As I've read a few articles on DSPAM claiming that it's better/faster/sexier than spamassassin, I would appreciate having this list's comment on DSPAM. I'm sure quite a few of you have tried it and might have some interesting experiences to share. My understanding is that DSPAM relies solely on algorithms (Bayes, CHI^2), and that complications arise when you have to teach your users on how to train the system (which SA doesn't require as it's based on other things aside from Bayes).
Hi Mathieu,
I haven't done any carefully controlled studies, but I've been very successful with SpamAssassin. I think SA has the better approach. Spammers have gotten quite good at fooling the pure algorithm methods. Some get their messages' spam probabilities down to 50% or so if not lower, mainly by including a lot of innocuous text in their messages. If you can also use DNS-based databases to look up IP addresses and domains associated with known spammers, plus other rules such as known ratware patterns in headers, keywords like 'viagra', and use that information in combination with the Bayes and other algorithms to determine messages' spamminess, you will have better accuracy. Blacklisting domains that are included in the content of spam messages has been a very successful technique for us.
Unfortunately, SA is a real memory hog and has higher hardware requirements than DSPAM to handle the same message load. But that's not a big issue for us. We average about 25,000 messages per day from the Internet with ~400 users. SpamAssassin is running on a dedicated Athlon 1.5 GHz machine with about 750MB of RAM, and we haven't had any problems. Peak RAM usage is about 600MB.
