GenerationIP

Type : System
Operating System : Redhat,Fedora,Centos
Write by : Fabien FAYE

In this how to, i want to present you sqlgrey a very simple greylisting solution for the limitation of your spam.

How it works from wikipedia explanation :

Typically, a server employing greylisting will record the three pieces of data known as a "triplet" for each incoming mail message:

• The IP address of the connecting host
• The envelope sender address
• The envelope recipient address

This is checked against the mail server's internal database. If this triplet has not been seen before (within some configurable period), the email is greylisted for a short time (also configurable), and it is refused with a temporary rejection. The assumption is that since temporary failures are built into the RFC specifications for email delivery, a legitimate server will attempt to connect again later on to deliver the email.

In practice, most greylisting systems do not require an exact match on the IP address and the sender address. Because large senders often have a pool of machines that can send (and resend) email, IP addresses that have the most-significant 24 bits (/24) the same are treated as equivalent, or in some cases SPF records are used to determine the sending pool. Similarly, with mailing lists which use unique per-message return-paths (via variable envelope return path or VERP), if an exact match on the sender address is required, each post from such a mailing list will be delayed. Instead, some greylisting systems try to eliminate the variable parts of the VERP by using only the sender domain and the beginning of the local-part of the sender address.

Greylisting is effective because many mass email tools used by spammers will not bother to retry a failed delivery, so the spam is never delivered. When a spammer does retry a delivery after the waiting period has expired, however, it will likely be after a number of automated honeypots have detected the spam source and listed both the source and the particular message in their databases. Thus, these subsequent attempts are more likely to be detected as spam by other mechanisms than they were at first.