Avoid double scan

[Neal L]

My apoligies to the list:  I sent the following message a few minutes ago
with the subject line "Re: Double sendmail processes" instead of the correct
subject line above.

I would be very interested in this as well.  We run several mailscanner
boxes here which are handed email in a round-robin fashion.  We choose to
scan all incoming and outgoing email for spam and viruses so simply
whitelisting our internal addresses wouldn't work for me.  Unfortunately
some users who receive their email on their own systems (after MailScanner
has already scanned them) have a forward rule that sends this email back out
of our system (for instance, to a gmail account).  In this case we end up
scanning the same message twice.

It would be great if MailScanner could identify a message that has already
been identified as spam by looking for the "X-so-MailScanner-SpamCheck" line
(one would, of course, want to use a customized line here so that a spammer
couldn't just put the generic line in a message) and then just pass it along
with the previous score rather than running the spam checks again.  My
thought is that this would be fairly safe because (1) we would only do this
for messages that have already been found to be spam, and (2) because we
only trust our own custom headers.  To be a bit safter we could only allow
this rule to be triggered if a message comes from certain IP addresses.

Is there a general interest out there for this kind of a thing?  If so, I
wonder if it's something Julian would be interested in implementing.

Neal L.

Stefano Carlotto wrote:
> Is it possible to make a trusted MailScanner 'sign' email message in
> such a way that another MailScanner do not scan messages again?
> I was thinking that in a situation with multiple mail server it may be
> useful in order to reduce global systems load. Of course the choice of
> not to scan messages should be based on the capacity to recognize the
> sign of the friendly server and on the time passed from the previous
> mailscanner scan.
>
> thanks.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20061018/f4c2eb18/attachment.html