Well, check the header of this email I just got. IMHO, this email should have been marked as spam just for having the word Cialis in the Subject field. Shouldn't that email have been rejected? ________________________________________ Return-Path: Delivered-To: magallon@mydomain.com Received: (qmail 3146 invoked by uid 89); 21 Jun 2007 14:58:19 -0000 Received: by simscan 1.3.1 ppid: 3079, pid: 3113, t: 5.3725s scanners: attach: 1.3.1 clamav: 0.90.1-exp/m: spam: 3.1.8 X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on www.mydomain.com X-Spam-Level: * X-Spam-Status: No, score=1.8 required=3.0 tests=DATE_IN_PAST_96_XX, DK_POLICY_SIGNSOME,DK_SIGNED,HTML_FONT_BIG,HTML_MESSAGE,MIME_HTML_ONLY autolearn=no version=3.1.8 Received: from unknown (HELO cjrfc) (203.188.40.86) by www.mydomain.com with SMTP; 21 Jun 2007 14:58:14 -0000 Received-SPF: none (www.mydomain.com: domain at mail.wplus.net does not designate permitted sender hosts) To: Date: Thu, 14 Jun 2001 07:27:54 +0700 From: "Francesca Marianela" Message-ID: <390p316m.7745034@mail.wplus.net> DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=latter.wine; d=mail.wplus.net; b=aqNgtQGyzSWPvmkmGwETHiLHxTLFxUTIpiuyFGdXXNuAqzKmOSzesSyqIpbxaADrBkVLMqgSvT npiJKx; User-Agent: Mozilla Thunderbird 1.5 (Windows/20060111) X-Accept-Language: en-us, en MIME-Version: 1.0 Subject: CialisPhentemineXanaViagra\/aliun from $2/pill, No Doctor Approval, as simple as 1-2-3 mcock Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: 7bit -----Original Message----- From: ram [mailto:ram@netcore.co.in] Sent: Thursday, June 21, 2007 10:01 AM To: Leonardo Magallon Cc: users@spamassassin.apache.org Subject: Re: Spam getting thru On Thu, 2007-06-21 at 09:47 -0500, Leonardo Magallon wrote: > Hi, > My server is having a problem with spamd using a lot of resources( spamd > startup script is using -m 5 ) and a lot of spam is getting thru. The > installation is new using CentOS 5, spamassasin 3.1.8 and I am using > RulesDuJour ( I deleted the blacklist.cf and blacklist related rules to > alleviate load). > > Sometimes the spam doesn't even get the Spam assassin rules as the following > email header shows: > > Return-Path: > Delivered-To: myemail@mydomain.com > Received: (qmail 25345 invoked by uid 89); 21 Jun 2007 14:05:02 -0000 > Delivered-To: webmaster@mydomain.com > Received: (qmail 25338 invoked by uid 89); 21 Jun 2007 14:05:02 -0000 > Received: by simscan 1.3.1 ppid: 24712, pid: 24721, t: 600.9127s > scanners: attach: 1.3.1 clamav: 0.90.1-exp/m: spam: 3.1.8 > Received: from unknown (HELO dxv146.internetdsl.tpnet.pl) (83.14.47.146) > by www.mydomain.com with SMTP; 21 Jun 2007 13:55:01 -0000 > Received-SPF: pass (www.mydomain.com: SPF record at silverfour.com > designates 83.14.47.146 as permitted sender) > Message-ID: <4df501c7b40b$0078ea2a$922f0e53@dxv146.internetdsl.tpnet.pl> > From: "Sales" > To: "Grazini Valentina" > Subject: Queens of the Stone Age: Rockin' Rulers > Date: Thu, 21 Jun 2007 13:54:49 +0000 > MIME-Version: 1.0 > Content-Type: text/plain; > format=flowed; > charset="Windows-1252"; > reply-type=original > Content-Transfer-Encoding: 7bit > X-Priority: 3 > X-MSMail-Priority: Normal > X-Mailer: Microsoft Outlook Express 6.00.2900.2527 > X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2527 > > > Is this behavior correct? > I think this should be in the FAQ. Follow the standard recommendations * Use RBL's at the MTA to reject the mail ( we use zen.spamhaus and DSBL ) That saves a *LOT* of processing * Use a local caching DNS * Check valid recipient , valid sender domain etc at the MTA * if using SPF do it at the MTA * If still it doesnt work get better hardware, Buying 2GB ram is much cheaper than wasting 2hrs every day trying to deal with load IMHO Thanks Ram Also when posting to a list do not start off by replying to an unrelated thread > Thanks.