Kent J. Chen's WebLog

...information technology, internet, and random thoughts

Greylisting - Another Spam Killer

sshot-30Greylisting, a method of defending email users against email spam, actually hasn't been widely adopted in most of modern anti-spam system.  I am so impressed honestly, even at the first time when I heard of it.  It greylists any emails from a non-recognized sender for a short time and temporarily rejects it.  The assumption is that since temporary failures are built into the RFC specifications for e-mail delivery, a legitimate server will attempt to connect again later on to deliver the e-mail.  Why would it work to against the spam?  Because if the email is from a spammer, it will probably not bother to be retried.

Sounds good but how can I implement it?  It depends on what kind of mail server you are running.  Greylisting implementations have a pretty full list how to implement it based on the platform.  We are running Exchange server so basically this Grynx Greylist Freeware works for us.

Installation is easy, download the package and extract it onto the server where SMTP server runs, but the configuration is a little bit tricky.  First of all, I don't want it run on the same Exchange server so I have to load another Windows 2003 Server with SMTP service enabled, and configure it to relay all incoming emails to the internal Exchange server.  Secondly, configure it to use SQL database rather than an Access database.  Finally, updating the firewall so from now on all incoming emails will go to the new SMTP gateway with Greylisting enabled first before hitting to the internal Exchange server.

Everything runs beautifully, it has blocked over 4,000 from coming into our mail server just about 10 hours after I implemented it.  There is a big issue that could cause it not being used eventually in our organization. 

The most significant disadvantage of greylisting is the fact that, like all spam mitigation techniques, it destroys the near-instantaneous nature of email people have come to expect, and throws email back to the early days when it was slow and unreliable. A customer of a greylisting ISP can not always rely on getting every email in a small amount of time. Thus email loses its function as easy and effortless vehicle to transfer electronic information instantaneously.

Because of this, I have to take a step back and put the schedule on the firewall so the rule that redirects emails to the greylisting enabled SMTP server will be only on after hours.  It's still a huge help because it reduces a huge amount of spams that we need to monitor.  Whoever monitors all filtered spam for any false positives still owes me a big thank-you.

[advertisement] If you happen to be a fan of mini moto or pocket bike and are looking for a parts for your toy, check it out these parts listed on kncnet's eBay store

Print | posted on Monday, September 10, 2007 12:22 AM | Filed Under [ Security ]

Feedback

Gravatar

# re: Greylisting - Another Spam Killer

Hi,
What you should really do is to have a look at the successor of Greylist for Exchange - JEP(S).
It has all the nice features of the reviewed version, is still available in a free version and has a lot of improvements - and more to come.

Cheers,
Chris
www.Grynx.com www.Proxmea.com
9/29/2007 5:22 AM | Chris

Post Comment

Title  
Name  
Email
Url
Comment   
Please add 7 and 5 and type the answer here:

My Recent Posts