Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've used greylisting on my servers for many years, but I don't know how effective it is nowadays.

Is it still good for fighting spam in 2012?

Or is the typical spammer MTA capable of resending greylisted emails now?

share|improve this question
    
"Good" for what? Greylisting does have pros and cons. –  Michael Hampton Oct 9 '12 at 12:24
1  
@Michael: For fighting spam. Read the question :) –  neu242 Oct 9 '12 at 12:48
1  
I changed the title slightly. Does it look better now? –  neu242 Oct 9 '12 at 13:09
1  
@MichaelHampton Uh, point of interest... what spam prevention measures do you use that don't cause the CEO to complain? Or maybe, if more appropriate, what kind of CEO do you have that isn't a spoiled, whiny $#^&*@ who'll find something to complain about in absolutely anything? –  HopelessN00b Oct 9 '12 at 15:22
1  
@HopelessN00b Our CEO is not like that. I wouldn't be judging someone's personality or behaviour based solely on their profession. –  darvids0n Oct 10 '12 at 2:23

4 Answers 4

up vote 44 down vote accepted

I last looked at this quantitatively in July of this year (2012). In July, my mailserver received about 46,000 attempts to deliver mail; of those, about 1,750 returned and were permitted through by the greylisting (and passed valid sender domain, SPF and some other non-content-based tests). Of those, about another 1,500 were filtered by my content-based filtering..

Assuming that those 44,250 emails were spam (since they couldn't pass greylisting, I think that's a fair assumption), if it were not for the greylisting my content-based filtering would have had to deal with 46,000 mails instead of 1,750.

A twenty-five-fold increase in load on my content-based filtering would require me to have much beefier CPUs and more memory. That would in turn increase my monthly hosting costs, because of the extra power consumption (and, probably, the size of the server).

So in short, the last time I counted, yes, greylisting still made very, very good sense as part of a complete spam-filtering system. I have activated it for clients in the past few weeks, and all are extremely happy with the decrease in load on their content-based filtering systems also.

Edit: I note that I haven't answered the question about whether it's becoming less effective over time. When I turned it on, in late 2006, my estimate at that time was that it was filtering out about 95% of the spam. 1,750 as a proportion of 46,000 is about 4%, so my data suggest that it's not become less effective over that time period.

share|improve this answer
    
Exactly the kind of answer I was looking for. Thanks! –  neu242 Oct 9 '12 at 11:55
2  
I think it makes a lot of sense to look at this quantitatively in your particular situation. I just checked, and my mail server sees very different figures: total for August and September, 460214 5xx rejects, 12331 4xx rejects and 22665 accepts. Thus, 4.6% accepted and only 2.6% of spam (at best) blocked by greylisting. The 5xx rejects are dominated by 8.4% unknown user and >90% RBL. (And I don't even run extremely aggressive RBLs. A completely overwhelming majority of the RBL blocks are XBL.) Then again, traffic caught by RBLs never make it to greylisting. –  Michael Kjörling Oct 9 '12 at 14:36
6  
Interesting, but I can't make a direct comparison because I won't, as a matter of principle, use any RBL as a brightline test for receipt; I only use them as contributors to a spamassassin score. I've been on RBLs myself too often, for completely bogus reasons, to entrust the operation of my own mail to someone else's rationale. If, however, we were to assume that all those XBL rejections are from fire-and-forget botnets, then if you greylisted first as I do, you'd see comparable percentages to me. –  MadHatter Oct 9 '12 at 14:47
1  
Yes, I have strongly considered changing it to being only a spam score contributor and relying on greylisting, for precisely the reason that you mention. However, that does not negate the point I was making, that different servers may see very different traffic patterns and the only way to really know if greylisting is effective is to look at it from the point of view of your particular setup. –  Michael Kjörling Oct 10 '12 at 12:20
1  
I was going to disagree again, but really I completely agree with you. For all users, the best way to find out if it's an effective technique in your mail flow is to try it in your mail flow and measure - Michael speaks wisely! –  MadHatter Oct 10 '12 at 12:25

spambots usually still don't do message queueing , but some of them just send the spam twice to every recipient with a few minutes delay to defeat greylisting. also, nowadays, spam from spambots isn't the real problem anymore, spam from compromised yahoo accounts etc is much harder to catch.

From that point of view, greylisting is not as effective as it used to be. In combination with other anti-spam techniques it can still help, for example if your domain is often in the "first batch" of spam campaigns, greylisting can help delay the message long enough for domain/ip blacklists to catch up, so if the spam would have slipped through your filters on the first connection attempt, it maybe gets detected on the second attempt.

share|improve this answer
    
The vast majority of the Spam delivery attempts I receive do come from Spambots. I use other techniques to discourage Spambots and most give up before they can be be greylisted. On my server Greylisting still blocks about half the senders, it processes. I do exempt senders which can be determined to be extremely likely to pass greylisting. –  BillThor Oct 10 '12 at 0:35

As a tangential issue, i don't like being in the position of having deployed a technique like greylisting without being able to measure its effectiveness. On Debian, with postfix as the MTA and postgrey as the greylisting policy engine, you can just apt-get install mailgraph to get a simple graph of accepted vs. rejected mail. Mailgraph is a bit old school and completely standalone, but it works, and its data or techniques could easily be integrated into a more complex modern monitoring system.

share|improve this answer

Get a reputation-based mail filter. Greylisting is a bit old-school and isn't a comprehensive solution. There are workarounds (from the spammer's perspective), and unpredictable mail delivery times for your users...

Either outsource the filtering to a cloud service or buy an appliance that has access to such a list and has other methods of validating spam. My recommendation is usually Barracuda for their appliance or for their cloud filtering solution. Both options have economies of scale and mature heuristics that provide a cleaner overall solution.

Looking at one of my client's Barracuda Spam Filter's report for September 2012, out of 98,457 messages, 1,623 were cut-off before even hitting the mail server because of bad recipients... 34,488 were blocked as SPAM. Only 96 questionable messages made it through. Those rated as SPAM were a combination of reputation, score, intent, three RBL's, Bayesian filtering and custom rulesets. All in one unit... All processed before hitting the relatively small mail server.

enter image description here

Also see: Fighting Spam - What can I do as an: Email Administrator, Domain Owner, or User?

share|improve this answer
2  
Interesting, but you're not answering my questions regarding greylisting. And your stats without greylisting numbers aren't very relevant here :) –  neu242 Oct 9 '12 at 12:51
    
@neu242 The point is that 1). Greylisting has known-disadvantages, 2). cannot be considered a whole solution and 3). there are better ways of detecting spam as the processes have evolved over the past few years. –  ewwhite Oct 9 '12 at 12:57
4  
Greylisting is of course just a part of my spam prevention toolkit. My setup is much like @MadHatter's. But since I asked specifically about greylisting, I sort of expected greylist specific answers. –  neu242 Oct 9 '12 at 13:05
1  
@ewwhite: actually, I don't see how it wasn't rather clear. For your reference: I did check the question history. Didn't see a change that affected this in any way. –  Jürgen A. Erhard Dec 2 '12 at 1:31
1  
@JürgenA.Erhard You're a little late to this. And your post is rude. Any professional spam filtering solution implemented today should not rely solely on greylisting. If you have any other concerns, see the canonical Server Fault spam question here. –  ewwhite Dec 2 '12 at 1:35

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.