4 ms·

What are fellow self-hosted email folks doing about spam these days? I've found that Spamassassin is letting through more and more these days...

by yrro 7y ago

avian 7y ago
I'm using a custom procmail setup build over the years around Bogofilter [1]. I find it still works well, even though Bogofilter is more or less unmaintained at this point. I'm only aware of one serious bug in the upstream distribution [2], but a patch for that exists. The running yearly average false negative rate for me is currently 6.5%, which isn't perfect but it's survivable. It's hard to say what false positive rate is, but over the years I can't remember an instance where I would go fishing in the spam folder for a mail I knew I should receive (I do have classification settings very much biased towards false-negative rather than false-positive) [1] http://bogofilter.sourceforge.net http://bogofilter.sourceforge.net [2] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=733622 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=733622
jlelse 7y ago
I use mailcow[1], which uses rspamd and it just let's through like 1 mail every few days. [1]: https://github.com/mailcow/mailcow-dockerized/ https://github.com/mailcow/mailcow-dockerized/
tomatocracy 7y ago
I can thoroughly recommend rspamd - it feels rather more robust than spamassassin and is easier to configure eg if you just want to do Bayesian filtering etc. The analytics and logging you get through the web interface is also very good.
LinuxBender 7y ago
I use a methodology called S25R [1] that involves regex filters in postfix. Super simple, no third party anything for those regex patterns. I reject the spammers and use iptables for the really bad spammer networks. In terms of external third party resources, I also use spamcop and uceprotect in postfix to do RBL checking. [1] - http://www.gabacho-net.jp/en/anti-spam/anti-spam-system.html http://www.gabacho-net.jp/en/anti-spam/anti-spam-system.html
jerrac 7y ago
I use dspam. It seems like an abandoned project, but it still works. I looked at rspam, but I'm not a fan of the way the lists cost money as soon as you want to make money. Sure, right now, I'm only hosting personal email, but who knows what could happen in the future?
parliament32 7y ago
I've been having good luck with SA's heuristic learning engine. False positives are non-existant and it catches ~90% of spam that isn't caught by other rules first.

What are fellow self-hosted email folks doing about spam these days? I've found that Spamassassin is letting through more and more these days...

by yrro 7y ago

What are fellow self-hosted email folks doing about spam these days? I've found that Spamassassin is letting through more and more these days...

avian 7y ago

I'm using a custom procmail setup build over the years around Bogofilter [1]. I find it still works well, even though Bogofilter is more or less unmaintained at this point. I'm only aware of one serious bug in the upstream distribution [2], but a patch for that exists. The running yearly average false negative rate for me is currently 6.5%, which isn't perfect but it's survivable. It's hard to say what false positive rate is, but over the years I can't remember an instance where I would go fishing in the spam folder for a mail I knew I should receive (I do have classification settings very much biased towards false-negative rather than false-positive) [1] http://bogofilter.sourceforge.net http://bogofilter.sourceforge.net [2] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=733622 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=733622

jlelse 7y ago

I use mailcow[1], which uses rspamd and it just let's through like 1 mail every few days. [1]: https://github.com/mailcow/mailcow-dockerized/ https://github.com/mailcow/mailcow-dockerized/

tomatocracy 7y ago

I can thoroughly recommend rspamd - it feels rather more robust than spamassassin and is easier to configure eg if you just want to do Bayesian filtering etc. The analytics and logging you get through the web interface is also very good.

LinuxBender 7y ago

I use a methodology called S25R [1] that involves regex filters in postfix. Super simple, no third party anything for those regex patterns. I reject the spammers and use iptables for the really bad spammer networks. In terms of external third party resources, I also use spamcop and uceprotect in postfix to do RBL checking. [1] - http://www.gabacho-net.jp/en/anti-spam/anti-spam-system.html http://www.gabacho-net.jp/en/anti-spam/anti-spam-system.html

jerrac 7y ago

I use dspam. It seems like an abandoned project, but it still works. I looked at rspam, but I'm not a fan of the way the lists cost money as soon as you want to make money. Sure, right now, I'm only hosting personal email, but who knows what could happen in the future?

parliament32 7y ago

I've been having good luck with SA's heuristic learning engine. False positives are non-existant and it catches ~90% of spam that isn't caught by other rules first.