Spam Filter ISP Support Forum

  New Posts New Posts RSS Feed - Grey Listing Problems
  FAQ FAQ  Forum Search   Register Register  Login Login

Grey Listing Problems

 Post Reply Post Reply
Author
Jim Ranson View Drop Down
Newbie
Newbie


Joined: 16 May 2011
Status: Offline
Points: 2
Post Options Post Options   Thanks (0) Thanks(0)   Quote Jim Ranson Quote  Post ReplyReply Direct Link To This Post Topic: Grey Listing Problems
    Posted: 16 May 2011 at 6:11am

I am experiencing problems receiving messages from some ISPs and seem to have narrowed the issue to greylisting (which I have now switched off).  The ISPs are the big ones, btinternet.com, yahoo, AOL who have large numbers of servers.

What I think is happening, is that the initial mail attempt is made from Server 1 and the link is dropped and the IP added to the Greylist Cache.  The ISP tries again, but this time from Server 2.  Again the link is dropped and the second IP added to the Greylist Cache.  Sometimes, the mail is received from one of the current Greylist IPs andthis is then added to the accepted list and the mail is forwarded.  However if the ISP has many servers working in parallel, it never comes from the same IP twice and is never delivered.
 
Is anybody else experiencing this? or have I another problem I have not thought of?
Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4104
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 16 May 2011 at 10:11pm
Jim,

Unfortunately that is one of the side-effects of using greylisting. Per RFC, if a server experiences a temporary failure code while sending an email (which is exactly what greylisting does), the RFC states that the server should retry delivery after a brief delay. Unfortunately large ISP often do not abide by the RFC, and in case of a temporary failure they will defer delivery to a different SMTP server on their network. This new server will have a new IP, and when this IP connects to SpamFilter (or any other anti-spam server that uses greylisting), this new IP will again be subjected to the greylist filter, causing the initial connection to be delayed. If the ISP then again violates RFC and defers delivery to a third of their mail servers, you see how this process will become an issue.

Eventually most IPs from the large ISPs will be cached by the greylist filters, but the more mail relays they use, the longer this will take, causing some initial mail delays.

This is why we ship SpamFilter with the greylist filter disabled by default. Greylisting is a great asset to stop spam, but it can cause delays with larger providers. You can manually add IPs/networks you wish to have excluded, just as I mentioned in the other posting saw today (http://www.logsat.com/SpamFilter/Forums/forum_posts.asp?TID=6942#14084), but admins will need to decide if it is better for their needs to enable or disable the greylist filter, knowing its downsides.
Roberto Franceschetti

LogSat Software

Spam Filter ISP
Back to Top
Wayne View Drop Down
Groupie
Groupie
Avatar

Joined: 29 August 2006
Location: Switzerland
Status: Offline
Points: 60
Post Options Post Options   Thanks (0) Thanks(0)   Quote Wayne Quote  Post ReplyReply Direct Link To This Post Posted: 24 June 2011 at 3:06am
Roberto
 
So what's your opinion, is it still worth to use the greylist filter with all the negative consequences that implies?
I mean the most spammers learned already to adapt and are using spam software that can identify the 4XX messages, and perform the retry operation.
 
Regards
Wayne
SF4.5.0.1-beta
Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4104
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 24 June 2011 at 7:52pm
Wayne,

Actually most spambots so far do not retry the operation and just move on, as it's not worth for them to spend time retrying. Sometimes they still make it past the greylist filter as they have a large number of email addresses for one domain, so as they keep trying the other email addresses, eventually this will cause the initial 5-10 minute delay of the greylist filter to elapse and start accepting connection form the spambot. But in the meantime, hundreds of email attempts to other users have still been stopped.

Whether to implement it or not depends ont he admin and your customers. If they complain too much because of the initial delays that this filter causes, you may want to disable it. But if you're happy (and especially if your customers are happy) with the low spam that is allowed thru when using it, then you should enable it.
Roberto Franceschetti

LogSat Software

Spam Filter ISP
Back to Top
Wayne View Drop Down
Groupie
Groupie
Avatar

Joined: 29 August 2006
Location: Switzerland
Status: Offline
Points: 60
Post Options Post Options   Thanks (0) Thanks(0)   Quote Wayne Quote  Post ReplyReply Direct Link To This Post Posted: 27 June 2011 at 3:28am
Roberto

Thank you very much for the detailed explanation.

As a feature request it would be great if we could see in the statistics, how many emails were rejected by the greylist function and all other filters also. So we could see at a glance which filters are worthwhile to activate.

Regards
Wayne
SF4.5.0.1-beta
Back to Top
Wayne View Drop Down
Groupie
Groupie
Avatar

Joined: 29 August 2006
Location: Switzerland
Status: Offline
Points: 60
Post Options Post Options   Thanks (0) Thanks(0)   Quote Wayne Quote  Post ReplyReply Direct Link To This Post Posted: 27 September 2011 at 10:42am
Roberto

Sorry for bother you again with this topic, but the problem becomes worse and worse.

I mean, of course you are right and the big provider like Yahoo is violating the RFC rules, but honestly, we as your customers, and our customers as well which use a Yahoo email address, don't care who is the bad guy, they just want to be able to send emails. If it would happen only with a small provider we could just suggest our customers to change to another one, but with Yahoo, one of the biggest?

So I checked just out how other Spamfilter manufacturer are handling this problem and many of them have the possibility to do exclusions on IP and Hostname level.

As example http://www.dataenter.com/doc/xwall_greylisting_exclusions.htm

Would that not be a feasible solution that SF could exclude also all *. yahoo.com Hosnames instead just of the IP's?

Regards

SF4.5.0.1-beta
Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4104
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 27 September 2011 at 4:31pm
Wayne,

Have you manually added the IPs to the greylist filter as discussed in the other thread above? Spammers can (very) easily spoof the reverse DNS host name of an IP, and provide false information in the EHLO and MAIL FROM commands incorrectly identifying themselves as *.yahoo.com. Doing so would immediately render the greylist filter useless in such cases. This is why we solely rely on checking the IP addresses of the senders.
Roberto Franceschetti

LogSat Software

Spam Filter ISP
Back to Top
yapadu View Drop Down
Senior Member
Senior Member


Joined: 12 May 2005
Status: Offline
Points: 297
Post Options Post Options   Thanks (0) Thanks(0)   Quote yapadu Quote  Post ReplyReply Direct Link To This Post Posted: 28 September 2011 at 4:23am
Don't forget, you can turn greylisting off as well if you find it is causing too many problems.

It also depends on how much email you process, we notice almost no delays anymore...  The more email you process the more your greylist knows about legit email servers.

For us it works well, I can recall only a single customer complaining about it in the last year or so.
--------------------------------------------------------------
I am a user of SF, not an employee. Use any advice offered at your own risk.
Back to Top
Wayne View Drop Down
Groupie
Groupie
Avatar

Joined: 29 August 2006
Location: Switzerland
Status: Offline
Points: 60
Post Options Post Options   Thanks (0) Thanks(0)   Quote Wayne Quote  Post ReplyReply Direct Link To This Post Posted: 28 September 2011 at 8:49am
Roberto

Yes we added your IPs to the list, but Yahoo has more servers and there are not all included so far.
I will give up then and really think about to disable the greylist filter and see what happens then. What is worse? Mails from customers we never get or more spam.....we will see.

@yapadu

Right now we have 43'000 entries in the GreyListAllowed file, but still every week some customers who call us because they can't get through. Good if it works well for you, for us also many years, but now the Yahoo complaints are piling up.

Thanx for the feedback.
SF4.5.0.1-beta
Back to Top
yapadu View Drop Down
Senior Member
Senior Member


Joined: 12 May 2005
Status: Offline
Points: 297
Post Options Post Options   Thanks (0) Thanks(0)   Quote yapadu Quote  Post ReplyReply Direct Link To This Post Posted: 30 September 2011 at 4:57am
Hi Wayne,

Yes we must process more email through our servers, as our primary has 545,000 entries.

If you send me your email I can email it to you.  You can try it, might be a better option than just shutting yours off.

You could also take my list and your list, merge them to remove dupes so if you have some servers that we don't you will not be impacted.
--------------------------------------------------------------
I am a user of SF, not an employee. Use any advice offered at your own risk.
Back to Top
Wayne View Drop Down
Groupie
Groupie
Avatar

Joined: 29 August 2006
Location: Switzerland
Status: Offline
Points: 60
Post Options Post Options   Thanks (0) Thanks(0)   Quote Wayne Quote  Post ReplyReply Direct Link To This Post Posted: 30 September 2011 at 5:29am
Thx for the offer yapadu Smile

Fully agree, better to give it a try than to turn it off.
But I guess it will help just for a short time, because we haven't that much traffic as you, so some of the Yahoo servers will disappear quickly from the list after a few weeks.

Sent you a PM Wink
SF4.5.0.1-beta
Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4104
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 10 October 2011 at 8:48pm
Please see new forum announcement at:
for a new whitelist that is available.
Roberto Franceschetti

LogSat Software

Spam Filter ISP
Back to Top
 Post Reply Post Reply
  Share Topic   

Forum Jump Forum Permissions View Drop Down



This page was generated in 0.338 seconds.