Re: [exim] greylisting issue

On 4/21/2005 6:42, "Stephen Gran" <steve@???> wrote:

> On Thu, Apr 21, 2005 at 01:59:39PM +0200, Brian Candler said:
>> On Wed, Apr 20, 2005 at 12:20:59PM -0500, Craig Jackson wrote:
>>> It's the few mail servers that I need to receive
>>> mail from that don't resend that I'm concerned about. For example,
>>> Southwest Airlines does not always resend.
>>
>> You are saying that Southwest Airlines have configured their mail server so
>> that their outgoing mails are dropped on the floor in response to any
>> temporary error??
>
> I don't believe so - I have heard this before, but I use greylisting
> here and we get their mails without a problem. There was initially some
> delay, but no lost mail AFAIK.

We don't seem to have problems with Southwest Airlines (but they are an
example of what should be whitelisted--we haven't--I'll try to find time).
We did whitelist United Airlines after some problems.

There are servers around which seem to retry quite often within the first
few minutes (despite the SHOULD in the RFC suggesting waiting 30 minutes),
and then not retry again for several hours (four seems popular, but that's
after the last "quick" retry).

Server farms are another problem, in situations where a different server in
the farm is the one which retries...that just starts a new greylist
sequence...I've seen the dance last a couple of days with Ticketmaster.

One should build a simple and flexible way to do the whitelisting. We do
our greylisting in a daemon running in Python that we wrote...it returns
just ACCEPT or DEFER to Exim (ACCEPT includes the forms of whitelisting we
use). So the semi-complex database queries are written in a more friendly
environment than Exim ACL language. [The daemon also "normalizes" the
recipient addresses, so that many forms of VERP normalize to the same string
for a given recipient, avoiding greylisting delays for many sites which VERP
with a unique string per message per recipient.]

Our Exim config deals with deferring greylisting to DATA time for the empty
envelope sender so that "proper" callbacks aren't affected.

--John




--John