7 ms·

Rspamd – Fast, free and open-source spam filtering system

64 points by cebka 11y ago

feld 11y ago
I have not yet had a chance to use this, but it's the only modern anti-spam software that I am remotely interested in deploying.
k2enemy 11y ago
I'd be really curious to hear feedback from anyone that has used this. I'm currently using dspam and still deal with a lot of spam hitting my inbox.
- vizzah 11y ago
  I use ASSP and even without Bayesian filters (which I don't like for too many false positives) have only an occasional phishing e-mail in my numerous inboxes, even with e-mail addresses published on sites.
- OrNix 11y ago
  Easy to use, fast and flexible antispam.
- spacenerf 11y ago
  I've been using it on my own machine for a while and have used it for ingress/egress filtering at a small ISP (handling ~5k emails/day). Accuracy is reasonably good & it's very light. If there's something more particular you want to know ask away. ;)
- darklajid 11y ago
  I'm a happy dspam user (most stuff won't reach me), but looked into this one in the past. Reasons for me not to give it a try: - Rule based mostly (which I think of as 'SA') - No db support, as far as I could tell. My dspam keeps everything in a postgresql db and I can easily backup/restore that with all my other stuff (dovecot/postfix virtual users, for example) - ~Easy~ to integrate into anything. Look for 'how can I make dovecot-antispam integrate with dspam' and that's been done a thousand times (and works nicely). I haven't found a decent number of rspam resources That said: My whole post basically says that I didn't try it (for reasons that were important to me). Their site looks interesting and in the end I guess I'd love to hear about successful dspam->rspam migrations as well.
  - scott_karana 11y ago
    > - No db support, as far as I could tell. My dspam keeps everything in a postgresql db and I can easily backup/restore that with all my other stuff (dovecot/postfix virtual users, for example) Rspamd appears to use sqlite3: https://rspamd.com/doc/workers/fuzzy_storage.html https://rspamd.com/doc/workers/fuzzy_storage.html
    - darklajid 11y ago
      Hey. Thanks, but.. That's not quite what I had in mind. For one, somedb-only (sqlite or anything else) is usually not enough. I would hesitate to introduce a system that just supports mysql when everything else is using postgresql for me, for example. And on top of that, this schema is .. limited. My dspam setup learns and can do that for each and every user (though system wide training seems to be the norm, as far as I can tell). This is really just a storage engine as far as I can tell and not really comparable. That said: I guess I would give rspam a try if I saw a lot of positive reviews/reports. It's just that it certainly doesn't do the same thing as dspam. It's quite a different animal.
  - jwise0 11y ago
    I was a very happy dspam user for about three days -- SpamAssassin's accuracy on my setup is terrible, and dspam performed pretty well (and increasingly so with training). Then, dspam started segfaulting, and none of my e-mail was delivered. I looked into what was going on, and it appeared that the dspam hash database had somehow become corrupted; and since dspam is completely unmaintained these days, it was unlikely that whatever bug I tripped upon would ever be fixed. Sigh. I also would like to hear user reports about rspamd! I am getting sick of the false negative rate that I'm getting from SpamAssassin.
- rennpferd 11y ago
  Works like a charm, my setup is postfix + dovecot + rmilter + rspamd.
  - zobzu 11y ago
    seems like the perfect setup du jour, should probably document it :)
    - rennpferd 11y ago
      Yeah, should've documented it while I was setting it up...
noinsight 11y ago
I have just been using OpenBSD's spamd and I haven't had any problems with spam. And I like to know I'm messing with the spammers too.
- hobarrera 11y ago
  Indeed. I was getting a few of dozen spam messages per week. Setting up spamd reduced that to less than a dozen per year. Regrettably, 2015 is the years this seems to be ending, since I've already gotten about 8-10 spam messages this year (with the majority being this last month).
pjsg 11y ago
To me, the most important things about anti-spam systems are the false positive / false negative numbers. This information ought to be top and center, and it isn't.
- cebka 11y ago
  This information is merely interesting for some academic researches on some very specific messages corpus. But in the real world, I cannot efficiently evaluate the accuracy because it depends on zillions of parameters. Moreover, since rspamd uses not only statistics but a number of sources, such as DNS lists, SPF, DKIM, hashes databases and so on, it is literally impossible to be determined about preciseness.
  - pjsg 11y ago
    If I am to invest in the time and energy to switch over my current anti-solution to this, then I want to ahve some level of assurance that it will be more effective than my current scheme. I agree that spam is a moving target and that is why anti-spam systems need constant updating. My current system (over the last 30 days) rejected 87% (around 45k emails) and accepted 13%. Of that 13% (6600) around 300 were classified as spam by the bayesian classifier in thunderbird. Around 80 were manually classified as spam and added to thunderbird's rules. The thunderbird classifier probably classified 2 ham messages as spam. I don't know of any ham->spam errors in the initial filtering phase. Should rspamd be expected to do better, about the same, or worse?
    - cebka 11y ago
      From what you are saying, I can conclude that you are using very high scoring for statistical classifier (or basing solely on statistics). This is not an option for a system with millions of users (their accept/reject rate is close to 70/30 percents, as we cannot rely on bayes at all). Therefore, I've never ever evaluated bayes as a single classifier. Nevertheless, I'm using OSB-Bayes as a statistical algorithm for rspamd which has been proven to be a good classifier.
    - zobzu 11y ago
fensipens 11y ago
How does rspamd compare to mopher (http://mopher.org http://mopher.org) in terms of functionality? I see some interesting things like the surbl module but other than that this seems to be more like mimedefang (or that's at least what I've picked up from the landing page). Also do you consider supporting multiple database drivers or will you stick with sqlite3?
- cebka 11y ago
  They are not related at all. From what I'm observing, mopher is a milter (so it might be compared with my another project called 'rmilter') and it can work with Spamassassin. Hence, if something can work with spamassassin then it will be capable to talk with rspamd at some extent. Multiple database drivers are in plans for rspamd 1.0 (along with personal statistics and advanced rules planner). The tricky stuff here is that rspamd uses non-blocking model currently which is hardly supported by database drivers (excluding redis and some others). However, rspamd has a concept of asynchronous threads executed in thread pool. So something like MySQL query could be executed within this thread pool with no delay for other filters processing.

64 points by cebka 11y ago

feld 11y ago

I have not yet had a chance to use this, but it's the only modern anti-spam software that I am remotely interested in deploying.

k2enemy 11y ago

I'd be really curious to hear feedback from anyone that has used this. I'm currently using dspam and still deal with a lot of spam hitting my inbox.

vizzah 11y ago
I use ASSP and even without Bayesian filters (which I don't like for too many false positives) have only an occasional phishing e-mail in my numerous inboxes, even with e-mail addresses published on sites.
OrNix 11y ago
Easy to use, fast and flexible antispam.
spacenerf 11y ago
I've been using it on my own machine for a while and have used it for ingress/egress filtering at a small ISP (handling ~5k emails/day). Accuracy is reasonably good & it's very light. If there's something more particular you want to know ask away. ;)
darklajid 11y ago
I'm a happy dspam user (most stuff won't reach me), but looked into this one in the past. Reasons for me not to give it a try: - Rule based mostly (which I think of as 'SA') - No db support, as far as I could tell. My dspam keeps everything in a postgresql db and I can easily backup/restore that with all my other stuff (dovecot/postfix virtual users, for example) - ~Easy~ to integrate into anything. Look for 'how can I make dovecot-antispam integrate with dspam' and that's been done a thousand times (and works nicely). I haven't found a decent number of rspam resources That said: My whole post basically says that I didn't try it (for reasons that were important to me). Their site looks interesting and in the end I guess I'd love to hear about successful dspam->rspam migrations as well.
- scott_karana 11y ago
  > - No db support, as far as I could tell. My dspam keeps everything in a postgresql db and I can easily backup/restore that with all my other stuff (dovecot/postfix virtual users, for example) Rspamd appears to use sqlite3: https://rspamd.com/doc/workers/fuzzy_storage.html https://rspamd.com/doc/workers/fuzzy_storage.html
  - darklajid 11y ago
    Hey. Thanks, but.. That's not quite what I had in mind. For one, somedb-only (sqlite or anything else) is usually not enough. I would hesitate to introduce a system that just supports mysql when everything else is using postgresql for me, for example. And on top of that, this schema is .. limited. My dspam setup learns and can do that for each and every user (though system wide training seems to be the norm, as far as I can tell). This is really just a storage engine as far as I can tell and not really comparable. That said: I guess I would give rspam a try if I saw a lot of positive reviews/reports. It's just that it certainly doesn't do the same thing as dspam. It's quite a different animal.
- jwise0 11y ago
  I was a very happy dspam user for about three days -- SpamAssassin's accuracy on my setup is terrible, and dspam performed pretty well (and increasingly so with training). Then, dspam started segfaulting, and none of my e-mail was delivered. I looked into what was going on, and it appeared that the dspam hash database had somehow become corrupted; and since dspam is completely unmaintained these days, it was unlikely that whatever bug I tripped upon would ever be fixed. Sigh. I also would like to hear user reports about rspamd! I am getting sick of the false negative rate that I'm getting from SpamAssassin.
rennpferd 11y ago
Works like a charm, my setup is postfix + dovecot + rmilter + rspamd.
- zobzu 11y ago
  seems like the perfect setup du jour, should probably document it :)
  - rennpferd 11y ago
    Yeah, should've documented it while I was setting it up...

noinsight 11y ago

I have just been using OpenBSD's spamd and I haven't had any problems with spam. And I like to know I'm messing with the spammers too.

hobarrera 11y ago
Indeed. I was getting a few of dozen spam messages per week. Setting up spamd reduced that to less than a dozen per year. Regrettably, 2015 is the years this seems to be ending, since I've already gotten about 8-10 spam messages this year (with the majority being this last month).

pjsg 11y ago

To me, the most important things about anti-spam systems are the false positive / false negative numbers. This information ought to be top and center, and it isn't.

cebka 11y ago
This information is merely interesting for some academic researches on some very specific messages corpus. But in the real world, I cannot efficiently evaluate the accuracy because it depends on zillions of parameters. Moreover, since rspamd uses not only statistics but a number of sources, such as DNS lists, SPF, DKIM, hashes databases and so on, it is literally impossible to be determined about preciseness.
- pjsg 11y ago
  If I am to invest in the time and energy to switch over my current anti-solution to this, then I want to ahve some level of assurance that it will be more effective than my current scheme. I agree that spam is a moving target and that is why anti-spam systems need constant updating. My current system (over the last 30 days) rejected 87% (around 45k emails) and accepted 13%. Of that 13% (6600) around 300 were classified as spam by the bayesian classifier in thunderbird. Around 80 were manually classified as spam and added to thunderbird's rules. The thunderbird classifier probably classified 2 ham messages as spam. I don't know of any ham->spam errors in the initial filtering phase. Should rspamd be expected to do better, about the same, or worse?
  - cebka 11y ago
    From what you are saying, I can conclude that you are using very high scoring for statistical classifier (or basing solely on statistics). This is not an option for a system with millions of users (their accept/reject rate is close to 70/30 percents, as we cannot rely on bayes at all). Therefore, I've never ever evaluated bayes as a single classifier. Nevertheless, I'm using OSB-Bayes as a statistical algorithm for rspamd which has been proven to be a good classifier.
  - zobzu 11y ago

fensipens 11y ago

How does rspamd compare to mopher (http://mopher.org http://mopher.org) in terms of functionality? I see some interesting things like the surbl module but other than that this seems to be more like mimedefang (or that's at least what I've picked up from the landing page). Also do you consider supporting multiple database drivers or will you stick with sqlite3?

cebka 11y ago
They are not related at all. From what I'm observing, mopher is a milter (so it might be compared with my another project called 'rmilter') and it can work with Spamassassin. Hence, if something can work with spamassassin then it will be capable to talk with rspamd at some extent. Multiple database drivers are in plans for rspamd 1.0 (along with personal statistics and advanced rules planner). The tricky stuff here is that rspamd uses non-blocking model currently which is hardly supported by database drivers (excluding redis and some others). However, rspamd has a concept of asynchronous threads executed in thread pool. So something like MySQL query could be executed within this thread pool with no delay for other filters processing.