On Tuesday, December 7, 2004, 5:50:05 AM, Paul Schwarz wrote:
I'm using XWall and this is what it states:
GreyListing
GreyListing spam filter, based on http://projects.puremagic.com/greylisting
The GreyListing method looks at three pieces of information about any particular mail delivery attempt:
The IP address of the host attempting the delivery The envelope sender address The envelope recipient address
From this an unique triplet for identifying a message is created and if this
triplet was never been seen before, or the sender is not excluded or on the white list, then the message delivery is refused with a temporary failure.
Any normal SMTP server will reschedule the message and will resend it after some time ( usually 10 - 15 minutes ).
Spammers however are sending applications designed specifically for spamming. These applications usually adopt the fire-and-forget methodology. That is, they attempt to send the spam to one or several MX hosts for a domain, but then never attempt a true retry as a real SMTP server would.
There are some misbehaving mail servers that have a problem with GreyListing and XWall automatically excludes them. You will find the list at GreyListing Exclusions
Note: Make sure your backup MX SMTP also runs XWall or any other SMTP server that support GreyListing or else the spammer will bypass XWall by sending to XWall first and then to the backup MX.
Max triplets to gather
Defines how many triples XWall should member
Initial delay of a previously unknown triplet Lifetime of triplets that have allowed mail to pass Lifetime of triplets that have not yet allowed a mail to pass
Defines the time interval of the triples
Show detailed triplet description (last seen, time elapsed)
If this is enabled XWall shows a detailed description about the status of the triplet, including the last seen and elapsed time.
Thanks. That matches the usage of the term greylisting that Dave mentioned. It's probably a somewhat reasonable approach, though it may itself be RFC non-compliant. I'm sure others have looked into that issue though I haven't.
Jeff C. -- "If it appears in hams, then don't list it."