Re: [Emailcore] Status of Greylisting (i'd wish MessageID were part of SMTP prologue)

It appears that Steffen Nurpmeso  <[email protected]> said:
>This is interesting, for example the Firefox browser i use only
>can manage one password for all the IETF mailing-lists i am
>subscribed too (iirc, many many months, but it tried to auto-fill
>a false one now, and i definetely recall having problems with
>password auto-fill for mailing-list subscriptions), so
>auto-filling the password just does not work.

I believe you, but that has nothing whatsoever to do with SMTP or
the way that mail works.

>These are interesting numbers far beyond mine, thank you!  (It
>surely will increase now that i post on @ietf.org, as always.)
>Yes /24, not /8.  Really very interesting that /24 is of so much
>use even today.  Many sites use multiple "deferred" until a retry
>is accepted, and your "one month" white listing is also a number
>quite large i think.

It might as well be forever.  The only point of greylisting is
to see if an MTA follows the spec well enough to retry.  Once
you've seen a retry, greylisting is of no further use for that
source.  The only reason I time out after a month is to keep
the local whitelist database from getting too big.

>I find it interesting that such simple greylisting that cannot
>even correctly identify a specific message seems so useful still.

But identifying the specific message is not important. How often does
a spambot send two different messages with the same envelope in a
time gap that makes it look like a retry? Basically, never.

I have tried a version of greylisting that did the retry after DATA
and kept a hash of the message. I found that a certain number of
systems regenerate the retried message in a form that is not quite the
same, e.g., different timestamps. The hashes don't match and the
retries always failed.

R's,
John