Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've been running an amavisd-new, spamassassin, postfix setup for a while to help crush spam on our incoming e-mail servers. The setup I'm using is a few years old at this point and its about time to rebuild on new hardware.

I was wondering if there was another approach to tackling this ever-present issue that might yield better results for our large mail system. I have no particular complaints about the current setup, other than the fact that we still are plagued by spam... :)

I'm mostly interested in free solutions, but might be willing to consider a paid software/third party service if the price is right.

Thanks in advance for any suggestions you might have.

share|improve this question
2  
Dear Close Voter - I'm aware that there is a certain amount of opinion here, but there are definitely factual answers to this question that will be helpful for people like me looking to setup a solid spam solution. –  gnarf Dec 20 '11 at 16:43
    
I'm afraid that not only is this somewhat subjective, but you're essentially asking a "shopping" type question, which is very much off-topic on server fault. Having said all that, we outsource our email gateway handling to mimecast. They and many of the companies like them give you some control of the scan settings, and generally do a good job. –  RobM Dec 22 '11 at 10:44
    
Yeah, but its a lot of help to me right now, and potentially someone else some day... Googling for this results in so much static its almost impossible... –  gnarf Dec 22 '11 at 19:45
add comment

4 Answers

I outsource to Postini. I like Postini, but I am not necessarily advocating for them. I DO advocate outsourcing your spam filtering though, for three major reasons:

  1. It saves my bandwidth - MX records point to Postini, spam goes to them, they filter, I get ham. I don't have to waste server resources or bandwidth dealing with incoming spam.
  2. I don't have to deal with making sure my heuristics are updating properly, or that I'm using the right blacklists. I have other issues that take my time that are probably more mission critical to my organization than that.
  3. It's distributed. If my network connection or power go down, or I change IP ranges, it'll queue mail for me then redirect to where I want it to go. It eliminates a single point of failure.

And it's not THAT expensive. I think I pay about 1/month/mailbox for it. That's worth it to me, to be honest.

share|improve this answer
1  
It is always a good idea to outsource, if you can trust the outsourcing company. They will probably not "read" your mails as the receive Billions a day. But the possibility persists. –  mailq Dec 21 '11 at 20:57
    
That same possibility exists for any unencrypted mail. It doesn't worry me that much, to be honest. We did a study of our clients, and they encrypt the sensitive stuff, or it never leaves their Exchange server. We felt the risk was minimal. –  Driftpeasant Dec 21 '11 at 21:10
add comment

If you're running postfix as your MTA, configuring the right DNSBLs is 90% of the solution :)

Also, since you say you're upgrading to latest versions, you will appreciate postfix' new SMTP triage server, postscreen.
It handles all RBL checking in parallel, and has an extensive black- and whitelist cache, thus easing the load on the parts of the system that actually matter (postfix and spamassassin).

share|improve this answer
    
Nice - Which DNSBL's do you suggest nowadays? I'm gonna do some research on postscreen –  gnarf Dec 20 '11 at 16:41
2  
I use zen.spamhaus.org exclusively; it deals with over 95% of all known bad IPs. Note that they do have a volume limit after which you need to pay for the service, but paying for it grants you permission to host local copies of the entire database. It all depends on your own volume, of course - I have it on authority that even millions of messages per month do not trigger them to contact you or deny you service. –  adaptr Dec 20 '11 at 17:04
    
Here are the usage limits: spamhaus.org/organization/dnsblusage –  Jason Nichols Apr 12 '13 at 14:46
add comment

You should not filter Spam. You have to reject Spam. This means you have to reject the mail during SMTP dialog. If you already accepted the mails then you are responsible for final delivery. And that can bring you in big trouble if your "filter" incorrectly identified a legit mail as Spam which then was dumped into trash. But if you reject the falsely identified mail, the sender will get notified.

So adaptr's approach is the correct one as it rejects Spam at the earliest. The second defense line should be policyd-weight which is like SpamAssassin for the data during SMTP dialog.

The third defense line should be an optimized amavisd-new setup as before-queue content-filter. But you have to check if it can cope with your load. Receiving 20-30 mails per second at this stage is no problem.

If you need a good DNSBL then check ix.dnsbl.manitu.net. It is optimized for recipients in Germany.

share|improve this answer
    
+1; for rejecting during SMTP dialog, but it's worth drawing attention to the distinction between reject and bounce. –  Bryan Dec 21 '11 at 22:25
    
I did not say anything about rejecting spam; you simply don't know whether it would have been spam or not. What i said was to use proper DNSBLs, which will reject clients that are in the blacklist. The corollary is, obviously, that you have to trust the DNSBL to block the right IPs. –  adaptr Dec 22 '11 at 9:45
    
@adaptr You did! Using DNSBLs means rejecting Spam. You may also reject Ham this way, but the DNSBL's intention is to list IPs from where Spam originates. So you use the third party knowledge to reject mails. –  mailq Dec 22 '11 at 17:05
add comment

I'd recommend an appliance. This is where using something like a Barracuda Spam Firewall or a Cisco Ironport is beneficial. The idea is that these devices keep the ugliness off of your servers. They're tunable and can be tweaked to your organization's needs.

Short of using one of the above, you can get by with what you have. I've been skipping zen.spamhaus.org since it's recently been a problem for users emailing from dynamic IP ranges (e.g. 3g/4g cards, certain ISPs). One of the value-add features of the Barracuda Spam Filter is Barracuda Central. This central reporting and spam database sits at the core of the of Barracuda's offering. It is also available to plug into mail systems like yours as an RBL. It's free, but requires registration - The RBL is b.barracudacentral.org. I'd suggest trying this and monitoring the results. I haven't had false positives while using this service.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.