Caching results from greylist/spam scoring systems

[Christopher Martin <ch...@ebit.com.au>]

Only peripherally related to SA, but I figure someone here is bound to 
know the answer: do any of Razor, Pyzor, DCC or any of the other peer 
spam rating systems cache queries? That being, if we get the same spam 
sent to a thousand staff as individual mails, how many lookups do I get, 
3 (one for each protocol/client) or 3000?

I know any RBL lookups will remain in BIND's cache and I would hope that 
the same happens in regards to Razor and the like. I also thought that 
there might be expiry settings for info that could be tuned.

Anyone have any suggestions?

Re: Caching results from greylist/spam scoring systems

[Matt Kettler <mk...@verizon.net>]

Christopher Martin wrote:
> Only peripherally related to SA, but I figure someone here is bound to
> know the answer: do any of Razor, Pyzor, DCC or any of the other peer
> spam rating systems cache queries? That being, if we get the same spam
> sent to a thousand staff as individual mails, how many lookups do I
> get, 3 (one for each protocol/client) or 3000?
Razor does not cache. Cloudmark has hinted in the past about making a
commercial cache add-on, but I don't know if they've really done this or
not.

DCC can cache, if you're running your own dcc server (dccd) and having
your clients query that.

As for the client parts, dccproc definitely does not cache, it will rely
on your dccd to cache for it, or you'll get none at all. dccproc gets
called and exits for every message, so caching would be impossible.

Dccifd *might* perform some trivial caching (ie: the most recent query
only).

I can't comment on Pyzor, but I don't think it caches in the
quick-and-easy setup most folks do. I suspect you can run your own pyzor
server to cause caching to occur, but I really don't know.

So, in summary, you'll get at least 1000, and probably 3000.

>
> I know any RBL lookups will remain in BIND's cache and I would hope
> that the same happens in regards to Razor and the like. I also thought
> that there might be expiry settings for info that could be tuned.
>
> Anyone have any suggestions?
>