[Boston.pm] Mail and spam

We talked a little bit about spam tonight, and I mentioned my messed up
setup.  Here's what I have:

Emails enter my network into a sendmail server - all it does is do
graylisting (bounce everything with a temporary failure code), then
forward to another server running qmail.  

The qmail server is using maildrop to filter duplicate emails (based on
message IDs), does whitelist filtering (mailing lists and such), then
feeds the remaining emails to CRM (crm114.sf.net).  

CRM does an amazing job filtering spam.  If it says something isn't
spam, I take it's word for it, and deliver it to my inboxs.  If it does
say it's spam, I feed the email to my own filtering script, which
does whitelisting and blacklisting based on addresses in the headers.
If something is whitelisted, it goes to the inboxes.  If something is
blacklisted, it goes to /dev/null.  If it can't decide one way or the
other, the email moves on...

The last step is feeding the email to spamassassin.  If SA says it's
spam (with a really high threshold), the mail goes to /dev/null.  If
not, it goes to a spam folder for me to look at later.

Here's how the numbers end up looking (on Dec 11):

Emails before graylisting          : 209,856
Emails after graylisting           : 185,657 (24,199 dropped, 11.5%)
Emails after dropping duplicates   :  93,685 (91,972 dropped, 49.6%)
Emails after maildrop filtering    :  93,312 (373 delivered, 0.4%)
Emails CRM identified as spam      :  93,134 (178 delivered to inbox, 0.1%)
Emails my script let through       :     889 (92,245 dropped, 99%)
Emails spamassassin agreed is spam :     844 (45 delivered to spambox, 5%)

So at the end of the day, 551 delivered to various mailboxes (0.26% of
the original mass), and 45 had to be manually inspected (0.02%).  Out of
those, I think 1 was actually ham, which means false negative rate of
0.00047%, which isn't bad.

Anyway, that's my sad story.  Let me know if anyone has any questions!

-- 
Dan Boger
dan-rlx3YLNxYWXQT0dZR+AlfA@xxxxxxxxxxxxxxxx