Filtering Forwarded Messages for Spam
I manage several accounts as a reseller (Apache/Linux/cPanel). One account in particular has chosen to use aliases (forwarders) instead of POP3 mailboxes to receive mail. Over several years of use (since before I hosted their account), the level of spam delivered to the aliases has increased to where it significantly outnumbers legit mail. cPanel's built-in regex filtering isn't able to fully meet the challenge, and because of the nature of the message delivery, there's no established routine for filtering at the end-user level.
Fortunately, SpamAssassin is available to all resold accounts. Unfortunately, it works only on physical mailboxes; mail arriving through forwarders is not processed.
I discussed the situation with my account provider, with whom I've been very satisfied with since sign-up, and inquired about a server-side extension to SpamAssassin and sendmail (i.e., MIMEDefang). Understandably, they were concerned about how a site-wide solution might affect other account holders who (for whatever reason) might not want SA to process their messages.
What I'm investigating is whether there exists an anti-spam solution that can be placed solely onto the resold account and -- most importantly -- is able to process messages arriving to the domain through forwarders. From what I've gathered so far, it can't involve access to procmail, or modifications to the server-side install (that is, configuration outside the scope of the reseller account), due to the server's reliance upon cPanel.
The solution wouldn't necessarily have to function in the same way as SpamAssassin, since for all intents and purposes, it would take over SA's duties on the account. If in fact it did work the same (i.e., scoring messages and inserting extra header information), I'd hope that cPanel's regex filtering could be used at the account level to discard offending messages before they were forwarded.
Any first-hand accounts with useful software, or any helpful feedback, would be welcome and appreciated. Likewise, if I come up with a suitable solution elsewhere, I'll let you know. Thanks in advance.
