Resolved Greylist delay on likely all incoming e-mail

[pos-sudo]

Dear,

Since a port 25 failure block by my ISP (which is unblocked now) because of SPAM. Do I have issues with incoming email, they are delayed and it takes very long before they will proccessed and delivered in the inbox. After my research I read this about greylisting:

After the first email is rejected, the sender's address is added to the Greylisting database. The information is stored there for an expiration time interval.

I think that we could resolve this issue if I know how to properly remove some of those records in the existing database for the greylist, because during the block of smtp which is unblocked for now, the server tried to receiving incoming e-mails. My question is how to properly remove these or clean up these records in the database. (these I reffer to automatically added e-mail records / IP records from sender hosts)

Thanks in advance!

Greetings from The Netherlands

 

[mow]

I think you misunderstand greylisting.
The records in the database are created when a server connects for the first time trying to deliver a mail (and is rejected).
Those records allow receiving from those hosts when they connect a second time, after a (configurable) cool-off time.
They expire on their own.

There is, however, a problem with greylisting: When the sending site does not send from a single server IP but iterates through a mail-out farm, greylisting won't recognize the server from the saved record, and greylists the (new) server IP again. So the mail won't be delivered until any of those servers connects again. For speedier delivery, the domains where this happens need to be put on the whitelist. E.g.:
plesk bin grey_listing -u -domains-whitelist 'add:a*smtp-out*.amazonses.com'

 

[pos-sudo]

I think you misunderstand greylisting.
The records in the database are created when a server connects for the first time trying to deliver a mail (and is rejected).
Those records allow receiving from those hosts when they connect a second time, after a (configurable) cool-off time.
They expire on their own.

There is, however, a problem with greylisting: When the sending site does not send from a single server IP but iterates through a mail-out farm, greylisting won't recognize the server from the saved record, and greylists the (new) server IP again. So the mail won't be delivered until any of those servers connects again. For speedier delivery, the domains where this happens need to be put on the whitelist. E.g.:
plesk bin grey_listing -u -domains-whitelist 'add:a*smtp-out*.amazonses.com'

Thank you for your quick reply. If I restart the server will this fix my issue as well? Or do I misunderstanding again ?

 

[pos-sudo]

Dear,

If we disable greylisting for a domain there will be no DEFER delay, however a lot of incoming SPAM that should be blocked is also comming through. How can we avoid this? Any solutions?

Server output:

Nov 6 04:00:03 server journal: greylisting filter[25765]: Starting greylisting filter...
Nov 6 04:00:03 server psa-pc-remote[19138]: REJECT during call 'grey' handler
Nov 6 04:00:03 server psa-pc-remote[19138]: Message aborted.

Thanks in advanced!

EDIT: Thanks to other threats we have manage to fix this Issue, feel free to contact me If someone is not getting rid of this issue.

 

[chit4]

How did u fix this issue? We are currently facing the same problem.

Thanks in advance!

Dear,

If we disable greylisting for a domain there will be no DEFER delay, however a lot of incoming SPAM that should be blocked is also comming through. How can we avoid this? Any solutions?

Server output:


Thanks in advanced!

EDIT: Thanks to other threats we have manage to fix this Issue, feel free to contact me If someone is not getting rid of this issue.

 

[ChristophRo]

Greylisting does not help with blocking SPAM, trust me
99.99% of all (SPAM) mails come from legit mailservers, that have queues and will try to resend the message again, after it got rejected the first time around.

In general, I cannot recommend using greylisting anymore, as most mailprovider use a plethora of outbound SMTP servers nowadays, defeating the purpose of greylisting and only cause huge delivery delays.

 

[danami]

In general, I cannot recommend using greylisting anymore, as most mailprovider use a plethora of outbound SMTP servers nowadays, defeating the purpose of greylisting and only cause huge delivery delays.

The delay is caused from providers that send from multiple IP address. I do agree that greylisting is less useful now. If you really want to use greylisting you can solve any delays by using the Plesk greylisting CLI tool:

Example: You might see the same email in the mail log coming from different mail servers from one provider. In this case it's amazon which is getting huge delays:

a15-177.smtp-out.amazonses.com
a14-30.smtp-out.amazonses.com
a15-229.smtp-out.amazonses.com
e252-50.smtp-out.amazonses.com

To whitelist emails from Amazon matching all of the mail servers you can whitelist it using a wildcard entry (Remember that you are whitelisting the client RDNS record of the email server not an email address):

plesk bin grey_listing --update-server -domains-whitelist add:"*.amazonses.com"

 

[mow]

To whitelist emails from Amazon matching all of the mail servers you can whitelist it using a wildcard entry (Remember that you are whitelisting the client RDNS record of the email server not an email address):

plesk bin grey_listing --update-server -domains-whitelist add:"*.amazonses.com"

I recommend using a more narrow pattern like "*.smtp-out.amazonses.com", though.