Greylisting Testimonial

The spammers never stop. Their current most productive scheme seems to be to hijack Windows machines on broadband networks (cable modem or DSL) and use them to send out massive amounts of spam. While this doesn't foil content-based tools like SpamBayes, the huge amount of spam that can be sent out makes the tools at the receiving end work that much harder.

I used to run postfix on the Mojam/Musi-Cal mail server. In late March 2005 I spent a couple hours configuring it for better spam rejection. One of the biggest wins was enabling greylisting. The graph below identifies the number of incoming messages on my laptop that were classified as ham or spam by SpamBayes. Note the significant drop in spams after I enabled greylisting on our mail server. (The huge spike in May 2005 was due in large part to a Sober.Q virus outbreak that took awhile to quell.) I chose postgrey, but I believe other solutions are available.

Greylisting graph

Greylisting works by temporarily deferring email from unknown senders. Standards-compliant SMTP servers will try back a bit later. After five minutes of retrying, postgrey accepts the mail for delivery and marks the sender as "known" in its database. Future mail from that sender is accepted immediately. Greylisting works because many (most?) sources of spam don't retry mail delivery. Even if they did, they might not have five minutes to wait before the ISP of the hijacked box recognizes that a host on their network has been commandeered and disconnects it from the network.

In short, I'm a fan of greylisting. If you're looking for server-side anti-spam solutions, it ought to be one of the weapons in your arsenal.


Skip Montanaro
(skip@pobox.com)