mailscanner + exim release from out queue

[Glenn Steen]

On 30 April 2013 09:49, Jonas Akrouh Larsen <jonas at vrt.dk> wrote:

>  Hi Glenn****
>
> ** **
>
> >That MailScanner doesn't operate at SMTP-time is exactly what sets it
> apart... It is the fundamental difference that make MailScanner perform so
> >much better, and suffer from so much less risk of DoS:ing, than amavisd ...
> ****
>
> >Sure, you cannot do "on the fly rejections", but ... AV/Anti-UCE scanning
> is to expensive at that stage anyway (IMO)... apart from the simple >things
> you can do in the MTA, that is (recipient verification, rfc strictness,
> graylisting etc). But the benefits of not doing it in one go, as amavisd
> >does, far outweigh that drawback.****
>
> >If one were to somehow wrangle MailScanner into action during SMTP... one
> could as well use amavisd instead;-).****
>
> >** **
>
> >As for choice of MTA, one should always stick with the one one is most
> comfortable with ... You're far less likely to foobar things if you know
> >what you're doing:-). If one starts from scratch, taking into account what
> happens to be the default on the system you use seem like a very sound
> >strategy:-).****
>
> ** **
>
> I’ve stuck with exim+MS for 5 years so I guess I must be liking it for the
> most part J****
>
> **
>
For the most pat, yes...:-)
Have been using Postfix/MS  for close to 10 years myself. Still a happy
customer;-).

**
>
> However I do find it annoying not being able to scan at smtp time, it
> would be much simpler for bounces and such, and rid my outgoing queue of
> mails I can’t return to sender because it was forged etc.****
>
> **
>
With the numbers you quote in a later response in this thread (20k/day with
about 20-40 bouces "living" in your outgoing queue at any given moment), it
doesn't sound that bad... Sure, one *could* miss something important in
theoutgoing queue, but ... once you look there, you tend to know that
you're looking for, wouldn't you say?;-).

You mention a few of these are due to systems downstream doing 4xx temp
failures, or similar... The way I work around this is by not doing a normal
"call ahead recipient verification", but rather maintain a relay recipient
file that I recreate (if the downstream hosts are available) every 15
minutes... That way, the normal scanning will take place as long as my MX
doesn't run out of disk for the queues. Don't know if this is easily done
in exim, but is rather trivial with postfix.
And yes, I do realize that doing things like that isn't optimal for a
service provider type of setup. But for the corporate side of things... It
just works dandily:-)

**
>
> Also it shouldn’t run in parallel, so it’s no more expensive than running
> it post smtp, since you don’t spam scan a virus, you don’t virusscan
> something listed on rbl etc.****
>
> **
>

But the thing is, with the load you describe, you very likely do have
batches larger than 1 message/batch... If you do "MS scanning" at
SMTP-time, you will not be able to do that.  Sure, you'd still "gain" the
intelligent order of execution MS has, but ... you'd miss out on the truly
impressive performance gain you have in the batching.
Also... Don't underestimate the DoS risk... While under fire on a normal MS
setup, the queue storage is likely to run out before the system croaks due
to processing ... overload ... Do MS at SMTP and the system will likely go
into memory deprivation/thrashing or plain run out of CPU before anything
like that can happen... IMO, that is:-).

 **
>
> But thanks for the comments J****
>
> **
>
You're welcome.

> **
>
> ** **
>
> Med venlig hilsen / Best regards****
>
>
>
Vänlig hälsning till dig med!
Cheers
-- 
-- Glenn

> ****
>
> Jonas Akrouh Larsen****
>
>  ****
>
> TechBiz ApS****
>
> Laplandsgade 4, 2. sal****
>
> 2300 København S****
>
>  ****
>
> Office: 7020 0979****
>
> Direct: 3336 9974****
>
> Mobile: 5120 1096****
>
> Fax:    7020 0978****
>
> Web: www.techbiz.dk****
>
> ** **
>
> ** **
>
> --
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
> Before posting, read http://wiki.mailscanner.info/posting
>
> Support MailScanner development - buy the book off the website!
>
>


-- 
-- Glenn
email: glenn < dot > steen < at > gmail < dot > com
work: glenn < dot > steen < at > ap1 < dot > se
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20130502/13b3f09b/attachment.html