Are there any plans to implement greylisting? Here is a whitepaper on the subject:

http://projects.puremagic.com/greylisting/whitepaper.html - http://projects.puremagic.com/greylisting/whitepaper.html

The basic premise is this:

Every message attempt initially gets rejected with a 451 temporary error, and three pieces of info are cached: the IP, to addy, and from addy. If the same combination (IP,to,from) is seen again between min_time and max_time, the message is passed to other checks, and the triplet is cached for a period of time. Additional messags from the same triplet (IP,to,from) bypass the greylist.

Min_time is usually around 5 minutes to prevent instant retries, and max_time is usually around 24 hours. Triplet cache time is on the order of days, something like 30-40 days.

ASSP, a free spam proxy perl script, implements this, and it worked really well. The problem(***edit - program***) was buggy for other reasons or I would be using it. But the Greylist was a great feature.

The reason it works is that most mail servers are configured to retry a couple of times after 10-60 minutes (sometimes even up to 24 hours) on a temporary error, whereas automatic spam programs usually give up on any error the first time, or will retry again very quickly.

I would really like to see this implemented. Thoughts?

I'm sorry, but I disagree. Greylisting and the blacklist cache are two entirely different methodologies. Number one, the blacklist cache is a reactive filter - it waits for a certain amount of spam from an IP before doing anything. Number two, the ban is too broad, being based on IP only. I have had many problems with this feature where a legitimate emailer is trying to send mail through their ISP's mail server when the ISP also has a spamming customer in their midst. Granted, the ISP should be taking care of this, but all my clients care about is that they are not getting messages from legitimate contacts.

A greylist solves both of these problems. Rather than relying on checking with friends ("Hey, is this server a spammer?") or the message content or country of origin, it challenges every message that comes through with "Prove to me you are legitimate." It's the fundamental difference of innocent until proven guilty vs. guilty until proven innocent. Given that 90%+ of my incoming mail is spam, I prefer the latter. Asking all the messages to wait for a few minutes and try again later is a very good way to "authenticate" legitimate messages. Most legitimate mail servers will retry on temporary failures after a short period of time. Most spamming programs only try once.