To quote the Website for DSPAM:
DSPAM is an intelligent, adaptive spam filter capable capable of learning what spam is and isn’t based on each user’s individual email behavior. It is designed for both system-wide filtering and third party integration. You should use DSPAM if you are looking for a scalable, fast, and accurate spam filter that is capable of adaptive learning. Although it is a spam filter by design, DSPAM has shown great proficiency in classifying any kind of document into one of two concepts.
DSPAM is not a drop-in solution. It requires some thought, some work, and some training (both you the installer/sysadmin and the e-mail users). However, I’ve found it more than worth it. It has a number of options, some experimental, some ready for production work. Like most adaptive filtering packages that start with a blank slate, it takes about two weeks of e-mail to fully train it.
Netscape/Mozilla/Thunderbird comes with reasonable pre-training and does a decent job right out of the box. I was impressed with Netscape’s filtering when Janelle started using it several years ago. However, all her mail was coming through AOL and they filtered out the obvious scams, illegal operations, stock pump and dump operations, etc. When we moved and just relied on Thunderbird’s filtering, it’s limitations showed up. Thunderbird never seemed to learn about image spam.
I had been using DSPAM on my system at home for several years and was quite happy with it. I had tried several anti-spam packages, e.g., SpamAssassin and CRM114, but DSPAM had far fewer false positives and false negatives. And it used less CPU and memory than SpamAssassin. SpamAssassin is written in Perl, DSPAM is written in C. SpamAssassin is a real memory hog. My mail server was an old dual 300MHz PII with only 192MB. It could handle my e-mail load without breathing hard until I added SpamAssassin. It thrashed with SpamAssassin. Plus SpamAssassin uses someone else’s definition of spam, not mine. I tried tweaking it, but it always had an uncomfortably high level of false negatives and positives.
CRM114 is also fully adaptive and catches stuff that DSPAM doesn’t, but in the end I found it gave too many false positives. Since it broke in an upgrade, I’ve stopped using it.
I’ve found that just having probable spam filtered into a separate folder is nice, even if I have to wade through it all. However, eventually the amount and the coarseness of the spam became wearing. After the intial two week training period, I never caught DSPAM in a false positive, even though I waded through thousands of spam e-mail. Mostly, I let it discard spam sight unseen, but every once in a while I’d look at the flagged items. There was one exception, when I finally signed up for an eBay account, I had to whitelist ebay.com to get the signup e-mails through.
To install, read the documentation and follow the instructions. If you are using Postfix, you will have to make one change. Postfix delivers mail as the user receiving the mail. Not all MTAs do this. The dspam executable is installed root execute only. Add other and group execute permissions, e.g., as root, chmod og+rx dspam. I have it deliver both spam and innocent (AKA ham) e-mail, tagging spam. I use Maildrop (Procmail has equivalent functionality) to sort tagged spam into its own folder or the bitbucket once training is complete.
The result is very good. DSPAM is catching the image spam that Thunderbird didn’t. I have only a week of training, but false positives are few and far between, mostly just HTML newsletters it hasn’t seen yet. Another week and I’ll let Maildrop start discard the spam, sight unseen.