GeoIP based greylisting with Exim?

Question

I have been using Sendmail together with milter-greylist for many years at several sites.

milter-greylist has support for defining greylisting rules based on GeoIP database lookups. This is very convenient for companies who do not do business internationally. Almost all spam is sent from foreign IP addresses. It does not matter if legitimate (ham) e-mail from foreign addresses is slightly delayed. Local e-mail must arrive without delays, thus greylisting is skipped for a couple of country codes. Also if SPF record matches or the IP is on a whitelist the greylisting is skipped. This is very simple to implement in greylist.conf with the milter hook in sendmail.cf. It is also good for the mail server's resources because most spam is dropped before it ever arrives on the server and thus the system load caused by spamassassin and/or dspam based filtering solutions further down the delivery path is much lower.

Now to the real question:

How can I implement similar (i.e. GeoIP based) greylisting with Exim?

I have a new responsibility to take care of yet another mail server which happens to run Exim and receives a high volume of spam. I do not feel like re-implementing their e-mail delivery system from scratch but I definitely need to do something about the load caused by their spam volumes. Unfortunately Exim does not seem to have milter interface. Also I was unable to locate greylisting solutions with GeoIP support for Exim. I am a complete noob with Exim (I can do everything with sendmail.cf and sendmail m4 macros).

I would be happy if implementing this feature was possible by using just exim configuration file syntax. In that case I would take the effort of learning it and possibly starting to use exim at other sites as well.

Answer 1

By far the best way to manage spam is by bayesian filtering. While you may get transient benefits applying other approaches before applying the bayesian filters, the success of bayesian filtering is dependant on having a large volume of spam and ham to model - so if you start denying emails based on the IP address then you'll lose out in detection in the long run. OTOH it should be possible to flag the message rather than just denying it.

SPF, and RBLs are also well proven ways to prevent spam. And supported by spamassassin (along with Bayesian filtering and others).

Have you modelled your data to see whether adding country lookup will improve spam detection? Compared with a well configured spamassassin installation?

If you must go down this route....

Writing a milter is easy - but IIRC, Exim does not support milters.

Trying to map out all the allowable IP addresses as Exim ACLs would be very difficult.

So the most practical way to implement this would be using a MDA which supports header injecting filters (e.g. procmail) which then feeds into spamassassin.

Answer 2

It only helps a little bit, but there are GeoIP services that are queryable via DNS (like DNSBLs). Maybe you can use it as a base for making decisions based on the result.

See for example http://www.netop.org/services/ip-geolocation