Large scale spam filtering

[Gayle]

Ok, so I need to find an OSS spam/AV solution and while that's not hard there is one specific requirement that I'm struggling with so I thought I'd ask the experts (i.e. you lot (God help me! )).

Requirements are:

Must fit into the current Qmail -> Exchange environment. Obviously Qmail as the internet facing MTA which accepts mail and passes it on to Exchange.

Maximum processing time of around 2 seconds per message (based on current and projected mail/spam volumes). I think this rules out SpamAssassin based on my own experience.

No/minimal false positives far more important then no spam getting through.

Anything identified as spam to be quarantined and need an interface for the admins to check and confirm spamminess or release to recipient. This interface must be usable by muppets. PHP based web interface would be ideal as any shortcomings I can correct in house (think I saw something for dspam the other day but can't find it now and didn't look closely enough at the time). This is the killer, tagging and filtering client side is not an option.

Must work alongside ClamAV (all ClamAV identified mail to be sent to the bit bucket).

Don't ask for much do I?

I am leaning towards dspam at the moment but need confirmation that it can do what I need, amavisd-new I'm not sure about as I've only seen it used with SA and I can't see it being fast enough but I am willing to be proved wrong on that one.

Any guidance (weblinks would be perfect) gratefully received.

[georwell]

Mailscanner will show you the light...

[radulucian]

i am also investigating dspam to replace my current spamassassin solution.

aparently, dspam can do everything you need and more. that includes the web interface (dspam-web), speed compliance, succes percentage and so on.

unfortunatelly, dspam is still masked in portage and apparently that is for a good reason.
i will look into this and i promise to report back if i manage to make it work in an elegant manner (the gentoo way) but i urge you to post a conclusion on this thread once you reach to a conclusion

[SnEptUne]

Unfortunately, dspam is quite slow. At least for me, it would take 55 second to filter one message if the message is a large text file. SpamAssassin seems to handle email better if the message is large. So if you are going to receive a lot of large message, perhaps, SpamAssassin would seem to be a better choice. Btw, I am using a 300mhz PPC.

[nharring]

I run a high volume (roughly 1M messages/day) site with 4 servers doing smtp traffic running through Sophos AV and SpamAssassin (via spamc/spamd). Our average message delivery time is under 2 seconds, including both spam and virus and write to an NFS filer. Obviously it'd be faster if it didn't have to do local delivery also.
Invoking SA as a standalone perl app each time is really heavy and time consuming, but the spamc/spamd solution works nicely, and supposedly 3.0 is even faster.