[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: greylisting on debian.org?

This one time, at band camp, Thomas Bushnell BSG said:
> martin f krafft <madduck@debian.org> writes:
> > Anyway, I'll be interested to hear a summary of their arguments, as
> > Christian Perrier requested. I find it hard to imagine how properly
> > configured greylisting should cause any problems.
> It's a violation of the standard.  It is especially problematic,
> because it is a violation against the spirit of being liberal in what
> you accept, and conservative in what you require.

Sadly, those days may be coming to an end.

> It assumes, for example, that the remote MTA will use the same IP
> address each time it sends the message. If the remote MTA is a big
> server farm, with a lot of different hosts that could be processing
> the mail, what is your strategy for preventing essentially infinite
> delay?

I use a greylist implementation that autowhitelists after a configurable
number of successful retries for a tuple.  Assuming you mean places like
yahoo or aol, the essentially infinite delay you speak of has never been
an issue so far.  They all end up whitelisted after a while, and then
mail from them proceeds without delay.  Assuming the number of users
debian has, it shouldn't take very long to record hits for all of their
outbound servers.
> Another problem is with hosts that do not accept a message from an MTA
> unless that MTA is willing to accept replies.  This is a common spam
> prevention measure.  The graylisting host cannot then send mail to
> such sites until they've been whitelisted, because when they try the
> reverse connection out, it always gets a 4xx error.  I've been bitten
> by this one before.

That is an odd implementation of sender callouts designed by someone who
doesn't understand SMTP, and is not really an issue for the conversation
at hand.  Normal sender callouts, which route the message to the public
MX, have their pros and cons, but it's not under discussion at the
|   ,''`.                                            Stephen Gran |
|  : :' :                                        sgran@debian.org |
|  `. `'                        Debian user, admin, and developer |
|    `-                                     http://www.debian.org |

Attachment: signature.asc
Description: Digital signature

Reply to: