Do I need SpamAssassin?

[Peter Bonivart]

On Thu, 2003-05-08 at 22:28, Kevin Spicer wrote:
> >So, if I use SA can I turn off MS spam features and only use it for
> >attachment filtering then? Will I gain any speed by that?
>
> MailScanners spam features (apart from SA integration) are just RBL
> lists. Normally you would either use RBL's in MS _or_ SA (not both) -
> personally I favour using it within SA (That way you can use the less
> reliable RBLS and just assign them a low score so they contribute, but
> aren't the only criteria).  Alternatively (if you have a big spam
> problem) you can set sendmail up to use the RBLS to block all mail from
> those addresses and turn off RBLS in MS and SA.

OK, I will only use attachment filtering then and do all spam handling
in SA.

> >I don't get the scoring system either, why do I need a score? Isn't the
> >mail supposed to be marked as spam so the client (Outlook in my case)
> >can decide what to do with it? Does Outlook use the score, I haven't
> >used it for a while?
>
> SA passes each mail past a series of 'rules' or tests.  These can be
> tests of the headers, common phrases or formatting tricks in the body,
> RBL tests, DCC Razor or Pyzor tests etc. etc.  Each rule carries a
> score, if a mail triggers the rule then the rules score is added to the
> score for the mail.  Therefore the higher the score the more likely a
> mail is spam.  You pick a threshold score above which you wish to tag a
> mail as {SPAM?} - you can set this as low or as high as you wish
> (although I don't personally deviate far from the default setting of 5).

Thank you, that was a very good explanation. Sorry for asking another
question, can you mark and deliver a message with a score of 5 and
delete a message with a score of let's say 10 which is surely spam? The
question is really if there's several thresholds with their own action
associated?

> >Finally, a question about performance. If I have an MTA box in a DMZ
> >running Bind and Sendmail (sending and receiving mail on the internet)
> >and the load is really light (we average about 5.000 messages/day)
> > would a similar box be sufficient for MS, SA and anti-virus scanning
> > to be placed between the MTA and Exchange? The box I'm referring to is
> >a Sun Fire V120 with 550 MHz UltraSparc-II and 512 MB RAM. Will I need
> > more CPU and/or RAM?
>
> I ran a similar load for months on a desktop Pentium 500 with 256M of
> RAM, running Linux with no load problems at all (that said I tend to
> really strip my machines back, no X or anything like that) I was also
> running bind but only as a caching nameserver, purely for the benefit of
> sendmail.  So I'd guess you'd be fine.  I don't see why you need to put
> MS on a seperate box though.  Its probably easier to use your existing
> box since MS doesn't interfere with your sendmail configuration.  One
> its installed you stop sendmail and start MailScanner (MailScanner will
> kick off sendmail with the correct command line arguments for you).  If
> you have problems stop MailScanner and start sendmail.  Easy as that.
> If you do have performance issues try put the mailscanner work directory
> in tmpfs.

I want to keep the boxes available from the outside as simple as
possible to get the best uptimes and easiest upgrading for good
security. The box between the MTA and Exchange is on the inside and can
be more complex needing more upgrades and so on.