Greylisting Not Really Blocking

[eacobb]

Givens: Installed greylisting per instructions, Plesk 8 with FC4 at Spry, MySQL database is being updated.

I get the 5 minute delay as I specified in the config file. However, spam seems to still come through. All domains keep getting spam.

Is there something different I should do since I have multiple domains hosted on the same server?

Thanks,

Eric

 

[atomicturtle]

Its not a silver bullet, you're still going to get spam with greylisting. Its just going to cut down on those spammer MTAs that dont retry to send messages when they encounter an error.

 

[eacobb]

More Info

I'm still concerned. I've read many many posts in this forum about spam going from 200 a day to 2. Or no spam at all. Etc. My clients go from 200 a day to 190. It still seems something's not right.

 

[eacobb]

Also, do you think it would help to increase the "wait" time from 5 minutes to 10? Or will this not matter if the remote MTA will still retry?

 

[atomicturtle]

200 to 190 is a lot more realistic to be honest. I'm very dubious of any claim that high, aside from a well trained bayesian database, I've never seen anything have that level of consistancy in blocking spam.


Greylisting functions by creating a temporary mail failure, that causes the sending mail server to retry the message. Spammer MTA's, which are usually very basic cgi scripts, trojan mailers on desktop systems, or a custom mail server, will not try to resend messages on that error message. It is on these servers that greylisting will block traffic effectively.

However any normal mail server that has been rendered an open relay, which is the vast majority of spam sources, will retry the message when it encounters the temporary failure. I suspect that the reason why people report major success is that in the first 24 hours or so, greylisting does have an effect on those systems, because they cant retry for a day or more. Once those hosts start to get whitelisted, the volume once again resumes.

This is why it's important to combine multiple levels of anti-spam systems together. Greylisting, RBL's, SURBL's, Razor/DCC/Pyzor, and a well trained bayesian db (this IMHO is creepy good once its well trained).