Greylisting
|
|
Greylisting is a simple method of defending electronic mail users against e-mail spam. In short, a mail transfer agent which uses greylisting will "temporarily reject" any email from a sender it does not recognize. If the mail is legitimate, the originating server will try again to send it later, at which time the destination will accept it. If the mail is from a spammer, it will probably not be retried.
Greylisting requires little configuration and modest resources. It is designed as a compliment to existing defenses against spam, and not as a replacement.
| Contents |
How it works
Typically, a server that utilizes greylisting will record the following three pieces of information (known as a "triplet") for each incoming mail message:
- The IP address of the connecting host.
- The envelope sender address.
- The envelope recipient address.
This is checked against the mail server's internal whitelist. If any of this information has never been seen before, the email is greylisted for a set period of time (how much time is dependent on the server configuration), and it is refused with a temporary rejection. The assumption is that since temporary failures are built into the RFC specifications for e-mail delivery, a legitimate server will attempt to connect again later on to deliver the e-mail.
Greylisting is effective because many mass e-mail tools utilized by spammers are not set up to handle temporary bounces (or any bounces, for that matter; they will never bother to retry a failed delivery), so the spam is never delivered.
Advantages
The main advantage from the user's point of view is that greylisting requires no additional configuration from his end. If the server utilizing greylisting is configured appropriately, the end user will probably not notice any delays in e-mail delivery.
From a mail administrator's point of view, only minimal configuration is usually required on the mail server for greylisting to work.
Disadvantages
There is the possibility that poorly-configured e-mail systems will translate the temporary reject as a permanent bounce and not deliver the mail, which would lead to legitimate mail being bounced. This can be combated with whitelisting or exception lists.
Greylisting delays all unknown e-mail, not just spam.
Since there is always an ongoing arms race between legitimate e-mail administrators and those who send bulk e-mail, the likelihood is that spam tools which are thwarted by greylisting will be fixed to circumvent this safeguard in the future.
Links
- A greylisting whitepaper by Evan Harris (http://projects.puremagic.com/greylisting/whitepaper.html)