Re: More anti-spam tuning.

Scott Walde writes:
> Greg Oster wrote:
>
> >Dylan Griffiths writes:
> >
> >
> >>Greylisting really helped out as well, although enough spammers use
> >>compromised real email servers that I still get spam.
> >>
> >>
> >
> >In general, greylisting rocks. In the two real-world deployments of
> >greylisting (via gld: http://www.gasmi.net/gld.html ) that I've done,
> >we've seen the spam volume drop by some 90%. (about 6000-9000 pieces
> >of mail on one system..)
> >
> >
> I'm having issues with gld. Some spammers seem smart enough to retry in
> 5 minutes, but gmail retries from a different IP address each time, so
> it gets blocked. Am I not using it right? or is this just collateral
> damage?

Collateral damage that's easy to fix by putting the gmail servers
into the whitelist. (there should be a "table-whitelist.sql" file
somewhere that has "Googlemail" entries, among others). Other good
candidates for the whitelist are folks like BUGTRAQ, and anyone else
who changes the "from=" address on a *per-message* basis.

> So far, my greylist has 14 rows, with 5 of those being spams that
> successfully navigated gld (and two more I expect to, soon), and two
> rows are gmail, which hasn't. That's not a very good ratio in my opinion.

I'll leave it to the stats experts out there to determine if this
sample size is sufficient for drawing conclusions about the
population characteristics ;)

Later...

Greg Oster
Received on Mon May 15 10:57:24 2006