Re: SRS implemenation in sendmail

[snip]
>Perhaps in abundance, but spf-milter, as of 1.40, at:
>
>http://spf.pobox.com/sendmail-milter-spf-1.41.pl
>
>also has full support for "fake DSN detection" (-S), using SRS. A Milter,
>imho, is really a good place to implement such a policy.

After a week of using sendmail-milter-spf-1.41.pl, I have come to the 
conclusion that it is far from rock solid stable.  It may work for long 
periods on low volume mail servers, but its limitations become apparent 
when you throw some real load at it.

To indicate my volume, an average day consists of 20,000+ connections 
rejected do to RBL+ lookups, and another 85,000+ due to unsigned SRS 
addresses in the SMTP envelope.  Then we drop 45,000+ emails by 
SpamAssassin, and MailScanner catches 1,000 viruses in the remainder.  And 
after all that, we still have 100,000+ emails being delivered per day.

The sendmail-milter-spf does not handle this kind of volume.  The first 
thing I noticed is the memory leaks.  The RSS of the process slowly 
climbs.  I wrote a script that runs from cron and checks on it and when it 
gets to 80MB it restarts.  That is currently happening about once every 21 
hours.

The second thing is it dies periodically.  Last night I was paged out of 
bed twice because the sendmail-milter-spf process had died and I had to 
restart sendmail.  When it dies, the sendmail processes stack up quickly, 
run my machine out of RAM (1GB) and by the time I get paged (less than 5 
minutes) its got 600MB+ in the swap file, all full of sendmail processes.

This all is not unusual for milters though, I have previously experienced 
similiar instability with all sorts of milters, including MIMEDefang and a 
myriad of other milters that try to perform the same function (which is why 
I now using MailScanner for that purpose).  The only milter I ever used 
that was truly stable was rays-filter, because it tried to do very little, 
and the less you do the less that goes wrong.  In any event, what is really 
needed is a way to do this without using the milter interface, i.e. a 
direct patch to sendmail, perhaps.


--
-- =========================
    Tom Lahti
    Tx3 Online Services

    (888)4-TX3-SVC (489-3782)
    http://www.tx3.net/
-- =========================