Seth Goodman writes:
Sendmail did a much more valid test in July
http://sendmail.net/dk-milter/benchmark/
and determined their DomainKeys implementation would add 8-16% overhead
to MTAs.
FWIW, my own testing is in the same range for IIM.
Thanks for posting this link. I was looking for it recently. The
conclusion they draw is based on a large average message size. Most spam
are very short messages, and spam is the preponderance of the incoming
stream, so I don't think the conclusion necessarily agrees with the data
they present. For very short messages, the throughput of this fairly
CPU-rich MTA was reduced to approximately half. I suggest this is more like
what typical sites with high spam loads will see.
Something to note here is that signing and verifying are
several orders of magnitude different in CPU complexity --
verifying being *much* cheaper. The SHA1 digest quickly
overcomes the RSA verify as the dominate factor... not to
mention that watching Spamassassin grind away trumps all...
Mike