On 2024-04-11 at 03:41:37 UTC-0400 (Thu, 11 Apr 2024 15:41:37 +0800)
Mr. Peng via Postfix-users <vir...@gmail.com>
is rumored to have said:
Thanks for all the help.
BTW, is spamassassin still a popular option for antispam today? or
should I
use rspamd instead?
SpamAssassin is still pretty popular and we just made a new bugfix
release. I am biased as a member of the SpamAssassin PMC, but I think it
is a very good choice for many sites and it has a large mature user base
with a lot of support available. I have heard much good about rspamd
from sources I trust, but I am not directly familiar with it. Were I to
set up a new mail system today without legacy reliance on SA, I would
probably try using rspamd just to learn about it.
Regards.
On Wed, Apr 10, 2024 at 10:23 PM Bill Cole via Postfix-users <
postfix-users@postfix.org> wrote:
On 2024-04-10 at 05:46:36 UTC-0400 (Wed, 10 Apr 2024 17:46:36 +0800)
Mr. Peng via Postfix-users <vir...@gmail.com>
is rumored to have said:
I have been using spamhaus, spamcop, sorbs as the RBL providers for
antispam.
But some of the customers speak to me about the FP issues caused by
RBL.
Do you think the three RBL above are reliable in a practical system?
Those are three of the best, but you have to understand that they are
complicated and may not fit YOUR needs.
Spamhaus offers multiple DNSBLs which each has a vey specific
definition,
which they aggregate in the "Zen" list which uses reply value to
indicate
which component an address listing belongs to. Not all component
lists of
Zen are appropriate for all MTAs. Spamhaus is extremely careful about
making each list reliably represent what they claim it represents.
They act
quickly on the rare occasions when they inadvertently list sources of
legitimate email.
SpamCop is based on actual feeds of spam from many sources, and when
they
list an IP, you can be certain that it recently sent spam. They do
not
exempt major mailbox providers who are also major spam emitters. If
you use
the SpamCop list as an absolute test, you will reject some legitimate
mail
which shares an outbound MTAQ with spam. Reliably.
SORBS is also informed by multiple sources of spam, and like SpamCop
they
do not exempt mixed sources. Like Spamhaus, they have both
independent
DNSBLs and an aggregated list that uses distinct return values for
each
component list, so you need to take that into account when using it,
to fit
the different sorts of listings to different interfaces. Like
SpamCop, some
of the SORBS components intermittently list major mixed sources.
You really need to look at your DNSBL choices carefully and with an
understanding of your users and their needs. You may want to consider
using
them in a more complex filtering tool like SpamAssassin where it is
possible to weight the impact of different DNSBLs to fit your needs
and to
make explicit direct exemptions if you like.
--
Bill Cole
b...@scconsult.com or billc...@apache.org
(AKA @grumpybozo and many *@billmail.scconsult.com addresses)
Not Currently Available For Hire
_______________________________________________
Postfix-users mailing list -- postfix-users@postfix.org
To unsubscribe send an email to postfix-users-le...@postfix.org
_______________________________________________
Postfix-users mailing list -- postfix-users@postfix.org
To unsubscribe send an email to postfix-users-le...@postfix.org
--
Bill Cole
b...@scconsult.com or billc...@apache.org
(AKA @grumpybozo@toad.social and many *@billmail.scconsult.com
addresses)
Not Currently Available For Hire
_______________________________________________
Postfix-users mailing list -- postfix-users@postfix.org
To unsubscribe send an email to postfix-users-le...@postfix.org
