Internet and e-mail policy and practice
including Notes on Internet E-mail


2011
Months
Nov

Click the comments link on any story to see comments or add your own.


Subscribe to this blog


RSS feed


Home :: Email


09 Nov 2011

Greylisting still works Email

Greylisting is a hoary technique for rejecting spam sent by botnets and other poorly written spamware. When a mail server receives an attempt to deliver mail from a hitherto unseen sending host IP address, it rejects the message with a "soft fail" error which tells the sender to try again later. Real mail software does try again, at which point you note that the host knows how to retry and you don't greylist mail from that IP again. The theory is that spamware doesn't retry, so you won't get that spam. I wrote a paper on it for the 2005 CEAS conference, and concluded that conservative greylisters worked well.

We've now been using greylisting for close to a decade, and some people have argued that it's no longer useful, since the bad guys could easily fix their spamware to retry, or since bots are so cheap, they could just send everything twice. So does it still work?

I recently went through my greylister's logs and collected some statistics for both a recent week, and the past year, about hosts that I greylisted:

 WeekYear
No retry12121294812
One retry745662402
Many messages495674590

The first row is the number of hosts that got a soft fail and never came back. The second row is the number that retried the message that failed, but never sent anything again, and the third row is the number that retried and sent more messages after that.

As you can see, for the week, about half of the greylisted hosts didn't retry, and over a year, about 2/3 didn't. That's still a lot of mail my mail server didn't have to filter. I attribute the different ratios to the shutdown of several botnets over the past year, evidently botnets that didn't retry.

So it's certainly not a magic bullet (what is?) but greylisting still is an effective way to deter a lot of spam cheaply.


posted at: 11:11 :: permanent link to this entry :: 3 comments
posted at: 11:11 ::
permanent link to this entry :: 3 comments

comments...        (Jump to the end to add your own comment)


Nice stats.

Any stats on how much legitimate email was among those messages that were greylisted?

(by Martijn Grooten 05 Nov 2011 16:38)



Did you do comparisons to get an idea if it's worth using? I mean, yes it works, but with high quality DNSBLs, in your opinion does it still make using it when pondering the pros and cons?

(by Joao Gouveia 07 Nov 2011 04:31)


This is post DNSBL
I don't greylist any address that's in the DNSBLs I use (Spamhaus Zen, mostly) so, yes, greylisting is useful along with DNSBLs.

(by John L 07 Nov 2011 10:39)


Add your comment...

Note: all comments require an email address to send a confirmation to verify that it was posted by a person and not a spambot. The comment won't be visible until you click the link in the confirmation. Unless you check the box below, which almost nobody does, your email won't be displayed, and I won't use it for other purposes.

 
Name:
Email: you@wherever (required, for confirmation)
Title: (optional)
Comments:
Show my Email address
Save my Name and Email for next time

Topics


My other sites

Who is this guy?

Airline ticket info

Taughannock Networks

Other blogs

CAUCE
Criminal Abuse of Domain Names: Bulk Registration and Contact Information Access
87 days ago

A keen grasp of the obvious
My high security debit card
394 days ago

Related sites

Coalition Against Unsolicited Commercial E-mail

Network Abuse Clearinghouse



© 2005-2018 John R. Levine.
CAN SPAM address harvesting notice: the operator of this website will not give, sell, or otherwise transfer addresses maintained by this website to any other party for the purposes of initiating, or enabling others to initiate, electronic mail messages.