Exiscan

[Rick Cooper]

> -----Original Message-----
> From: mailscanner-bounces at lists.mailscanner.info 
> [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf 
> Of John Schmerold
> Sent: Wednesday, January 24, 2007 12:30 PM
> To: MailScanner discussion
> Subject: Exiscan
> 
> Anyone using (or tried using)exiscan with MailScanner? Any feedback?
> 
> Exiscan is Exim's SPAM scanner.
> 

I use ExiScan with MailScanner and it's fine. I do the virus scan (with
clamav), I block basic file types we never accept (.exe/.cmd/.pif, etc),
CLSID attachments, Invalid MIME boundaries, Excessive Mime parts (> 256),
excessive line lengths ( > 32764), partial messages, file names > 512,
Boundary Space Gaps (broken mime), Long Mime boundaries, spam scored above
14 (I have never had a FP > 14), all with ExiScan. On the MailScanner side,
I add two AV products and block spam based on MailScanner rules. This let's
me use MailWatch to handle the quarantine and releasing there of, for the
lower scoring spam that could possibly be FP.

Now bear in mind I have a very informative reject message associated with
each of the ExiScan rejects but who pays attention to those? I use
MailScanner for more in-depth file-type/name analysis, more refined spam
handling and user messages for more obscure file-type/name rejections. Our
sites also do hundreds of emails per day not hundreds of thousands so the
cost of the above checks (spam/av) are not an issue. Were I handling very
large amounts of mail I would rather offload the spam/AV stuff entirely to
MailScanner. I currently use my own SPF perl program (embedded into Exim)
because there was a period where ExiScan hadn't update to the latest spf
libs, that has been handled but I am too lazy to recompile exim so you could
do that within exim as well. Also bear in mind you could, technically, add a
X-Spam-Free type header to those messages that fall below your MailScanner
threshold (in exim) and skip reprocessing them again in MailScanner but our
volume is low enough I have never bothered.

Rick


--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.