0

I have a FortiMail with Greylisting turned on. The idea is that only after a valid SMTP retry, an email will get released.

However, it appears that for a large email provider like outlook.com, that SMTP retries arrive from different IP addresses, which completely defeats Greylisting.

Does RFC 2821 specify that SMTP retried MUST come from the same IP address? If not, I don't see how Greylisting can work.

  • 1
    The Wikipedia article for greylisting mentions that "because large senders often have a pool of machines that can send (and resend) email, IP addresses that have the most-significant 24 bits (/24) the same are treated as equivalent, or in some cases SPF records are used to determine the sending pool. " – Trevor Reid Mar 19 at 15:32
  • I have simply whitelisted and exempted the ip-ranges used by the handful large and problematic email providers that suffered from that particular scenario – HBruijn Mar 19 at 15:39
0

The RFCs don't really say anything about what IP address a sender might use.

You can leave greylisting on in this scenario if you can tolerate lengthy delays in mail receipt.

I run greylisting with 300 seconds and this is sufficient for virtually every email provider, including O365. While they often do resend from a different address, for any given message the pool of IPs they use is rather small, and the message does eventually arrive. After that it's not a problem.

  • Don't you find that the multiple sending IP's result in multiple Greylist entries, causing the originals to expire and emails potentially lost (like when the sending service gives up...)? Also, 300 seconds, is that your initial Greylist delay? (the period of time immediately following receipt of a "new" email during which your Greylist device continues to reply with a rejection)? – Novox Mar 20 at 17:38
  • I don't expire entries in the greylist. So future messages will come through. And yes, 300 seconds is the initial delay. After 301 seconds the mail can come in. – Michael Hampton Mar 20 at 18:11
0

Greylisting may be turned off for DNSWL.org listed addresses.
[I do not know if FortiMail supports it]

It should fix cases of almost all large email providers.

https://www.dnswl.org/?page_id=15

How to use

You may use dnswl.org data to filter however you like, but our general recommendations are:
Skip greylisting for all listed IPs (none – high)
All listed hosts are expected to pass greylisting so you are only avoiding delays, not affecting what gets blocked.

Caveat: Greylisting some freemail providers may increase the chance that bulk detectors (Razor/Pyzor/DCC etc) catch some additional spam.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.