Re: Challenge-response mail filters considered harmful (was Re: Look at

[tallison@tacocat.net]

I've been catching up on my email for the past few weeks and found this
rather horrible thread.

My sincerest apologies for all of my earlier posts.  I had no idea what a
fluster-cluck this had become.

However, the issue of blocking spam does seem to get people excited, even
to the point of religious furvor, when they think they may be able to come
up with the ultimate solution.

Rather than debate the zealots, I thought it would be potentially useful
to identify things that do work.

First, I use postfix exclusively because of it's configurability and
capacity to handle a lot of mail and extensions easily.

Postfix has some wonderful UCE controls that are largely based on a need
to have a correctly formed header.  Postfix v2 has a wonderful feature of
doing a reverse SMTP session back to the sender to validate the email
address.  This is somewhat slow, but highly effective.  However, I do not
yet enable this feature.

I typically use the UCE controls and spam filters (spamassassin, bogofilter).

I outright delete mail that scores >15 from the spamassassin default
scoring configuration.
Everything over 5.0 get's filtered into a seperate mailbox (spam).
Everything else get's delivered to procmail.

Out of all that:
I get <6 spams per day delivered to my spam folder.
I get 1 spam per month delivered to procmail.
I get >150 attempts to deliver every day per account.

>From this, the UCE controls do the lions share of the work.  This isn't
hard to imagine since much of the spam is spoofed addresses anyways.

Correctly configuring your mail server can go a long ways to reducing the
spam that you recieve.

I should note that there are a number of emails that are bounced as
undeliverable from "real people" because of my UCE controls being so
strict.  Generally these are few and can easily be corrected by adding
their address to the postfix access.db file.