[SLL] [SLL} Re: Anti-spam methods

[Jules Agee]

Glenn Stone wrote:
> On the other hand, I have found greylisting, which is almost but not quite a
> challenge-response mechanism which is *built into SMTP*, to be quite
> effective.

Seconded. Last week our server was hit with 257791 SMTP connections.
40974 messages got past the greylisting function. SpamAssassin tagged
25350 of those with a score above 5, leaving 15624 presumably legit
messages unmolested. A few spams still get through due to conservative
SA tuning, but not many.

> I've found that a well-trained SA implementation can safely kill
> anything above 10.0 without fear.  Sometimes I'll get an FP as high
> as 7.something with SA, but very very rarely.

Also seconded. 10 seems to be the magic number; I haven't seen any FPs
that high. I plotted a SA score graph for our mail traffic about a year
ago (before we implemented greylisting). At that time, about 45% of the
spam we received scored between 12 and 15, so a good kill threshold is
probably somewhere around 10-12.

-Jules