bounces, backscatter and anti-spam

[leigh]

Hi all,
I'm having a hell of a time with bounced email. Looking into a possible solution, I have a few questions:

At what point does scalix hand a message to spamassassin? Is it before or after scalix has determined whether it is destined for a valid email address?
We are getting lots of email to invalid email addresses. It seems a waste of CPU to have spamassassin examine these, when they are not going to be accepted anyway.

Is there any way to silently discard such messages, rather than bouncing them? We have a huge mail queue, all of which are non-delivery notifications. All destined for invalid addresses. This is getting in the way of delivering legitimate mail.

[Kris]

I think the best way is to have a seperate machine handling spam. I have a simple debian server with Postfix, amavis and spamassassin on it in front of my Scalix server. This machine does a lookup of valid users on the Scalix machine and is therefore able to reject e-mail for unknown users. Then, e-mail is checked with Amavis/Spamassassin for spam, viruses and unwanted attachments. I also use the Fuzzy-OCR plugin for spamassassin, which is very effective in dealing with image-spam.

If you need more information on my setup, let me know

[leigh]

I was hoping to avoid doing it that way.
I am, however interested in how you have postfix look up valid usernames on scalix?

[Kris]

At first, I had Postfix do LDAP lookups in the Scalix ldap server. That worked fine, but sometimes during a big spam-run, the load on the Scalix server went sky-high. So I changed this, I made a script that exports all valid addresses to a file and let Postfix do lookups in that file.

[adhodgson]

Hi,

Another really effective way for the lookup issue is to get the MTA on the front-end server to do recipient callouts to the Scalix box. If it is configured correctly, omsmtp should reject unknown users with a 550 code generated from Sendmail, and most MTAs cache these lookups, so load is really negligable (I have seen several very large providers do this).

Thinking about this, this should work with the Spamassassin setup that the OP has, but I prefer a front-end spam server for the reasons I want to keep load on the Scalix box to a minimum.

IMHO mails should be rejected as close to your borders as you can make it - that way, the bounces most often don't manifest, because the spam tools used to generate the messages either die or just give up on the 550 response from the SMTP server, or the bounce is handled by a server outside of your control, and is someone else's problem.

Thanks.
Andrew.