You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Vahric MUHTARYAN <va...@doruk.net.tr> on 2006/11/20 23:33:23 UTC
Greylisting
Hello Everybody,
I'm using SA for a long time without any problem, nowadays spammers are using too much graphical objects and they are tring to change it day by day. I'm tring to use fuzzyocr but it's taking too much cpu. I think that try greylisting . I wonder are there anybody use greylisting ? Somebody can give me feedback ?
Regards
Vahric
Re: Greylisting
Posted by Rick Macdougall <ri...@ummm-beer.com>.
Vahric MUHTARYAN wrote:
> Hello,
>
> Do you come across with any problem from your clients for mails are not
> arriving at right time ? Because I afraid of people mta's all of them
> are configured with different retry times .
Hi,
We whitelist the major providers and people like Yahoo and Gmail, etc.
We have our retry delay limit set at 1 minute, so most normal servers
will retry at a maximum of 15 minutes and be successful.
Like someone else mentioned, there are a lot of brain dead servers out
there and I have seen a server retry 8 hours later.
I've never seen anything greater than 8 hours though and once it does go
through, that tuple is whitelisted for 45 days (with my setup anyways).
Regards,
Rick
Re: Greylisting - branching further off topic
Posted by Matt Hampton <ma...@coders.co.uk>.
Benny Pedersen wrote:
> On Tue, November 21, 2006 00:23, Michele Neylon :: Blacknight wrote:
>> Dylan Bouterse wrote:
>>> Do you have a compiled list of those IPs? And what method are you using
>>> to whitelist? Email offlist if more appropriate. Thanks!
>> We whitelist the main Irish ISPs, so our list wouldn't be of much use to
>> you unless you were in Ireland :)
>
> i do the same exatly here, just for danmark, no isp should imho be greylisted
>
> i solved it by using marbl, search for this postfix policy on google
>
> that means greylist if connecting ip is listed on a rbl list, it works nice here
>
> olso whitelist ips that typical send forwarded mails, important if you have
> spf test in mta level
>
I am running a small test "real time whitelist" (RWL) suitable for for
this. It currently has those addresses that milter-greylist provides
(plus a few others) and I intended to open this up for people to test.
I am looking for some comments on a policy to add IP addresses to the
list. If anyone has any suggests please email me off list.
Also if anyone is interested in a patched version of smf-grey which
supports RBLs and RWLs then please let me no - again off list
regards
Matt
Re: Greylisting
Posted by Benny Pedersen <me...@junc.org>.
On Tue, November 21, 2006 00:23, Michele Neylon :: Blacknight wrote:
> Dylan Bouterse wrote:
>> Do you have a compiled list of those IPs? And what method are you using
>> to whitelist? Email offlist if more appropriate. Thanks!
> We whitelist the main Irish ISPs, so our list wouldn't be of much use to
> you unless you were in Ireland :)
i do the same exatly here, just for danmark, no isp should imho be greylisted
i solved it by using marbl, search for this postfix policy on google
that means greylist if connecting ip is listed on a rbl list, it works nice here
olso whitelist ips that typical send forwarded mails, important if you have
spf test in mta level
--
This message was sent using 100% recycled spam mails.
Re: Greylisting
Posted by "Michele Neylon :: Blacknight" <mi...@blacknight.ie>.
Dylan Bouterse wrote:
> Do you have a compiled list of those IPs? And what method are you using
> to whitelist? Email offlist if more appropriate. Thanks!
>
We whitelist the main Irish ISPs, so our list wouldn't be of much use to
you unless you were in Ireland :)
--
Mr Michele Neylon
Blacknight Solutions
Hosting & Colocation, Brand Protection
http://www.blacknight.ie/
http://blog.blacknight.ie/
Tel. 1850 927 280
Intl. +353 (0) 59 9183072
UK: 0870 163 0607
Fax. +353 (0) 59 9164239
Re: Greylisting
Posted by Leander Koornneef <l....@ic-s.nl>.
On 21-nov-2006, at 0:21, Dylan Bouterse wrote:
> Do you have a compiled list of those IPs? And what method are you
> using
> to whitelist? Email offlist if more appropriate. Thanks!
>
Postgrey, for instance, comes with its own whitelist. I presume most
greylisting software does?
Leander
>
>> -----Original Message-----
>> From: Michele Neylon :: Blacknight [mailto:michele@blacknight.ie]
>> Sent: Monday, November 20, 2006 6:01 PM
>> To: users@spamassassin.apache.org
>> Subject: Re: Greylisting
>>
>> Vahric MUHTARYAN wrote:
>>> Hello,
>>>
>>> Do you come across with any problem from your clients for mails are
> not
>>> arriving at right time ? Because I afraid of people mta's all of
> them
>>> are configured with different retry times .
>>>
>>
>> We whitelist the main ISPs SMTPs to avoid this issue
RE: Greylisting
Posted by Dylan Bouterse <dy...@corp.power1.com>.
Do you have a compiled list of those IPs? And what method are you using
to whitelist? Email offlist if more appropriate. Thanks!
Dylan
> -----Original Message-----
> From: Michele Neylon :: Blacknight [mailto:michele@blacknight.ie]
> Sent: Monday, November 20, 2006 6:01 PM
> To: users@spamassassin.apache.org
> Subject: Re: Greylisting
>
> Vahric MUHTARYAN wrote:
> > Hello,
> >
> > Do you come across with any problem from your clients for mails are
not
> > arriving at right time ? Because I afraid of people mta's all of
them
> > are configured with different retry times .
> >
>
> We whitelist the main ISPs SMTPs to avoid this issue
>
>
> --
> Mr Michele Neylon
> Blacknight Solutions
> Hosting & Colocation, Brand Protection
> http://www.blacknight.ie/
> http://blog.blacknight.ie/
> Tel. 1850 927 280
> Intl. +353 (0) 59 9183072
> UK: 0870 163 0607
> Fax. +353 (0) 59 9164239
Re: Greylisting
Posted by "Michele Neylon :: Blacknight" <mi...@blacknight.ie>.
Vahric MUHTARYAN wrote:
> Hello,
>
> Do you come across with any problem from your clients for mails are not
> arriving at right time ? Because I afraid of people mta's all of them
> are configured with different retry times .
>
We whitelist the main ISPs SMTPs to avoid this issue
--
Mr Michele Neylon
Blacknight Solutions
Hosting & Colocation, Brand Protection
http://www.blacknight.ie/
http://blog.blacknight.ie/
Tel. 1850 927 280
Intl. +353 (0) 59 9183072
UK: 0870 163 0607
Fax. +353 (0) 59 9164239
Re: Greylisting
Posted by Philip Prindeville <ph...@redfish-solutions.com>.
John D. Hardin wrote:
>On Tue, 21 Nov 2006, Vahric MUHTARYAN wrote:
>
>
>
>>Do you come across with any problem from your clients for mails are not
>>arriving at right time ? Because I afraid of people mta's all of them are
>>configured with different retry times .
>>
>>
>
>Whitelist your clients' known MTA IP addresses.
>
>Greylisting is supposed to throttle connections from J. Random MTA,
>not sites with whom you are regularly exchanging legitimate email.
>
>
But that's the point, isn't it?
Graylisting needs to both pay attention to whom you've
received email from in the past, and track outgoing email
and automatically add the recipients on outgoing email
to your graylist.
Now, are you graylisting based on the remote end's
IP address? Or on the mail from:?
Because the former seems to be more reliable, but at the
same time more work: you need to look at the outgoing
email's domain, then try to figure out who their MX'ers
and SPF'ers are. Of course, if they use different hosts
for incoming and outgoing mail, then this falls on its
face...
Which a lot of large companies do: Cisco, Albertsons...
-Philip
Re: Greylisting
Posted by "John D. Hardin" <jh...@impsec.org>.
On Tue, 21 Nov 2006, Vahric MUHTARYAN wrote:
> Do you come across with any problem from your clients for mails are not
> arriving at right time ? Because I afraid of people mta's all of them are
> configured with different retry times .
Whitelist your clients' known MTA IP addresses.
Greylisting is supposed to throttle connections from J. Random MTA,
not sites with whom you are regularly exchanging legitimate email.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
A sword is never a killer, it is but a tool in the killer's hands.
-- Lucius Annaeus Seneca (Martial) 4BC-65AD
-----------------------------------------------------------------------
Re: Greylisting
Posted by Vahric MUHTARYAN <va...@doruk.net.tr>.
Hello,
Do you come across with any problem from your clients for mails are not
arriving at right time ? Because I afraid of people mta's all of them are
configured with different retry times .
Regards
Vahric
----- Original Message -----
From: "Rick Macdougall" <ri...@ummm-beer.com>
To: <us...@spamassassin.apache.org>
Sent: Tuesday, November 21, 2006 12:49 AM
Subject: Re: Greylisting
> Vahric MUHTARYAN wrote:
>> Hello Everybody, I'm using SA for a long time without any problem,
>> nowadays spammers are using too much graphical objects and they are tring
>> to change it day by day. I'm tring to use fuzzyocr but it's taking too
>> much cpu. I think that try greylisting . I wonder are there anybody use
>> greylisting ? Somebody can give me feedback ?
>
> Hi,
>
> I use it with great success (300-400 spams a day dropped to 2-3 a week)
> using qmail.
>
> You WILL have to add some IP's to a white list to not block braindead
> exchange (older versions) and Groupwise (lotus notes) servers that bounce
> on a 421 - Please try again later, instead of trying again later.
>
> Since it's not really an SA question, you might be better off asking on
> your MTA's mailing list.
>
> Regards,
>
> Rick
>
Re: OT sendmail mailing list - WAS:Re: Greylisting
Posted by Jerry K <sp...@oryx.cc>.
Thanks to everyone for your replies.
I was pretty sure that there were no sendmail mailing list, but I wanted
to check again after Rick's comments (below).
Jerry
Jerry Kemp wrote:
> Can anyone suggest a 'sendmail' mailing list?
>
> I am aware of NNTP comp.mail.sendmail Usenet news.
>
> Thanks,
>
> Jerry
>
>
> Rick Macdougall wrote:
>> Vahric MUHTARYAN wrote:
>>> Hello Everybody,
>>> I'm using SA for a long time without any problem, nowadays
>>> spammers are using too much graphical objects and they are tring to
>>> change it day by day. I'm tring to use fuzzyocr but it's taking too
>>> much cpu. I think that try greylisting . I wonder are there anybody
>>> use greylisting ? Somebody can give me feedback ?
>>
>> Hi,
>>
>> I use it with great success (300-400 spams a day dropped to 2-3 a
>> week) using qmail.
>>
>> You WILL have to add some IP's to a white list to not block braindead
>> exchange (older versions) and Groupwise (lotus notes) servers that
>> bounce on a 421 - Please try again later, instead of trying again later.
>>
>> Since it's not really an SA question, you might be better off asking
>> on your MTA's mailing list.
>>
>> Regards,
>>
>> Rick
OT sendmail mailing list - WAS:Re: Greylisting
Posted by Jerry Kemp <sp...@oryx.cc>.
Can anyone suggest a 'sendmail' mailing list?
I am aware of NNTP comp.mail.sendmail Usenet news.
Thanks,
Jerry
Rick Macdougall wrote:
> Vahric MUHTARYAN wrote:
>> Hello Everybody,
>> I'm using SA for a long time without any problem, nowadays
>> spammers are using too much graphical objects and they are tring to
>> change it day by day. I'm tring to use fuzzyocr but it's taking too
>> much cpu. I think that try greylisting . I wonder are there anybody
>> use greylisting ? Somebody can give me feedback ?
>
> Hi,
>
> I use it with great success (300-400 spams a day dropped to 2-3 a week)
> using qmail.
>
> You WILL have to add some IP's to a white list to not block braindead
> exchange (older versions) and Groupwise (lotus notes) servers that
> bounce on a 421 - Please try again later, instead of trying again later.
>
> Since it's not really an SA question, you might be better off asking on
> your MTA's mailing list.
>
> Regards,
>
> Rick
Re: Greylisting
Posted by Rick Macdougall <ri...@ummm-beer.com>.
Vahric MUHTARYAN wrote:
> Hello Everybody,
>
> I'm using SA for a long time without any problem, nowadays spammers are using too much graphical objects and they are tring to change it day by day. I'm tring to use fuzzyocr but it's taking too much cpu. I think that try greylisting . I wonder are there anybody use greylisting ? Somebody can give me feedback ?
>
Hi,
I use it with great success (300-400 spams a day dropped to 2-3 a week)
using qmail.
You WILL have to add some IP's to a white list to not block braindead
exchange (older versions) and Groupwise (lotus notes) servers that
bounce on a 421 - Please try again later, instead of trying again later.
Since it's not really an SA question, you might be better off asking on
your MTA's mailing list.
Regards,
Rick
Re: Greylisting
Posted by John Andersen <js...@pen.homeip.net>.
On Monday 20 November 2006 21:06, Duncan Hill wrote:
> Greylisting has been used now for over 2 years. I haven't seen any
> spammer adapt their botnets to handle it in that time frame.
But its used on .0002% of MTAs. Not worth anybody's effort
until it goes mainstream, or gets talked up here on this list.
--
_____________________________________
John Andersen
Re: Greylisting
Posted by Philip Prindeville <ph...@redfish-solutions.com>.
Brian Godette wrote:
>On Monday 20 November 2006 19:06, Rick Macdougall wrote:
>
>
>>John Andersen wrote:
>>... the spammers are not actually
>>storing the email addresses on the infected machines, they just send an
>>email to go out).
>>
>>I'm not saying they won't do it, I'm saying they aren't doing it currently.
>>
>>
>
>Actually they have been for some time as an anti-botnet surveillance measure.
>The newer spambots do a bulk download of recipients and payload, then some
>time later (hours/days?) start the run after having been disconnected from
>the controlling irc channel/web page. By the time the spam run is noticed all
>that's left is a autonomous zombie with nothing but smtp traffic.
>
>In fact I would guess that passive spam-relays, that the spammer just connects
>to as an open relay, are less common due to a large percentage of broadband
>users being behind NATs. I'm also starting to see more "behave like a real
>MTA" as well slowly making greylisting less effective.
>
>
What about "Survivor Island meets graylisting-BLs"?
Have a service where users of that service get to vote end-points
off the island... so to speak.
Ok, for those of you that haven't profited from the latest in
Hollywood's creative brilliance.... That is, you can initially
consult a graylist service and ask them about a particular end-
point. The service might come back and say, "I've not heard
about this IP address or I don't have information about it that
hasn't expired." (which would imply a low-risk assessment)
So the first few clients would not graylist this sender, and accept
email from him. If their spam filtering then said that they were
getting positive hits as a result, they would report back to the
graylisting service, saying "Hey, wait a minute... that guy that you
told me wasn't a spammer actually is!" (At this point, you might be
given a short-lived single use token with which to report back...
if you don't report back, that's counted as not complaining
against this user... if you do report back, you have to present
the single-use token back to authenticate yourself. How quickly
tokens are given out to requestors could be throttled to protect
against DoS attacks or deliberately poisoning the database.)
As more clients report back to the service that they are not having
favorable interactions with this sender, his graylist time would
soar: perhaps eventually hitting hours or days.
After he'd been quarantined sufficiently long to get sanitized
(say 14 or 30 days), the collected data would be purged and
he'd get a fresh start (or a new opportunity to hang himself, if
he's a repeat offender and not just a compromised host).
The advantages are:
* quick convergence
* you don't need to explicitly create a lot of honey-pots for
detection
* flexibility in how you weigh your negative votes against your
positive ones
Disadvantages:
* how to make the service resiliant to malicious mis-reporters
* caching would make it more scalable, but defeat the quick
convergence property
Comments?
-Philip
Re: Greylisting
Posted by Brian Godette <bg...@idcomm.com>.
On Monday 20 November 2006 19:06, Rick Macdougall wrote:
> John Andersen wrote:
> ... the spammers are not actually
> storing the email addresses on the infected machines, they just send an
> email to go out).
>
> I'm not saying they won't do it, I'm saying they aren't doing it currently.
Actually they have been for some time as an anti-botnet surveillance measure.
The newer spambots do a bulk download of recipients and payload, then some
time later (hours/days?) start the run after having been disconnected from
the controlling irc channel/web page. By the time the spam run is noticed all
that's left is a autonomous zombie with nothing but smtp traffic.
In fact I would guess that passive spam-relays, that the spammer just connects
to as an open relay, are less common due to a large percentage of broadband
users being behind NATs. I'm also starting to see more "behave like a real
MTA" as well slowly making greylisting less effective.
Re: Greylisting
Posted by jdow <jd...@earthlink.net>.
From: "Rick Macdougall" <ri...@ummm-beer.com>
> John Andersen wrote:
>> On Monday 20 November 2006 15:08, Rick Macdougall wrote:
>>> It's possible that they could send it all twice but I've never seen it.
>>> Remember that some unbelievable number of infected Windows clients are
>>> the main source of spam and it would just be too much trouble for the
>>> spammer to try every address twice after a 15 minute interval.
>>
>> Oh come on! It costs the spammer NOTHING to make that adjustment
>> to his bot net. Its someone else's bandwidth, and someone else's
>> cpu cycles.
>>
>> They are reading this list and planning the changes already.
>>
>
> Sure it costs them. If 70K hosts can send 1 billion emails a day, 70K
> hosts who have to retry can only send 1/2 a billion emails a day
> (probably less with code and retrys, the spammers are not actually
> storing the email addresses on the infected machines, they just send an
> email to go out).
>
> I'm not saying they won't do it, I'm saying they aren't doing it currently.
I thought proper greylisting requires a wait of at least X number of
minutes with each site picking its own X. Two sends with no delay can
be trapped for leading to a direct feed to salearn.
{^_^}
Re: Greylisting
Posted by Rick Macdougall <ri...@ummm-beer.com>.
John Andersen wrote:
> On Monday 20 November 2006 15:08, Rick Macdougall wrote:
>> It's possible that they could send it all twice but I've never seen it.
>> Remember that some unbelievable number of infected Windows clients are
>> the main source of spam and it would just be too much trouble for the
>> spammer to try every address twice after a 15 minute interval.
>
> Oh come on! It costs the spammer NOTHING to make that adjustment
> to his bot net. Its someone else's bandwidth, and someone else's
> cpu cycles.
>
> They are reading this list and planning the changes already.
>
Sure it costs them. If 70K hosts can send 1 billion emails a day, 70K
hosts who have to retry can only send 1/2 a billion emails a day
(probably less with code and retrys, the spammers are not actually
storing the email addresses on the infected machines, they just send an
email to go out).
I'm not saying they won't do it, I'm saying they aren't doing it currently.
Regards,
Rick
RE: Greylisting
Posted by Giampaolo Tomassoni <g....@libero.it>.
From: Philip Prindeville [mailto:philipp_subx@redfish-solutions.com]
> John Andersen wrote:
>
> >On Monday 20 November 2006 15:08, Rick Macdougall wrote:
> >
> >
> >>It's possible that they could send it all twice but I've never seen it.
> >> Remember that some unbelievable number of infected Windows clients are
> >>the main source of spam and it would just be too much trouble for the
> >>spammer to try every address twice after a 15 minute interval.
> >>
> >>
> >
> >Oh come on! It costs the spammer NOTHING to make that adjustment
> >to his bot net. Its someone else's bandwidth, and someone else's
> >cpu cycles.
> >
> >They are reading this list and planning the changes already.
> >
> >
> >
>
> If the graylist time is 15 minutes (for instance), and someone
> reports them fairly soon after they start up... and their ISP is
> quick to shut them down (cough, cough) then we're managed
> to severely limit how many sites they hit before they get
> shut down.
>
> Of course, graylisting a larger value (2 hours) for totally
> unknown correspondents would be more effective.
The problem is that actually few sites implement greylisting, so what you say makes sense.
When this technology will be deployed even by the biggest ISPs, I'm expecting less reports to be effective at the time spam gets into a greylisting MTA.
The only solution to this would be widely spreaded, non-greylisted spamtraps reporting spam as soon as it is circulated, but I don't know if their number is enough for it right now.
giampaolo
>
> -Philip
>
Re: Greylisting
Posted by Philip Prindeville <ph...@redfish-solutions.com>.
John Andersen wrote:
>On Monday 20 November 2006 15:08, Rick Macdougall wrote:
>
>
>>It's possible that they could send it all twice but I've never seen it.
>> Remember that some unbelievable number of infected Windows clients are
>>the main source of spam and it would just be too much trouble for the
>>spammer to try every address twice after a 15 minute interval.
>>
>>
>
>Oh come on! It costs the spammer NOTHING to make that adjustment
>to his bot net. Its someone else's bandwidth, and someone else's
>cpu cycles.
>
>They are reading this list and planning the changes already.
>
>
>
If the graylist time is 15 minutes (for instance), and someone
reports them fairly soon after they start up... and their ISP is
quick to shut them down (cough, cough) then we're managed
to severely limit how many sites they hit before they get
shut down.
Of course, graylisting a larger value (2 hours) for totally
unknown correspondents would be more effective.
-Philip
Re: Greylisting
Posted by SM <sm...@resistor.net>.
At 22:06 20-11-2006, Duncan Hill wrote:
>Greylisting has been used now for over 2 years. I haven't seen any
>spammer adapt their botnets to handle it in that time frame. Some
>have moved to using ISP relays or other
>unsecured 'real' MTAs, but the majority live for the one-shot
>attempt. I do see the same message (presumably) being tried by
>multiple compromised PCs (same from/to for each one, 3 seconds apart or less).
Some compromised hosts do retry delivery (same from/to/IP address)
within a minute.
Regards,
-sm
Re: Greylisting
Posted by Duncan Hill <sp...@cricalix.net>.
John Andersen wrote:
> On Monday 20 November 2006 15:08, Rick Macdougall wrote:
>> It's possible that they could send it all twice but I've never seen it.
>> Remember that some unbelievable number of infected Windows clients are
>> the main source of spam and it would just be too much trouble for the
>> spammer to try every address twice after a 15 minute interval.
>
> Oh come on! It costs the spammer NOTHING to make that adjustment
> to his bot net. Its someone else's bandwidth, and someone else's
> cpu cycles.
>
> They are reading this list and planning the changes already.
Greylisting has been used now for over 2 years. I haven't seen any
spammer adapt their botnets to handle it in that time frame. Some have
moved to using ISP relays or other unsecured 'real' MTAs, but the
majority live for the one-shot attempt. I do see the same message
(presumably) being tried by multiple compromised PCs (same from/to for
each one, 3 seconds apart or less).
Only a single data point mind you, but I'd say the majority of spammers
haven't bothered to adapt to greylisting. Yet.
Re: Greylisting
Posted by uxbod <ux...@splatnix.net>.
Just to add to the pot I have started working for a company who was receiving +30,000 emails a day and acknowledged they had a spam problem. I got the go ahead to pilot Postfix, MailScanner, SpamAssassin + FuzzyOCR and PolicyD and have now reduced that to ~ 40 emails per day being delivered. The most noticeable change was using Greylisting, with MailScanner and SpamAssassin cleaning the rest up.
To say they are impressed would be a understatement.
Well done to all the developers and contributors off these fine pieces of software.
Cheers,
UxBoD
--[ UxBoD ]--
// PGP Key: "curl -s http://www.splatnix.net/uxbod.asc | gpg --import"
// Fingerprint: 543A E778 7F2D 98F1 3E50 9C1F F190 93E0 E8E8 0CF8
// Keyserver: www.keyserver.net Key-ID: 0xE8E80CF8
--
This message has been scanned for viruses and dangerous content by MailScanner, and is
believed to be clean.
Re: Greylisting
Posted by Charlie Clark <ch...@begeistert.org>.
Am 21.11.2006 um 01:12 schrieb John Andersen:
> On Monday 20 November 2006 15:08, Rick Macdougall wrote:
>> It's possible that they could send it all twice but I've never
>> seen it.
>> Remember that some unbelievable number of infected Windows
>> clients are
>> the main source of spam and it would just be too much trouble for the
>> spammer to try every address twice after a 15 minute interval.
>
> Oh come on! It costs the spammer NOTHING to make that adjustment
> to his bot net. Its someone else's bandwidth, and someone else's
> cpu cycles.
>
> They are reading this list and planning the changes already.
Of course! Spam and Spamassassin is the ultimate cops & robbers! I'm
sure the best spammers continually update the rules and run their own
tests against them to develop new mails which get through. Despite
everyone's best efforts we are fighting a losing battle with a
solution that does not tackle the botnet problem at source but for
that to happen things might have to get a whole lot worst! :-/
Charlie
--
Charlie Clark
Helmholtzstr. 20
Düsseldorf
D- 40215
Tel: +49-211-938-5360
GSM: +49-178-782-6226
Re: Greylisting
Posted by uxbod <ux...@splatnix.net>.
PolicyD is very good aswell. http://policyd.sourceforge.net
Yet again integrates very well with Postfix, especially when using PCRE to only Greylist dialups/ADSL connections.
On Sat, 25 Nov 2006 21:50:32 -0700, bob@proulx.com (Bob Proulx) wrote:
> mail@relay.dk wrote:
>> Very interesting - and scary to be honest :(
>
> Scary? Why?
>
>> I'm guessing most greylisting software out there also operates with a
> set
>> expire for each record? This being pretty high - obviously... 1-30 days
> or
>> what is reasonable.
>
> I use the 'postgrey' package which is specifically designed as a
> greylisting package for the postfix mailer. The default max-age for a
> record in postgrey is 35 days. There are a variety of configuration
> options available. See the postgrey docs for more details.
>
> Bob
>
> --
> This message has been scanned for viruses and dangerous content by
> MailScanner, and is
> believed to be clean.
--[ UxBoD ]--
// PGP Key: "curl -s http://www.splatnix.net/uxbod.asc | gpg --import"
// Fingerprint: 543A E778 7F2D 98F1 3E50 9C1F F190 93E0 E8E8 0CF8
// Keyserver: www.keyserver.net Key-ID: 0xE8E80CF8
--
This message has been scanned for viruses and dangerous content by MailScanner, and is
believed to be clean.
Re: Greylisting
Posted by Bob Proulx <bo...@proulx.com>.
mail@relay.dk wrote:
> Very interesting - and scary to be honest :(
Scary? Why?
> I'm guessing most greylisting software out there also operates with a set
> expire for each record? This being pretty high - obviously... 1-30 days or
> what is reasonable.
I use the 'postgrey' package which is specifically designed as a
greylisting package for the postfix mailer. The default max-age for a
record in postgrey is 35 days. There are a variety of configuration
options available. See the postgrey docs for more details.
Bob
RE: Greylisting
Posted by ma...@relay.dk.
Very interesting - and scary to be honest :(
I'm guessing most greylisting software out there also operates with a set
expire for each record? This being pretty high - obviously... 1-30 days or
what is reasonable.
- Nicolai
-----Original Message-----
From: Bob Proulx [mailto:bob@proulx.com]
Sent: 23. november 2006 07:57
To: users@spamassassin.apache.org
Subject: Re: Greylisting
Philip Prindeville wrote:
> Don't they? I thought the recommended retry time was 2 minutes,
> doubling on each failure, and maxing out at 2 hours.
The traditional Sendmail would retry either every 15 or every 30 minutes.
This would almost always be seen as the command line setting as sendmail
-q30m. But this may have changed in recent Sendmail releases. I just
checked a stock RHEL4 system and the queue retry time by default there is
1h. So from such a system a greylisting would delay the initial message by
1h. Subsequent messages would pass without delay.
Bob
Re: Greylisting
Posted by Bob Proulx <bo...@proulx.com>.
Philip Prindeville wrote:
> Don't they? I thought the recommended retry time was 2 minutes,
> doubling on each failure, and maxing out at 2 hours.
The traditional Sendmail would retry either every 15 or every 30
minutes. This would almost always be seen as the command line setting
as sendmail -q30m. But this may have changed in recent Sendmail
releases. I just checked a stock RHEL4 system and the queue retry
time by default there is 1h. So from such a system a greylisting
would delay the initial message by 1h. Subsequent messages would pass
without delay.
Bob
Re: Greylisting
Posted by Philip Prindeville <ph...@redfish-solutions.com>.
Don't they? I thought the recommended retry time was 2 minutes,
doubling on each failure, and maxing out at 2 hours.
That's what sendmail does (unless it's retry time has been explicitly
set to more than 2 hours, of course).
-Philip
Richard Frovarp wrote:
>I don't think the RFCs specify any time limit. Most timeout after 5 days
>of trying. We run 3 equivalent scanning machines, which requires us to
>run a greylisting that will sync between them. That could cause a large
>delay, if the sending machine tries to send to a different host that
>isn't synced. Messages that aren't sent from the same machine (SMTP
>farms like at GMail) can cause trouble as well, since the IP will
>change. The whitelist usually will timeout after a period of time, so
>there is a delay that may be induced again in the future, but that
>depends on setup.
>
>If a sensitive piece of mail needs to get through, it may be possible
>for the user to send the message again after the delay period has
>elapsed. This would be a new message, but if it leaves the same IP, with
>the same from and to pair (or however your greylisting works), it would
>fire right on through the greylist no problem. Not a perfect solution,
>but should work for rare occasions.
>
>One probably can whitelist recipients or recipient domains so that they
>are not affected by greylisting.
>
>Last week greylisting stopped 1.3 million messages, which is after the
>blacklists and greet pause did their significant work.
>
>Richard
>
>
Re: Greylisting
Posted by Richard Frovarp <Ri...@sendit.nodak.edu>.
I don't think the RFCs specify any time limit. Most timeout after 5 days
of trying. We run 3 equivalent scanning machines, which requires us to
run a greylisting that will sync between them. That could cause a large
delay, if the sending machine tries to send to a different host that
isn't synced. Messages that aren't sent from the same machine (SMTP
farms like at GMail) can cause trouble as well, since the IP will
change. The whitelist usually will timeout after a period of time, so
there is a delay that may be induced again in the future, but that
depends on setup.
If a sensitive piece of mail needs to get through, it may be possible
for the user to send the message again after the delay period has
elapsed. This would be a new message, but if it leaves the same IP, with
the same from and to pair (or however your greylisting works), it would
fire right on through the greylist no problem. Not a perfect solution,
but should work for rare occasions.
One probably can whitelist recipients or recipient domains so that they
are not affected by greylisting.
Last week greylisting stopped 1.3 million messages, which is after the
blacklists and greet pause did their significant work.
Richard
Joey wrote:
> One thing I have seen having greylisting on all 3 of my production email
> servers (about 4 months now) is that it definatly stops a lot of spam,
> HOWEVER I am seeing time sensative stuff take crazy amounts of time to be
> delivered. I am seeing 1/2 hour as the average, not the 5 minutes we are
> hoping for, and in a few cases we have seen a message delivered literally
> DAYS later, which what I thought was against what the RFC's specify, but
> it's what's happening. I had to move 1 client OFF our main servers onto a
> reseller plan in order to accommodate getting them off of the greylisting.
>
> Personally I get about 40 fewer spam messages a DAY because of greylisting
> and I am not willing to give it up just yet.
>
> Joey
>
>
> -----Original Message-----
> From: John Andersen [mailto:jsa@pen.homeip.net]
> Sent: Tuesday, November 21, 2006 11:10 PM
> To: users@spamassassin.apache.org
> Subject: Re: Greylisting
>
> On Tuesday 21 November 2006 06:02, mail@relay.dk wrote:
>
>> I'm afraid you're right on this one.
>>
>> Of course the spammers read this very list - and they have already
>> started to implement "anti greylisting" meassures...
>>
>> It's just a matter of time before they see too little success rate
>> when they read the bot stats and start to circumvent greylisting too
>> :(
>>
>> I have yet to try greylisting on a real production system. I am
>> concerned about the 5-15 mins. delay because we have some sensitive
>> customers that are already on their toes. But with the right set of
>> arguments I'm sure I can convince even the "worst" customer that
>>
> greylisting is a good thing...
>
>> still.
>>
>
> As I understand it, greylisting does not affect anything except the FIRST
> attempt. From there on, it goes through as fast as ever.
>
> Or am I wrong?
>
> --
> _____________________________________
> John Andersen
>
>
>
>
--
Richard Frovarp
EduTech System Administrator
1-701-231-5127 or
1-800-774-1091
RE: Greylisting
Posted by Joey <Jo...@Web56.Net>.
One thing I have seen having greylisting on all 3 of my production email
servers (about 4 months now) is that it definatly stops a lot of spam,
HOWEVER I am seeing time sensative stuff take crazy amounts of time to be
delivered. I am seeing 1/2 hour as the average, not the 5 minutes we are
hoping for, and in a few cases we have seen a message delivered literally
DAYS later, which what I thought was against what the RFC's specify, but
it's what's happening. I had to move 1 client OFF our main servers onto a
reseller plan in order to accommodate getting them off of the greylisting.
Personally I get about 40 fewer spam messages a DAY because of greylisting
and I am not willing to give it up just yet.
Joey
-----Original Message-----
From: John Andersen [mailto:jsa@pen.homeip.net]
Sent: Tuesday, November 21, 2006 11:10 PM
To: users@spamassassin.apache.org
Subject: Re: Greylisting
On Tuesday 21 November 2006 06:02, mail@relay.dk wrote:
> I'm afraid you're right on this one.
>
> Of course the spammers read this very list - and they have already
> started to implement "anti greylisting" meassures...
>
> It's just a matter of time before they see too little success rate
> when they read the bot stats and start to circumvent greylisting too
> :(
>
> I have yet to try greylisting on a real production system. I am
> concerned about the 5-15 mins. delay because we have some sensitive
> customers that are already on their toes. But with the right set of
> arguments I'm sure I can convince even the "worst" customer that
greylisting is a good thing...
> still.
As I understand it, greylisting does not affect anything except the FIRST
attempt. From there on, it goes through as fast as ever.
Or am I wrong?
--
_____________________________________
John Andersen
Re: Greylisting
Posted by John Andersen <js...@pen.homeip.net>.
On Tuesday 21 November 2006 06:02, mail@relay.dk wrote:
> I'm afraid you're right on this one.
>
> Of course the spammers read this very list - and they have already started
> to implement "anti greylisting" meassures...
>
> It's just a matter of time before they see too little success rate when
> they read the bot stats and start to circumvent greylisting too :(
>
> I have yet to try greylisting on a real production system. I am concerned
> about the 5-15 mins. delay because we have some sensitive customers that
> are already on their toes. But with the right set of arguments I'm sure I
> can convince even the "worst" customer that greylisting is a good thing...
> still.
As I understand it, greylisting does not affect anything except the FIRST
attempt. From there on, it goes through as fast as ever.
Or am I wrong?
--
_____________________________________
John Andersen
RE: Greylisting
Posted by "Chris St. Pierre" <st...@NebrWesleyan.edu>.
Here's an argument for you:
http://www.nebrwesleyan.edu/people/stpierre/filtered.png
This is the breakdown of mail filtered by one of our MXes over the
past week. The "RBL" line shows mail rejected by an RBL, mostly by
njabl; the "Rejected" line is line rejected by other MTA-level rules
(like requiring an FQDN for the HELO); the "Spam" line shows mail that
was accepted, marked as spam by SA, and delivered; and the
"Greylisted" line shows mail that was delayed by Postgrey and not
retried (i.e., successfully blocked).
As you can see, about 30% of the mail we filter (and about 25% of our
total mail) is rejected by greylisting. Each of our MTAs processes
about 400K messages per week. We greylist after all other MTA
restrictions, so that boils down to over 100K messages that SA would
have to scan if we weren't using greylisting.
Chris St. Pierre
Unix Systems Administrator
Nebraska Wesleyan University
On Tue, 21 Nov 2006, mail@relay.dk wrote:
>I'm afraid you're right on this one.
>
>Of course the spammers read this very list - and they have already started
>to implement "anti greylisting" meassures...
>
>It's just a matter of time before they see too little success rate when they
>read the bot stats and start to circumvent greylisting too :(
>
>I have yet to try greylisting on a real production system. I am concerned
>about the 5-15 mins. delay because we have some sensitive customers that are
>already on their toes. But with the right set of arguments I'm sure I can
>convince even the "worst" customer that greylisting is a good thing...
>still.
>
>I wonder how many years it will take before some organization steps up and
>lead the way to new SMTP standards. My company has gone from 1 to 4 mail
>server over the past 6 months. I reckon it's about time protocols adapt to
>the world today :)
>
> - Nicolai
>
>
>-----Original Message-----
>From: John Andersen [mailto:jsa@pen.homeip.net]
>Sent: 21. november 2006 01:12
>To: users@spamassassin.apache.org
>Subject: Re: Greylisting
>
>
>On Monday 20 November 2006 15:08, Rick Macdougall wrote:
>> It's possible that they could send it all twice but I've never seen
>> it.
>> Remember that some unbelievable number of infected Windows clients are
>> the main source of spam and it would just be too much trouble for the
>> spammer to try every address twice after a 15 minute interval.
>
>Oh come on! It costs the spammer NOTHING to make that adjustment to his bot
>net. Its someone else's bandwidth, and someone else's cpu cycles.
>
>They are reading this list and planning the changes already.
>
>--
>_____________________________________
>John Andersen
>
>
RE: Greylisting
Posted by uxbod <ux...@splatnix.net>.
Hmmm, customers not willing to wait 5-10 mins for a email ? Would prefer to receive more SPAM instead, especially for a protocol that does not guarantee delivery ;) Urgent Items = Use the phone or fax
On Tue, 21 Nov 2006 16:02:34 +0100, <ma...@relay.dk> wrote:
> I'm afraid you're right on this one.
>
> Of course the spammers read this very list - and they have already started
> to implement "anti greylisting" meassures...
>
> It's just a matter of time before they see too little success rate when
> they
> read the bot stats and start to circumvent greylisting too :(
>
> I have yet to try greylisting on a real production system. I am concerned
> about the 5-15 mins. delay because we have some sensitive customers that
> are
> already on their toes. But with the right set of arguments I'm sure I can
> convince even the "worst" customer that greylisting is a good thing...
> still.
>
> I wonder how many years it will take before some organization steps up and
> lead the way to new SMTP standards. My company has gone from 1 to 4 mail
> server over the past 6 months. I reckon it's about time protocols adapt to
> the world today :)
>
> - Nicolai
>
>
> -----Original Message-----
> From: John Andersen [mailto:jsa@pen.homeip.net]
> Sent: 21. november 2006 01:12
> To: users@spamassassin.apache.org
> Subject: Re: Greylisting
>
>
> On Monday 20 November 2006 15:08, Rick Macdougall wrote:
>> It's possible that they could send it all twice but I've never seen
>> it.
>> Remember that some unbelievable number of infected Windows clients
> are
>> the main source of spam and it would just be too much trouble for the
>> spammer to try every address twice after a 15 minute interval.
>
> Oh come on! It costs the spammer NOTHING to make that adjustment to his
> bot
> net. Its someone else's bandwidth, and someone else's cpu cycles.
>
> They are reading this list and planning the changes already.
>
> --
> _____________________________________
> John Andersen
>
>
>
--[ UxBoD ]--
// PGP Key: "curl -s http://www.splatnix.net/uxbod.asc | gpg --import"
// Fingerprint: 543A E778 7F2D 98F1 3E50 9C1F F190 93E0 E8E8 0CF8
// Keyserver: www.keyserver.net Key-ID: 0xE8E80CF8
--
This message has been scanned for viruses and dangerous content by MailScanner, and is
believed to be clean.
RE: Greylisting
Posted by ma...@relay.dk.
I'm afraid you're right on this one.
Of course the spammers read this very list - and they have already started
to implement "anti greylisting" meassures...
It's just a matter of time before they see too little success rate when they
read the bot stats and start to circumvent greylisting too :(
I have yet to try greylisting on a real production system. I am concerned
about the 5-15 mins. delay because we have some sensitive customers that are
already on their toes. But with the right set of arguments I'm sure I can
convince even the "worst" customer that greylisting is a good thing...
still.
I wonder how many years it will take before some organization steps up and
lead the way to new SMTP standards. My company has gone from 1 to 4 mail
server over the past 6 months. I reckon it's about time protocols adapt to
the world today :)
- Nicolai
-----Original Message-----
From: John Andersen [mailto:jsa@pen.homeip.net]
Sent: 21. november 2006 01:12
To: users@spamassassin.apache.org
Subject: Re: Greylisting
On Monday 20 November 2006 15:08, Rick Macdougall wrote:
> It's possible that they could send it all twice but I've never seen
> it.
> Remember that some unbelievable number of infected Windows clients are
> the main source of spam and it would just be too much trouble for the
> spammer to try every address twice after a 15 minute interval.
Oh come on! It costs the spammer NOTHING to make that adjustment to his bot
net. Its someone else's bandwidth, and someone else's cpu cycles.
They are reading this list and planning the changes already.
--
_____________________________________
John Andersen
Re: Greylisting
Posted by John Andersen <js...@pen.homeip.net>.
On Monday 20 November 2006 15:08, Rick Macdougall wrote:
> It's possible that they could send it all twice but I've never seen it.
> Remember that some unbelievable number of infected Windows clients are
> the main source of spam and it would just be too much trouble for the
> spammer to try every address twice after a 15 minute interval.
Oh come on! It costs the spammer NOTHING to make that adjustment
to his bot net. Its someone else's bandwidth, and someone else's
cpu cycles.
They are reading this list and planning the changes already.
--
_____________________________________
John Andersen
Re: Greylisting
Posted by Rick Macdougall <ri...@ummm-beer.com>.
Chr. v. Stuckrad wrote:
>
> But wouldn't Spammers simply send every Mail twice in an attemtpt
> to break greylisting, then after the automatic whitelisting has been
> switched, you get everything twice, simply doubling the amount of spam
> on the long run?
>
> Just curious why I get so many spams twice or thrice in an short time
> (I have NOT installed greylisting because of that phenomeneon, I assumed
> geylisting to 'go awy' or 'to be just a fad', but I re-think about it,
> because of the CPU-Cycles needed for FuzzyOCR).
>
It's possible that they could send it all twice but I've never seen it.
Remember that some unbelievable number of infected Windows clients are
the main source of spam and it would just be too much trouble for the
spammer to try every address twice after a 15 minute interval.
I guess if everyone used greylisting, then they might start doing
something like that.
Regards,
Rick
Re: Greylisting
Posted by "Chr. v. Stuckrad" <st...@mi.fu-berlin.de>.
On Tue, 21 Nov 2006, Vahric MUHTARYAN wrote:
> I'm using SA for a long time without any problem, nowadays
> spammers are using too much graphical objects and they are tring
> to change it day by day. I'm tring to use fuzzyocr but it's taking
Same Problem here ...
> too much cpu. I think that try greylisting . I wonder are there
> anybody use greylisting ? Somebody can give me feedback ?
But wouldn't Spammers simply send every Mail twice in an attemtpt
to break greylisting, then after the automatic whitelisting has been
switched, you get everything twice, simply doubling the amount of spam
on the long run?
Just curious why I get so many spams twice or thrice in an short time
(I have NOT installed greylisting because of that phenomeneon, I assumed
geylisting to 'go awy' or 'to be just a fad', but I re-think about it,
because of the CPU-Cycles needed for FuzzyOCR).
Stucki
--
Christoph von Stuckrad * * |nickname |<st...@mi.fu-berlin.de> \
Freie Universitaet Berlin |/_*|'stucki' |Tel(days):+49 30 838-5 57 78|
Mathematik & Informatik EDV |\ *|if online|Tel(else):+49 30 77 39 66 00|
Arnimallee 6 / 14195 Berlin * * |on IRCnet|Fax(alle):+49 30 838-75 454/
Re: Greylisting
Posted by Leander Koornneef <l....@ic-s.nl>.
On 20-nov-2006, at 23:33, Vahric MUHTARYAN wrote:
> Hello Everybody,
>
> I'm using SA for a long time without any problem, nowadays
> spammers are using too much graphical objects and they are tring to
> change it day by day. I'm tring to use fuzzyocr but it's taking too
> much cpu. I think that try greylisting . I wonder are there anybody
> use greylisting ? Somebody can give me feedback ?
I started using selective greylisting a while ago and the results
are simply amazing. For instance, my private mailbox has gone
from receiving 75-100 spams/day to 2-4 spams/day. Selective
greylisting is a variant of "pure" greylisting where you don't greylist
everything, but only "suspicious" smtp clients.
I'm using maRBL (written by Ian Campbell) for this, which acts
as a policy service for Postfix. It greylists clients based on DNSBL
lookups. maRBL used to be available from
http://www.orangegroove.net/code/marbl/, but the site seems
to have disappeared....
I'm actually using a modified version of maRBL, using a patch by
Mark Martinec (of amavisd fame) that integrates p0f support to
selectively greylist Windows smtp clients:
http://archives.neohapsis.com/archives/postfix/2006-11/0577.html,
which is both brilliant and hilarious :-)
I have also added (primitive) support for greylisting based on missing
PTR records and SPF checks myself (it actually rejects if SPF fails
hard).
I have put the three versions of maRBL available for download on my
server: http://leander.koornneef.net/marbl/
Perhaps it can be of use to anyone. And thanks to Ian and Mark!
Leander
Re: Greylisting
Posted by Vivek Khera <vi...@khera.org>.
On Nov 20, 2006, at 7:29 PM, Mike Jackson wrote:
> FYI, I work for a large hosting provider, and I've seen customers
> who have implemented greylisting, but spammers are getting smart
> enough to work around it. I doubt that they're wasting resources on
> queuing for redelivery, but they are recognizing 421s and
> attempting delivery later.
>
I too have noticed a diminishing effect of greylisting. Our abuse
desk keeps getting more and more spam and it is not possible to put
any real filtering in front of it... greylisting helped a lot
initially, but the last couple of months it has really gotten out of
hand how much spam makes it past greylisting.
Re: Greylisting
Posted by Mike Jackson <mj...@barking-dog.net>.
FYI, I work for a large hosting provider, and I've seen customers who have
implemented greylisting, but spammers are getting smart enough to work
around it. I doubt that they're wasting resources on queuing for redelivery,
but they are recognizing 421s and attempting delivery later.
----- Original Message -----
From: "Vahric MUHTARYAN" <va...@doruk.net.tr>
To: <us...@spamassassin.apache.org>
Sent: Monday, November 20, 2006 16:33
Subject: Greylisting
Hello Everybody,
I'm using SA for a long time without any problem, nowadays spammers are
using too much graphical objects and they are tring to change it day by day.
I'm tring to use fuzzyocr but it's taking too much cpu. I think that try
greylisting . I wonder are there anybody use greylisting ? Somebody can give
me feedback ?
Regards
Vahric
Re: Greylisting
Posted by Vahric MUHTARYAN <va...@doruk.net.tr>.
Hello,
Actually we are receiving too much mail, and % 60 - % 70 of this are spam , also my hardwares are not enough to handle all load because of this I can miss some mails and they are spam. Instead of using fuzzy ocr or any other think I guess that I can use greylisting How they explained on their web page, maybe with this configuration I can get load from server because image base spams are growing day by day.
Regards
Vahric
----- Original Message -----
From: Giampaolo Tomassoni
To: users@spamassassin.apache.org
Sent: Tuesday, November 21, 2006 12:52 AM
Subject: RE: Greylisting
-----Original Message-----
From: Vahric MUHTARYAN [mailto:vahric@doruk.net.tr]
Hello Everybody,
I'm using SA for a long time without any problem, nowadays spammers are using too much graphical objects and they are tring to change it day by day. I'm tring to use fuzzyocr but it's taking too much cpu. I think that try greylisting . I wonder are there anybody use greylisting ? Somebody can give me feedback ?
I renamed greylisting "the force".
I works a lot to me. Just, it may need a bit more effort to get statistical data about how much spam your machine traps: now you probably see a 9/1 spam/ham ratio, after you may easily see a 1/9 spam/ham ratio. You boss may ask you why the hell is your company spending that much for spam trapping...
You must be fast answering (and proving) that most of the spam is just left out of the system... :)
For reporting, a sql-based greylisting software is probably better suited.
-----------------------------------
Giampaolo Tomassoni - IT Consultant
Piazza VIII Aprile 1948, 4
I-53044 Chiusi (SI) - Italy
Ph: +39-0578-21100
MAI inviare una e-mail a:
NEVER send an e-mail to:
rainbowl@tomassoni.eu
Regards
Vahric
RE: Greylisting
Posted by Giampaolo Tomassoni <g....@libero.it>.
-----Original Message-----
From: Vahric MUHTARYAN [mailto:vahric@doruk.net.tr]
Hello Everybody,
I'm using SA for a long time without any problem, nowadays spammers
are using too much graphical objects and they are tring to change it day by
day. I'm tring to use fuzzyocr but it's taking too much cpu. I think that
try greylisting . I wonder are there anybody use greylisting ? Somebody can
give me feedback ?
I renamed greylisting "the force".
I works a lot to me. Just, it may need a bit more effort to get statistical
data about how much spam your machine traps: now you probably see a 9/1
spam/ham ratio, after you may easily see a 1/9 spam/ham ratio. You boss may
ask you why the hell is your company spending that much for spam trapping...
You must be fast answering (and proving) that most of the spam is just left
out of the system... :)
For reporting, a sql-based greylisting software is probably better suited.
-----------------------------------
Giampaolo Tomassoni - IT Consultant
Piazza VIII Aprile 1948, 4
I-53044 Chiusi (SI) - Italy
Ph: +39-0578-21100
MAI inviare una e-mail a:
NEVER send an e-mail to:
rainbowl@tomassoni.eu
Regards
Vahric
Re: Greylisting
Posted by Vahric MUHTARYAN <va...@doruk.net.tr>.
thank you for share your experiance with me
take a care
----- Original Message -----
From: "Andy Jezierski" <aj...@stepan.com>
To: <us...@spamassassin.apache.org>
Sent: Tuesday, November 21, 2006 12:58 AM
Subject: Re: Greylisting
> "Vahric MUHTARYAN" <va...@doruk.net.tr> wrote on 11/20/2006 04:33:23 PM:
>
>> Hello Everybody,
>>
>> I'm using SA for a long time without any problem, nowadays
>> spammers are using too much graphical objects and they are tring to
>> change it day by day. I'm tring to use fuzzyocr but it's taking too
>> much cpu. I think that try greylisting . I wonder are there anybody
>> use greylisting ? Somebody can give me feedback ?
>>
>
> We've used greylisting very successfully. Probably stops 80%-90% of the
> spam from even reaching SA. Several things to be aware of. Greylisting
> will introduce a delay that you have no control over. So if you require
> your mail to be delivered immediately, it may not work for you. Not all
> mail servers respond properly to the temp error and don't try to resend.
> Some mail servers don't retry for a very long time and your mail can be
> delayed for a very long time. I've seen an 8 hour delay once. That said,
> our average initial delay is between 5 - 10 minutes, most users don't
> notice it at all. After that, the mail isn't delayed at all.
>
> HTH
> Andy
Re: Greylisting
Posted by Andy Jezierski <aj...@stepan.com>.
"Vahric MUHTARYAN" <va...@doruk.net.tr> wrote on 11/20/2006 04:33:23 PM:
> Hello Everybody,
>
> I'm using SA for a long time without any problem, nowadays
> spammers are using too much graphical objects and they are tring to
> change it day by day. I'm tring to use fuzzyocr but it's taking too
> much cpu. I think that try greylisting . I wonder are there anybody
> use greylisting ? Somebody can give me feedback ?
>
We've used greylisting very successfully. Probably stops 80%-90% of the
spam from even reaching SA. Several things to be aware of. Greylisting
will introduce a delay that you have no control over. So if you require
your mail to be delivered immediately, it may not work for you. Not all
mail servers respond properly to the temp error and don't try to resend.
Some mail servers don't retry for a very long time and your mail can be
delayed for a very long time. I've seen an 8 hour delay once. That said,
our average initial delay is between 5 - 10 minutes, most users don't
notice it at all. After that, the mail isn't delayed at all.
HTH
Andy