Grynx community

[dennism]

I am using the Greylist program and am very impressed at how well it works.

I am working with the source code on a couple of features and would like to hear feedback...
1) sending server blacklist, any email from senders on this list will be dropped in all cases
2) bad address count for each sending server, it would perform an LDAP look up for recipients and count the number of non matchers per 24 hours (midnight to midnight...)
3) Auto blacklisting of sending servers based on number of inbound addresses that don't match recipient addresses. Possibly also an auto blacklist option to blacklist sending servers based on number of emails per day (as dangerous as that sounds it would work for us)
Option to unblacklist after x number of days.


After looking at the data that the greylist database is collecting I believe the above would help a bunch. On my server it seems that most of the spam traffic I have is doing dictionary emails in and sending us spam to thousands of different TO addresses (8500 unique addresses in 24 hours, we only have 50 users ! LOL)

I know that exchange 2003 sp2 does recipient filtering, but after reading about it, it just seems to me like a tool for the spammers to use to harvest email addresses. I know I could add tar pitting, but actually I cant, it seems that tar pitting is only supported on Windows 2003 servers, I am running Exchange 2003 on Windows 2000 Server so that's a no go.
The Microsoft built in option of "recipient filtering" is to keep checking the inbound addresses till one is good and let it through,seems like they could do better.

My way of thinking is that I want to blacklist a known spammer, dynamically if at all possible, and save space in the greylist database by not listening to them anymore. If I know that a sending server is pouring zillions of bad addresses at me they must be a spammer, this might be a way to eliminate this traffic.

Dennis Messer

[cmcawood]

Looking at my spam levels, I can honestly say an LDAP lookup would be awesome. I know EX2k3 does this, but I have quite a few clients running Ex2k servers still and the majority of spam that DOES eventually get through the Greylisting (which seems to be working fantastic in testing at the moment) is sent to invalid recipients.