Re: Spam passing greylisting.

Dave Lists wrote:

> Hi all,
> Everytime I mention greylisting I fear I'll start another arguement,
> so if you are against greylisting in concept or practice please ignore
> this thread.
> For those of you using it, are you finding more and more spammers
> are passing through greylisting? Example: [...]
>
> Now this system retried about once every 2 minutes, until it got
> through. Are you finding this happening to you? Is there anything we
> can do other than increase the delay?


I'm using greylisting with a 5-minute delay (most of the MTAs retry
after ~20 minutes but many after ~6 minutes from my logs) and some RBLs
to try to catch the sources when they come back.

I've not done any stats myself (Greylisting is done before RBL checks on
my configurations) but some SQLgrey users reported RBLs letting first
attempts pass, being greylisted and then blocked by RBLs before the
greylister let them in.
In fact this is what was the original idea with greylisting to help with
its obvious flaw: when spammer learn to retry, fallback on RBLs after
giving them enough time to be updated.

The amount of SPAM being catched this way with some RBLs could be quite
interesting to have...

Lionel.