What
happend to my spam?
Greylisting
- or what makes spammers different.Spammers deal
with a lot of emails every day. Most of them send several
millions on a daily base. In other words - as many as
they can get out. When quantity counts, retries are
a costly option. Most spammers will opt out of retries.
Greylisting
is great filter for many reasons :
- Very
low false positive casualties
- Costs
spammer bandwidth trying to get around it
- Easily
maintained by the administrator
- Creates
no non- delivery notices to spoofed senders
The Greyfilter
is based on the simple fact spammers don't waste time
resending email but mail server by RFC standard retry
a connection many times . When XWall
sees a message with an unknown triplet it will issue
a temporary message handling problem (5.4.1). In other
words it tells the other side, "I can't take your
message right now - try again." RFC-based mail
servers have no problem with that. Spammers, however,
seldom retry sending messages. Estimates are this filter
can get rid of 80% of the spam.
A triplet
is a composition of e-mail sender, e-mail receiver and
sending host ( server). Xwall stores
the triplet information. It can identify each incoming
triplet as new or seen before. It even knows how long
ago it saw the triplet.

Graylisting's
criteria
- The IP
address of the host attempting the delivery
- The envelope
sender address
- The envelope
recipient address
Pitfalls: If
you consider implementing the Greylist filter, you need
to assess your current situation or may experience negative
effects. It happened to me even knowing well how it
works. I'm talking about backup and redundancy mail
servers. I Use that great service form Zoneedit. They
offer a store and forward mail service or overflow buffer
for as little as $10.00 a year. So I implemented the
Gray filer and it started doing its job. But looking
at the ESATAdmin report my overall spam catching was
diminished. What happened? The backup mail service did
what it was supposed to do. It buffered the mail and
sent it to XWall. Now coming from a
"good" host it even passed the spam services
like spamhaus.org. (That of course can be prevented
by checking the headers). S, if you plan on using the
Greylist filter and you have a backup server you MUST
make sure the backup mailserver uses a XWall
as well.
ESATInformer
report shows greylisting
The greylisting
filter is so effective many will worry about loosing
good mail. Actually the filter is very reliable. There
may be some newsletters that simply don't re-send. These
could be blocked. They would show up in the ESATInformer
email report. The user can spot them with ease and the
admin can place an exclusion. ESATInfomer also helps
the user to understand address spoofing better by showing
the origination country and host of the originating
email server. In most cases that will calm down the
Boss when finding his wife on the report and then realizing
she does not live in Korea.

|