What is greylisting?
From Wikipedia, the free encyclopedia
Greylisting is a method of combating unsolicited email (spam) at mail server level.
Healthy mail server
A healthy mail server, also known as an MTA (Mail Transfer Agent), is a server that is not used for spamming. An example is the mail server of an Internet Service Provider (examples of Internet Service Providers are Chello, XS4All, Planet and Ziggo).
Unhealthy mail server
An unhealthy mail server is a server that sends large volumes of unsolicited (spam) messages to a large number of users.
How it works
We use greylisting on some servers. This feature may be enabled in particular when a server is struggling with large volumes of spam. The big advantage is that the load on the server drops considerably straight away. A greylisting record remains valid with us for 36 days, so delays should not occur very often.
How it works
Greylisting works by means of a rejection message (usually code 451) that the receiving mail server returns to the sending mail server. A "healthy" sending mail server will store the message temporarily and try again later. The receiving mail server will remember this based on various criteria. For example, the receiving mail server can remember the IP address in combination with the sender. That combination is then added to a whitelist.
As soon as the healthy sending mail server tries again after, say, 10 minutes (configurable), the receiving mail server checks the IP address and sender and, based on the configured time, either accepts the message or rejects it again. The IP address and domain are usually stored in a local database. On the next delivery, the local database is consulted to see whether this is a trusted combination. If so, the email is accepted immediately.
The idea behind this is that a healthy mail server keeps a queue and tries again after a few minutes. An "unhealthy" mail server (spam server) cannot afford to do this, because otherwise its own queues would fill up. As a result, its storage could fill up, which could cause other problems.
Advantages
Because few spam servers can handle this technique, very little unsolicited email is accepted by the receiving server.
Because the rejection is done with a 451 message at mail server level, the email does not even reach the spam filters. Spam filters such as SpamAssassin are known to be programs that demand a lot of processing power from the server.
Disadvantages
A major disadvantage of greylisting is that the end user depends on the mail server. The end user has no control over how quickly the sender is accepted. Nor does the end user have any control over when the sending mail server will offer the email again. To give a concrete example: the Internet Service Provider @home has a so-called requeue time (the time after which the sending mail server makes another attempt to deliver the email) of 1 hour. So the first time, it will take an hour before an email from an @home address is accepted. This is very inconvenient if the recipient is waiting for that very email.
Another disadvantage of greylisting is that spam servers are not the only ones without a queue. Programmers do not always use the local mail functionality and instead try to connect to the receiving mail server directly, without going through a sending mail server. The email will be rejected the first time and the user who triggered this action will most likely get an error message.
In addition, many large Internet Service Providers use a combination of several mail servers. The message is offered again later, not from the same IP address but from a different one. This means that many well-known domains have to be whitelisted in advance. And those are often exactly the well-known sources of spam.