With nothing better to do on a dull/hungover Sunday morning I thought I’d investigate a rumor I’d heard in the week regarding greylisting.
Now don’t get me wrong, I’m no fan of delaying email. I just want to see if what I’d heard was true…

I’m a bit of a tree-hugging Debian/postfix junkie so getting everything going was literally childs-play. Postgrey being the implementation of choice this time round and I had it running and tested in under 2 minutes.

sudo apt-get install postgrey

Then a quick edit of postfix’s main.cf.

At this time I also reduced the timeout from 5 minutes to 40 seconds since all I’m interested in is if they come back at all.

At the same time I deliberately turned off all rbl’s so that I’d get a big & fair dataset on the trap server. Then all I had to do is sit and watch.

Now of course this let through all the spam being sent via ISP’s relays but looking for direct sending bots running on DSL’s is pretty easy because they don’t have Wanadoo/Orange or Tiscali in the headers (only kidding).

So after a quick cuppa I had the results I was expecting. Here are the log highlights:

X-Greylist: delayed 651 seconds by postgrey;  <image /knob pills
X-Greylist: delayed 602 seconds by postgrey;  <PDF
X-Greylist: delayed 602 seconds by postgrey;  <Ecard
X-Greylist: delayed 605 seconds by postgrey;  <Image/knob pills
X-Greylist: delayed 608 seconds by postgrey;  <PDF
X-Greylist: delayed 604 seconds by postgrey;  <Stock
X-Greylist: delayed 685 seconds by postgrey;  <Ecard
X-Greylist: delayed 603 seconds by postgrey;  <Stock

These were all definitely dialup/dsl pools. The interesting thing is how long they all took to come back but nevertheless it shows that at least some bots are well wise to greylisting.