mark something as spam without many custom rule hits, which seem to be written for last years' spam, also firing at the same time.

I've since been trying bogofilter but I've run up against some of its limitations:

  • It doesn't have its own SMTP proxy or milter mode, so you can't really use it as a filter within Postfix on its own like you can with, say, Spamassassin. However, you can integrate it into proxsmtp which can then allow you to use it as an SMTP proxy and even, should you choose, as a before-queue filter.
share|improve this answer
    
If you search for 'bogofilter milter' you'll find a bunch of solutions. I have no experience with them though. –  mc0e Jun 27 '13 at 16:14
    
I have since found a solution in proxsmtp. –  thomasrutter Jun 28 '13 at 3:13
    
Bogofilter integrates well with Evolution in Ubuntu. –  rleir Feb 4 at 13:29
add comment

Firstly, you should expect to be dealing with well over 99% of spam before you get to the last ditch effort of heavy weight content processing. Checking sender domains, RBL checks, SMTP pipelining checks, and probably greylisting should all come before bayesian analysis or spamassassin.

I don't like spamassassin mostly because it doesn't give me enough flexibility to reject on the basis of light-weight checks without doing the heavy-weight ones at all. I regard it as only suitable for domains with light use (seconds per email rather than emails per second).

The dspam engine is quite good, but the supporting CGI program was pretty poor when I last looked (which was a few years back now). But maybe someone has taken on the task of finishing that off? It was a decent project, but looked like the author ran out of steam. In my experience dspam does very well initially, but significantly degrades with over-training.

I've tried bogofilter, some time before moving to dpsam. I forget the details, as i tried quite a few of them. I did like dspam better, but it was a few years back, and things may have changed.

One thing that's really important, is that doing a two way split between spam and non-spam is a bad strategy. You want an unsure category. The threshold for marking something as spam should be such that you should not need to go looking through it just in case it got something wrong. If you do, then what's the point? Spam-chasing becomes a hobby/time-waster rather than a way to get time back from spam. You should only be reviewing and training on the 'unsure' category. (If you do find errors in the other categories, train on them, but don't go looking for them).

Spambayes is another good one. Like bogofilter though, it's terms are single words. Engines which use word sequences like dspam does can do significantly better. (I'm not sure, but I suspect they're also more prone to over-training.)

share|improve this answer
add comment

All the above. No one method will provide decent spam protection, so you should be employing a combination of all those (and more) because each does have strengths and weaknesses. As for what those are, entire volumes have been written on the subject.

share|improve this answer
1  
I hate this sort of answer. Provide some information! –  reinierpost Jun 20 '13 at 15:01
    
Wish I could ban anyone who writes the phrase "entire volumes have been written on the subject" online without providing any links or examples. –  thomasrutter Feb 5 at 0:45
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.