what the heck is going on?

Yash · February 2, 2007, 8:54pm

In 1, your email is received and processed at the DSPAM server. A SPAM tag is added to any spam email. This tag is within the message headers, not in the subject or body. The mail is then pushed to the correct mail server. If you disable anti-spam in HSphere, the mail server will not check the email for the spam tag and process it as regular email. If you enable anti-spam, the mail server will either quarantine or delete it based on your settings. If you do not want server-side checking of spam, you can still configure your email client to filter spam based on this tag, locally on your computer. Also, if the main mail server goes down, DSPAM can queue mail for a good period of time.. preventing you from losing email

If you want nothing to do with dspam, you can change your MX records so mail comes directly to your mail server. No spam checking would be done, no spam tagging would be done.. All mail would come as it is to your email client.

gsaunders · February 2, 2007, 9:03pm

In 1, your email is received and processed at the DSPAM server. A SPAM tag is added to any spam email. This tag is within the message headers, not in the subject or body. The mail is then pushed to the correct mail server. If you disable anti-spam in HSphere, the mail server will not check the email for the spam tag and process it as regular email. If you enable anti-spam, the mail server will either quarantine or delete it based on your settings. If you do not want server-side checking of spam, you can still configure your email client to filter spam based on this tag, locally on your computer. Also, if the main mail server goes down, DSPAM can queue mail for a good period of time.. preventing you from losing email

If you want nothing to do with dspam, you can change your MX records so mail comes directly to your mail server. No spam checking would be done, no spam tagging would be done.. All mail would come as it is to your email client.

<< the mail server will either quarantine or delete it based on your settings >>

The options I see are Mark as Spam, Remove (delete?), and Move To (quarantine?). You didn’t mention Mark as Spam, but that is one valid setting correct?
Does the Spam Check Level setting OR the MaxScore Level do anything any more? OR is it totally relying upon DSPAM to make the case? OR is there another level of anti-spam (the old system) that is still taking place after DSPAM does it’s thing?
Are the white list and black lists honored even if DSPAM is running and Spam Processing is set to Mark as SPAM?

Thanks for help clarifying everything!

system · February 2, 2007, 9:25pm

Correct. “Move to” is where you move spam marked mails to a different mailbox of the domain.

All old is still in place. dspam check is just like another check added to the existing system, so everything is working as it was earlier.

yes, they will all work as it is. dspam is just going to add the extra header Yash mentioned about, in any case if a mail passes through it.

gsaunders · February 2, 2007, 9:52pm

So as long as anti-spam is turned on for the mailbox or mail domain, regardless of Spam Check Level, it will see DSPAM header settings and follow the Spam Processing choice?
So it is also possible that DSPAM doesn’t see something as SPAM, but with Spam Check Level set on Very Aggressive it is possible for the old system to see it as spam (even if DSPAM doesn’t)?

Thanks again for all the clarification… it is very, very helpful!

Yash · February 2, 2007, 9:56pm

Yes
Yes. But in long run, we would like to have our systems depend totally on dspam results and totally ignore spamassasin

gsaunders · February 2, 2007, 10:00pm

I like the idea of the mail gateway to hold mail on DSPAM should the main mail server have an issue, but I want to make sure the loopback issue has been fixed.

Can you share a bit on exactly what was happening and what the fix was?

Yash · February 2, 2007, 10:31pm

postfix, the MTA (mail transaction agent) handling mail on DSPAM uses a MySQL database to know which mail server to route the mail to. It is basically a domain ip map, that tells postfix which mail server handles a particular domain name.
This mySQL database needs to be constantly updated because new domains are added to the system all the time.
From what we see, it appears that he issue occured during these updates and also because at times the available mysql connections were getting exhausted. these issues have been corrected and we have not seen another loopback so far in the logs.

That doesn’t mean the issue is solved though, we continue to monitor and will only put mail5 live when we are confident its fixed

snooper · February 3, 2007, 9:51pm

Grow up and use a real database

and get this solved ASAP - i am beginning to look bad!

system · February 6, 2007, 11:48pm

Can you let me know what a real database here is?
If you mean postgresql or SQL server or Oracle, using them is no issue for us, but do we really need them. No i dont think so. You can do some big databases with high concurrency in MySQL if you are sure of your usage and pick the right DB engine for the task. Yahoo! Finance, for instance, has been using it fine for long.

I’ve not seen any more issues since we posted it as corrected. Let me know if you have noticed more of them.