I'm going to drag out my favorite dead horse and beat him some more.

If we had Spamassassin addon for SF there would not be a need to constantly keep writing keyword filters. SA is constantly being updated and can be extended. We use it as a filter after SF and are amazed at how much stuff it catches, including the amount of image spam. Whats frustrating is that there is no way to have SF learn about this spam so it can update its bayes engine and start catching it first. Thats the only item missing from making SF and SFE the cats meow.

I am using a copy of alt-n mdeamon v8 that we already had and sending all SF output to it. The Mdaemon just does SA and acts as a gateway to our mail servers. I have a content filter that checks to see if an entry was whitelisted by SF and if so just send it on its way, otherwise I have SA check it. I have certain rules for different weights that either throw it away or if its borderline, put it in a folder in MDaemon and have a human being (me) check it once an hour. When I check that folder I have the option of putting that email in different folders and i have created asp scripts to process whats in those folders every five minutes.

I have a surbl folder and anything in that folder is looked at with a script to find a valid url and I add that to my private surbl engine we run.

I have a whitelist folder and any email put in there has an asp script that extracts the from and to addresses and creates an entry in SF's autowhitelistdelivery.txt file and also sends the mail on its way

I have ham and spam folders that help SA tune its bayes engine and that runs nightly.

Just by moving these boderline emails to different imap folders I can manage the spam.

One other thing I forgot to mention is we scan the outgoing mail log and we create autowhitelistdelivery.txt entries so that cuts down on false positives as well.

All in all its pretty complicated but I hate spam and my 5000+ customers get so few spams that they are surprised when they do get one.

There is no perfect (windows based) spam system out there and I have tried them all, but have noticed that ALL of them have the ability to use SA (except SF )

Webguyz - regarding your spamassassin setup

how many domains and what email volume are you running on SFI?

We moved over from a *nix solution which included SA, because it kept on dying on us. we'd get thousands of messages which would delay for over 24 hours. of course our clients were not impressed.

In our environment, it's not feasible to check spam folders. the other day i looked at a clients spamfolder, (we have to forward all messages to the client, but spam is kept in a different folder on the mail server.), and over a period of 4 weeks there were over 100,000 (one hundred thousand) spam emails there :(.

Since we've started using SFI we don't experience the mail delays problems, and i'm afraid to put in SA and start having these problems again. We run multiple (read a couple hundred ) domains on SFI, which are routed to various mail servers. But i would love to make use of SA asa an added filter.

Thanks.

ImInAfrica,

  For a high volume site like yours what I do is probably too hands on. Another member here, kspare, told me about their setup which might work for you.

   --- > SF1 ---> SA --->SF2

It involves 2 instances of SF and whatever filter system (SA, or whatever) you want to incoporate.

The first SF gets the initial email and does primary spam filtering and then forwards all email to middle device (lets say its SA) and there SA will tag spam (not drop it) that scores very high with some special tag you designate and then sends to seconds SF. The second SF instance sees that special tag and a filter adds it to the quarantine db.

The upside is that there is not a lot of handling of the SA stuff by you or your personal, but users do have to check their quarantine often.

The downside is that the 2 SF instances don't share common knowledge (like in bayes) so there is no learning going on. All you've done is quarantine but everytime that mail come thru it won't be stopped at the first SF. No matter what you do its a kludge and nothing will replace having it builtin to SF and SFE.

Now if EVERYONE told Roberto how they feel about SA being included it might happen someday because LogSat does listen to their customers, but the customers must let LogSat know what features they need.

Happy Holidays!

Hi Roberto,

What is the likelyhood of a SA addin being made available for SFI? I'm seeing a lot of this spam also and can't seem to be able to get my head round RegEx, dispite reading over and over the examples etc.

Regards,

Lyndon