Skip to content

SpamAssassin or Rspamd? A reluctant migration log

Web Hosting by priya 7 replies 429 views
#1

Dear/madam,

I am documenting this migration for reference purpose only. Our mail infrastructure at OVHcloud was running SpamAssassin since 2019 itself. Kindly note the following observations:

1) SpamAssassin configuration is 3400+ lines. Rspamd equivalent is 900 lines only.
2) SA uses Perl regex. Rspamd uses Lua. The translation itself took forty hours.
3) Our false positive rate changed from 0.3% to 0.7%. This is unacceptable only.

The nightmare itself: SA's `score USER_IN_BLACKLIST` became Rspamd's `multimap { type = "from"; map = "/etc/rspamd/blacklist.map"; score = 6; }`. Simple, yes, but we had 47 such rules.

Then the twist, kindly prepare yourself. Forty percent of our "spam" folder was actually our own newsletter bounces. The client had misconfigured SPF itself. Rspamd was correct. SA had been hiding this.

I am requesting your guidance: is this migration worth completing, or shall we revert?

#2

Complexity kills
Rspamd wins

Your spf was broken all along

rm -rf / --no-preserve-root ☯
#3
priya said:
Forty hours

FORTY HOURS?! SNAPPED IT UP... wait NO YOU DIDNT! $12/YR FOR MAIL CLEANING ARE YOU KIDDING!

I found Hostinger with Rspamd preconfig, $8/YR! Took me 20 MINUTES to migrate! TWENTY!

Your client pay for 40 hours? Or you eat it? BIG DIFFERENCE!

world record: 4min Arch install
#4

Rspamd vs SA benchmark, same 10k corpus:

spamassassin:  14.2s  |  312MB RAM  |  8 processes
rspamd:         2.1s  |   89MB RAM  |  1 process + workers

disk IO: rspamd faster by 6.7x
network: irrelevant for local scan

Decent disk IO, meh network

Your SPF fix matters more than either choice

fio, iperf, geekbench. results or gtfo.
#5
SingaporeRep said:
SPF fix matters more

WRONG. SPF IS ONE LAYER ONLY.

What could go wrong:
- Rspamd Lua rules execute arbitrary code.
- No fail2ban on port 11334 = admin panel exposed.
- Your multimap files world-readable? LEAKED BLACKLISTS.
- Redis for Rspamd stats? Another attack surface.

I WARN YOU: firewall everything, fail2ban all ports, monitor logs daily. Every migration is a security event!

airgapped, encrypted, faraday'd, still worried
#6

0.7% false positives on what volume? That changes everything.

436 days. reboot is surrender.
#7

I had the same issue with spf, took days to notice

#8

Which redis version? And is it on the same box

Post a reply

You need an account to reply. Log in or register to join the conversation.

Post reply Preview Save draft