hi- i've recently asked about essentially this same topic on the postfix-users mailing list, so apologies to those subjected to the repetition.
the topic came up for me a couple of weeks ago when i asked about duplicate spam that was scoring low the first time it was received: https://mail-archives.apache.org/mod_mbox/spamassassin-users/201411.mbox/%3C5458FFE3.10404%40bitrate.net%3E understanding now what's going on, i've been thinking a bit about this, while the frequency of this trend seems to be continuing to increase. as a possibly meaningless anecdote, it's almost as though something changed overnight, and suddenly, our spam volume has increased dramatically. much of it is still detected by spamassassin, but it's sort of surprising to me how much seems to now be making it through postscreen and other postfix restrictions [e.g. very low or absent listings in dnsbls] and through to amavis/spamassassin. if i didn't know better, i might wonder if suddenly the dnsbls we're using had begun lagging behind. all of the emotional postulative opining aside, one possibility i have been considering is having postfix delay relay of messages to the content filter for a few minutes, as it seems that when these messages reach us, they're only minutes away from being matched by network tests [this is what i asked postfix-users about]. i'm interested to hear from folks on this list regarding this idea, as well as possible alternatives to dealing with this phenomenon. i believe amavis/spamassassin are operating properly, and the messages are scored quite accurately once network tests include matches - it's just this brief interlude which has begun to become somewhat frustrating. not wanting to assume which configuration elements might be relevant here, i haven't included anything, but if there are doubts as to the competence of my configuration, i'd happily provide anything which might reveal deficiencies. thanks -ben
