Could we pick up on the greylisting topic once more?

We've just purchased a Merak Mailserver License which has Greylisting built-in. We've been testing it with a few of our domains and I must say that greylisting works very well and takes such a load off the server, that I really would like to see it implemented in Spamfilter as well.

About 90% of todays spam is caught by the greylist alone, meaning the server will never have to go beyond the RCPT TO: command, saving bandwidth and resources, since all the other filters do not have to be processed.

Think about it, a greylisting implementation is not complicated...

Cheers,

Mike

1. the filter would have to be configurable per domain, just like the other filters
2. an ip bypass for well known or misbehaving mailservers could as well be easily implemented
3. greylisting only introduces a delay on the first communication between a distinct sender and recipient. After that, there is no more delay for a configured amount of time.

Again, I really like the idea behind greylisting. The implementation as easy, there is (practically) nothing to configure and it saves quite some bandwidth and cpu resources...


Edited by mikek

Dan,

 I find most large ISP's implementing greylisting (like Yahoo and AOL) and have set my outbound server retry to 2,10,30,60 & 90 minutes. I was getting complaints about Yahoo mail taking forever to be delivered. I'm surprised you rusers haven't complained.

I think the SFE version of Greylisting should include checking the autowhitelistforceddelivery file as well as doing its triplet check.

My 5.0 cents ;-)

Well that's great news! Looking forward to the beta already! :-)

Cheers,

Mike


Edited by mikek

Any news from the greylisting filter feature front? :-)


Edited by mikek - 26 October 2007 at 9:53am

"Unfortunately" we were having good results with a single SpamFilter, but to maximize performance, all the caching needs to be done in memory. This became a problem with multiple instances of SpamFilter however, as it was impossible to share the memory cache fast enough among multiple servers.

Having separate greylisting caches for multiple servers could cause an IP to be "allowed" on one server, but be "greylisted" on another. This could in turn cause a remote server to fail the delivery due to  too many retries, if the retries keep going to  different servers.

Our only option would be to implement greylisting, but only for single-server configurations, but are afraid this would cause too many complaints from customers who deployed multiple SpamFilters.

...opinions are welcome!

Impressive, I was going to mention something similar to that.  My thoughts were to put a flag on it and if the other connected SF machines were hooked up, it could bypass those machines for that message.

Michael

I'll second a stand-alone greylisting!

Have been experimenting with some 'free' greylisitng (try hermes-project) only products but they don't handle the load at the moment.

the other problem is that all emails would come to SFI only from the ip address of the greylisting server. so all rbl functionality is lost + plenty more functionality.

we tried it on our secondary mx records as it seems to be getting way more spam then primary.

 

when it worked (for about 90 minutes at a time), it was great. almost no emails were processed, as they were 99% spam.

 

on this subject i have another idea/thought:

setup an additional MX record for one of your domains with the highest priority (read MX 99).

Chances that REAL mail servers will use that are minimal. within 10 minutes you should be able to see connections to that mx record. (100% spam from our testing).

If we then setup a smtp engine to listen on the mx records, act really slow (we know spammers like to send mail FAST), and most importantly drop the connection after the 'rcpt to:' command, only after the connection has been made to wait for 5-10 seconds. We know spammer prefer the high priority mx records, and we know they like fast smtp servers, so by acting slow, and dropping the connection, they won't try again = less spam. Any takers on the idea? any comments?

 

Amir

Hi Guys, long time no speak.