Spam Filter ISP Forums : Greylisting story https://www.logsat.com/spamfilter/forums/ Thu, 05 Mar 2026 09:23:54 +0000 Sat, 12 Jan 2008 21:50:34 +0000 http://blogs.law.harvard.edu/tech/rss Web Wiz Forums 11.04 360 https://www.logsat.com/spamfilter/forums/RSS_post_feed.asp?TID=6330 <![CDATA[Spam Filter ISP Forums]]> https://www.logsat.com/spamfilter/forums/forum_images/web_wiz_forums.png https://www.logsat.com/spamfilter/forums/ <![CDATA[Greylisting story : Yep, same positive results here...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6330&PID=11524&title=greylisting-story#11524 Author: WebGuyz
Subject: 6330
Posted: 12 January 2008 at 9:50pm

Yep, same positive results here after about 6 days. My own email quarantine was averaging about 60-70 new quarantined items a day and now its about 3-4 a day.
 
So the greylisting picks up the single shot spammers and the blacklist cache cleans up the repeat offenders who got thru the greylist.  A good 1-2 punch that spammers will find hard to get around. And with the SFDC cranking up V4 SFE is getting to be an even better product. Thanks for listening and improving it!!Clap
 
 
]]> Sat, 12 Jan 2008 21:50:34 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6330&PID=11524&title=greylisting-story#11524 <![CDATA[Greylisting story : Roberto et al, First, I want...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6330&PID=11522&title=greylisting-story#11522 Author: Desperado
Subject: 6330
Posted: 12 January 2008 at 2:24pm

Roberto et al,
 
First, I want to state once again, how effective the GreyListing has been for us.  Here are some observations after MANY hours of log analysis.
 
Over the first 6 days, our inbound connection attempts went way up as most messages had to do 2 attempts as expected.  Over the 6 days, the connection count went down and became asymptotic as the GreyListAllow list populated ... again, as expected.  As of today, our quarantined items has reduced to one quarter, dramatically reducing the load on our SQL server while the actual, delivered good mail quantity remained at it's normal levels.  After the first few days I relaxed several of my RegEx filters based on False Positive reports (automatically generated every time a customer pushes a message out of quarantine). 
 
Bottom line is that we have reduced our False Positives to about 0.0095% while our server resources has been reduced to about 1/5 of the level it was running prior .  Oh, and customer complaints ... ZERO!
 
This is just getting better and better.  Thanks!
]]> Sat, 12 Jan 2008 14:24:12 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6330&PID=11522&title=greylisting-story#11522 <![CDATA[Greylisting story : StevenJohns wrote:I hope...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6330&PID=11515&title=greylisting-story#11515 Author: LogSat
Subject: 6330
Posted: 11 January 2008 at 5:05pm

Originally posted by StevenJohns StevenJohns wrote:

I hope that this does not mean that we need to run SF in enterprise mode with the database enabled as we run SF in SFI mode, forwarding emails to an internal server??

Do not worry, with SpamFilter ISP "standard" we will not be requiring the use of the database for anything else other than the quarantine database. All filters will always work without the need of the database.
]]> Fri, 11 Jan 2008 17:05:07 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6330&PID=11515&title=greylisting-story#11515 <![CDATA[Greylisting story : hi, No problems here either,...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6330&PID=11512&title=greylisting-story#11512 Author: Web123
Subject: 6330
Posted: 11 January 2008 at 1:24pm

hi,
 
No problems here either, spam in quarantine about 80 less now with greylisting active Smile
 
/Kim
]]> Fri, 11 Jan 2008 13:24:07 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6330&PID=11512&title=greylisting-story#11512 <![CDATA[Greylisting story : Hi Dan, Our hits have decreased...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6330&PID=11511&title=greylisting-story#11511 Author: dcook
Subject: 6330
Posted: 11 January 2008 at 1:20pm

Hi Dan,

Our hits have decreased also while the number of items quarantined while greylisting has been somewhat constant.
 
We have had only one customer complain and it was due to the mail not being retried more than once.  But the customer had the issue with three different ISP's?
 
 
 
]]> Fri, 11 Jan 2008 13:20:38 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6330&PID=11511&title=greylisting-story#11511 <![CDATA[Greylisting story : All, Just wondering if I am...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6330&PID=11510&title=greylisting-story#11510 Author: Desperado
Subject: 6330
Posted: 11 January 2008 at 12:48pm

All,
 
Just wondering if I am the only one seeing a large (huge really) decrease in ATTEMPTED connections ... almost like the Spammers add my servers to a "don't bother trying again" list. I do know that many applications will add servers to a "suppression" list but usually only after getting a "hard" bounce - 5xx code.
 
Anyway, after a large amount of log parsing I have set the following settings and am really enjoying the results.
 
Primary MX server:
GreyListInterval=420
GreyListLimboHold=8
GreyListAllowedHold=30
 
Secondary MX Server:
GreyListInterval=600
GreyListLimboHold=8
GreyListAllowedHold=2
 
Still zero complaints from my customers!
]]> Fri, 11 Jan 2008 12:48:47 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6330&PID=11510&title=greylisting-story#11510 <![CDATA[Greylisting story : &gt;&gt;In this beta, the &#034;GreyListAllowed.txt&#034;...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6330&PID=11499&title=greylisting-story#11499 Author: StevenJohns
Subject: 6330
Posted: 10 January 2008 at 6:12pm

>>In this beta, the "GreyListAllowed.txt" file that is used to hold the list of IP addresses that has passed the greylisting stage and are allowed to make connections is self-maintained and handled by the running SpamFilter. It cannot be changed by external application.

In the next betas we'll work with SpamFilter Enterprise to have this list stored in the database and distributed amongst the various SpamFilters.
 
 
 
I hope that this does not mean that we need to run SF in enterprise mode with the database enabled as we run SF in SFI mode, forwarding emails to an internal server??
 
By the way, just testing the greylisting....looks good so far.

 
]]> Thu, 10 Jan 2008 18:12:09 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6330&PID=11499&title=greylisting-story#11499 <![CDATA[Greylisting story : FYI - an updated beta is available...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6330&PID=11475&title=greylisting-story#11475 Author: LogSat
Subject: 6330
Posted: 09 January 2008 at 1:44pm

FYI - an updated beta is available in the registered user area.]]> Wed, 09 Jan 2008 13:44:08 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6330&PID=11475&title=greylisting-story#11475 <![CDATA[Greylisting story : I just installed the beta yesterday...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6330&PID=11458&title=greylisting-story#11458 Author: dcook
Subject: 6330
Posted: 08 January 2008 at 9:45am

I just installed the beta yesterday and our quarantine levels are down 80% per hour.  If you are using MYSQL -- here is a way to get a count per hour on qyarantined messages:
 
select  MsgInfo, Count(MsgHour) MsgCount
from (select DATE_FORMAT(MsgDate,'%m-%d-%Y %h %p') as MsgInfo, DATE_FORMAT(MsgDate,'%Y%m%d%H') as MsgHour From tblquarantine) as msgtable
Group By msgtable.MsgHour Order By  MsgHour Desc
 
ApproveVery impressed thus far.  I also sent an email to my hosted clients announcing the greylisting as a positive step in spam reduction and to expect an email to be delayed a few minutes.  I've had several atta-boy's from the clients responding to this email.
 
 
]]> Tue, 08 Jan 2008 09:45:24 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6330&PID=11458&title=greylisting-story#11458 <![CDATA[Greylisting story : just installed the beta and am...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6330&PID=11455&title=greylisting-story#11455 Author: mikek
Subject: 6330
Posted: 08 January 2008 at 5:09am

just installed the beta and am very impressed! the performance gain is great, before I usually had 10 - 15 concurrent connections which had to run through the various filters and now I'm down to 1 - 2...

great work (as always) Roberto!

cheers,

Mike
]]> Tue, 08 Jan 2008 05:09:31 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6330&PID=11455&title=greylisting-story#11455