Back in the day I ran an anti-spam service, users would point their MX to my server(s), I'd do the filtering and pass on valid mails to their real hosts. It wa

Back in the day I ran an anti-spam service, users would point their MX to my server(s), I'd do the filtering and pass on valid mails to their real hosts. It was a great learning experience, and I got to see a lot of volume. Sadly I never had enough customers to make the jump to the big-leagues, but it was fun. (I'd do proper SMTP-time rejection, but also archive rejected mails in a database for 30 days. Letting you browse / search through the rejected stuff - just in case I made a mistake, and also to see how good I was doing.) Even then content-scanning was not the best, but I used a lot of heuristics and I was quite proud of some of them. For example I "defeated" fast-flux hosts, via heuristics to lookup the number of addresses for a domain. Even large domains such as gmail only have 1-4 address-records, though of course their anycast and multiplexed. If you got a mail from a domain with 7+ MX records it was 99% spam.) At one point I documented damn near everything, after I'd shut down, but it seems I left the domains I used expire. I should see if I can dig out copies. (I used qpsmtpd as my core, and wrote a ton of glue code and custom plugins. Later the qpsmtpd-proxy was ported to javascript as Haraka - but I didn't covert my code even as I ported some plugins back.)