Greylisting with Postfix - Is it possible to not greylist connections which are from the MX of the host?

Question

I've recently set up an email server and I'm using greylisting as a way to tackle spam. The main drawback with greylisting is that it can delay your email. However I thought of a way to speed it up. If host X connects and wants to send an email from user@example.com, and the MX record for example.com, then don't greylist it, and just let it though immediatly.

This should prevent spam in the normal way and eliminate the delay for some hosts, right?

Is there anyway to do this, or am I incorrect?

I'm using Postfix and postgrey.

Answer 1

Postgrey isn't going to support that, however there is nothing stopping you from creating or finding a policy server that will do that. If your first policy server, let's call it dns-checker.sh, passes then the mail is delivered. If it fails Postfix moves on to the next check in order under smtpd_recipient_restrictions.

For any greylist server I recommend setting max age to 63 days which is two full months plus a day. I prefer delay time to be 30 sec. A delay tends to be a delay regardless of how long it is and many large webmail servers will retry within one minute so you overall delay is very low. You'll also want to use the class C as part of the tuple rather than the specific IP which should be the default. I also use auto whitelist the domain if x number of mails are relayed which is fairly liberal. With those settings I rarely have long delay issues.

The Postfix website lists a number of addons under the Policy Server heading at this URL. http://www.postfix.org/addon.html The smtpd-policy-template package looks to be the most interesting as it's basically a template for creating your own policy server. Of course it's still up to you to write the logic and actually code. :-)

Answer 2

You can tell postgrey to not greylist some hosts (/etc/postgrey/whitelist_clients), or you can put in an access list before the postgrey policy check which lists (and accepts) your MXes. Whatever makes more sense to you.

Answer 3

I use Postgrey with Postfix myself and I do have external MX hosts that have their priority set so they should only receive mail if the main server can't be reached. In some cases these MX servers are not administered by me so I can't assume the mail coming from them is not spam.

The way Postgrey works it looks at a tuple of sending IP, sender address and recipient address. For mail coming through an MX the sending IP will always be that of your MX. Which while yes you could whitelist the IP, it would defeat the purpose of greylisting in the first place.

Unless you are certain that the mail being sent to your mail server from an MX is not spam I would suggest not trying to short-circuit the greylisting process. If the mail is regular then the delay will only occur when a new tuple is seen and mail will flow smoothly through thereafter.

Answer 4

I never used Postfix and postgrey but the theory should work if you can make it happen.

I am also using greylisting on our mail server and has been using it for a couple of years. It works great, blocks 95+% spam initially from coming in. And because i have the same concern as yours, I only do it off work, like turn it off at 6:00pm and turn it back on at 7:00am next morning.

Answer 5

Spammers are catching up, and graylisting may not be as effective as it used to be. If you can, try using some RBLs, I find that they are more effective. YMMV.

AFAIK, postgrey cannot determine if the remote server's IP coresponds with the IP for the MX record of sender domain. Some other tools might be more adept to the task, take a look at postfix's add-on page for that.

As a side note, whichever technique you use, it may have a downside. RBLs might occasionally block some legitimate mail (although I find that quite rare with good RBLs and generally worth the trouble) and graylisting gives you a delay. Also, regarding your plan, sender box might not be the same machine the MX record is pointing to, so it might not be efficient if you're mostly dealing with mail from big domains. You'll need sender's address to be able to look up MX record for the domain, and, as we know, that's easily forged. Servers ocasionaly process mail for more than one domain.

On a brighter side, postgray implements auto-whitelisting of clients which repeatedly show to be able to pass the greylist. So, unless you really have to, maybe you shouldn't worry much about the delay.