Re: How to debug SA to identify long running body check?

Bill Cole <[email protected]> Wed, 21 Jan 2026 10:56:42 -0500

Newsgroups	gmane.mail.spam.spamassassin.general
Message-ID	<[email protected]>

On 2026-01-21 at 10:45:26 UTC-0500 (Wed, 21 Jan 2026 15:45:26 +0000)
Lichtinger, Bernhard <[email protected]>
is rumored to have said:

> This one takes about 30sec to finish.
> A block of about double this size takes already about 4min to finish.
>
> I suspect some catastrophic backtracking is happening with such a text in the body.
> My open question is: which regex is causing this?

You can go looking for any instances of '.*' in your rules as a  start, but I don't think your problem here is regex backtracking but rather DNS. All of those addresses will generate multiple DNS queries, and if they are not all identical (I assume that you have replaced the real addresses) they will each go out to the net for resolution.

This can be particularly problematic if you do not have a fully recursive nameserver running on the same machine (or at worst, same LAN segment) to do  all DNS resolution for your MTA. That means something OTHER THAN dnsmasq, which is only fit for low-volume end user name resolution.


-- 
 Bill Cole
 [email protected] or [email protected]
 (AKA @[email protected] and many *@billmail.scconsult.com addresses)
 Not Currently Available For Hire

signature.asc (application/pgp-signature, 285 B)