[07] WHAT IS GREYLISTING? HOW DOES HELP WITH SPAM OR UCE?

     SPAM that you receive can be forwarded to 'spam-bucket@sdf.org'.
     This file is accessible to all users and the purpose of it is to help 
     identify spammer networks and spam content.

 WHAT IS GREYLISTING?

     Greylisting is a passive approach to dealing with spam.  It allows the
     SDF SMTP server to keep track of the SMTP servers that communicate with it
     by establishing a tuple:  IP of the sending server, address of the sender
     and address of the recipient.  When SDF receives a connection from an 
     unknown SMTP server it issues a 451, which basically means "I'm busy, 
     please retry later".  This sort of response occurs normally for a multiple
     of reasons everyday such as:  The user is over quota, the file system is 
     full, the load average is too high and so on.  A properly configured MTA 
     will follow the SMTP protocol and respect a 451 by using its default retry
     interval which can be anywhere between 5 minutes to 60 minutes typically.
     SDF's greylisting is only in effect for 1 minute from the sending server's
     first attempt.  This is well within a reasonable retry period of a 
     properly configured SMTP server.  When the previously greylisted server 
     connects back within 20 hours of its first attempt, SDF accepts its 
     connection and allows the email to be delivered.  The tuple is then 
     whitelisted for 72 hours.  This also takes in account for other SMTP 
     servers on the same or neighbouring networks since greylisting on SDF only
     matches numbers up to CLASS B/16 (255.255.0.0) and therefore the smaller 
     CIDRs and all host numbers are ignored.  This allows greylisting to work 
     with massively large e-mail harvesting farms such as Gmail.

     Senders with SPF compliant headers are automatically passed without
     being deferred.

     There is a simple utility called 'greylist' you can use to see what tuples
     apply to you.  Its important to note that if you do see a tuple in the 
     greylist that you known is legtimate it will always show up in the 
     autowhitelist, for 72 hours, when the sending host retries.  Because it
     is possible that a spam host could resend before they change their IP 
     address, you could receive that spam on a retry.  However, it is unlikely
     that they will retry and therefore you will always receive legitimate 
     email with a very low percentage of that possibly being spam.

     By default greylisting is enabled for all SDF members.  If you would 
     like to disable it, which is not recommended, you may do so by typing
     'greylist -t'.  You can re-enable it with the same command.

     MetaARPA members can also use the 'greylist -tw' command to create their 
     own rules to apply to mail delivery specific to their email addresses and 
     their domains.  You must have greylisting enabled otherwise there will be 
     no need for a whitelist.  This custom whitelist is a flat text file called 
     .wl in the user's home directory with a single email address on each row 
     of the file.  The file can only contain email addresses and 
     meta-characters will be stripped and ignored.