This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion
Parents Reply Children
  • I found the last two obvious spam mails that got through:

    MSG   Jun 21 03:58:24Z [1o3V1z-0005pO-SF]: spam scanning result: 'NonSpam'
    MSG   Jun 21 03:58:45Z [1o3V2K-0005qt-IP]: spam scanning result: 'NonSpam'

    So I guess the SASI engine is just bad then.

  • SASI is being used in UTM, Central Email, Email Appliance, PureMessage etc. 

    It is now in the retrospective hard to compare those, as you do not have the comparison for this exact email. 

    But: Do you use IP Reputation? 

    __________________________________________________________________________________________________________________

  • That's not correct, I indeed can compare both engines for the very same email. I just send one of the two mails I posted above to an exchange server behind a XGS I downgraded to MR2, guess what the result was?

    MSG   Jun 21 09:15:06Z [1o3ZyT-0006wW-Mn]: spam scanning result: 'Confirmed spam'

  • Could you provide this particular Email as a Lab Request to get this sorted out? 

    __________________________________________________________________________________________________________________

  • Sure, I submitted a few samples to is-spam@labs.sophos.com that passed the SASI engine with ease.

    Why is the detection rate of the SASI engine that poor? We're talking about the usual "buy cheap viagra here!!!!"-mails I haven't received in years, just until you guys decided it would be a good idea to switch the spam engine. Since that day me and our customers a pleased with the most obvious spam mails that we all thought were dead.

  • It looks to me like Sophos doesn't see this for what it is: a serious problem that needs a fast solution. Our customers were willing to wait for a patch, but now it seems like the engine is just bad and a fix will, as always with Sophos, take ages to get released. I simply can't expect our customers to wait for that long, so if you guys don't surprise us, then we will look for another product from another company, at least for mail protection. Not just because we're disappointed with Sophos, but also because our customers would not be willing to buy another solution from the very same company that broke the one they already bought. I'm still having trouble explaining why a company like Sophos would replace a reasonably functional antispam engine without thoroughly testing the replacement.

  • So do you use the reputation filter in MTA or not? You did not answer this question.

    And also which kind of RBL do you use? 

    __________________________________________________________________________________________________________________

  • Hi, 

    The filter works in legacy mode.

    RBL:
    dnsbl-1.uceprotect.net
    pbl.spamhaus.org
    sbl-xbl.spamhaus.org

  • I don't see how this is even relevant, since the settings have not changed but the Spam Engine has. Anyway, reputation filter is enabled and I use all RBLs provided by Sophos + zen.spamhaus.org

  • Here you have a comparison of one week MR2 vs. one week MR4:

    The detection rate is just plain bad and I highly doubt that you guys did any propper testing before releasing this to your customers!