Greylisting

From Veximwiki

There is an implementation for exim at http://www.slett.net/spam-filtering-for-mx/exim-greylisting.html#exim-greylist-mysql

Another method that doesn't involve MySQL is shown below. Install greylistd add your exim user to the greylist group, make sure /var/lib/greylistd/whitelist-hosts is group readable, configure greylistd (set your delay time in the main greylistd config file and add your own hosts to /var/lib/greylistd/whitelist-hosts) and insert the following into vexim-acl-check-rcpt.conf:

defer
   message        = $sender_host_address is greylisted. \
                    Mail from $sender_host_address as <$sender_address> to \
                    <$local_part@$domain> is delayed. \
                    Please try again later.
   log_message    = greylisted.
   !senders       = :
   !hosts         = :  relay_from_hosts : \
   !hosts         = : ${if exists {/etc/greylistd/whitelist-hosts}\
                   {/etc/greylistd/whitelist-hosts}{}} : \
                   ${if exists {/var/lib/greylistd/whitelist-hosts}\
                           {/var/lib/greylistd/whitelist-hosts}{}}
   !authenticated = *
#    !acl           = acl_whitelist_local_deny
   domains        =  local_domains :  relay_to_domains
   verify         = recipient/callout=20s,use_sender,defer_ok
   condition      = ${readsocket{/var/run/greylistd/socket}\
       {--grey \
       $sender_host_address \
       $sender_address \
       $local_part@$domain}\
       {5s}{}{false}}

The commented line was used in the Debian greylistd docs (possibly standard with greylistd) in /usr/share.doc/greylistd/examples/exim4-acl-example.txt, but this ACL didn't apply to the Vexim configuration. There is additional config available elsewhere which shows how to catch mails without an envelope sender. References required.

Note that greylisting also has some disadvantages: emails are always delayed and some mail servers do not properly retry after the first delivery attempt, so emails from these servers are never delivered. Some servers at yahoo.com and ebay.com are known for this. It is therefore important to have a good white list.

This article has a large white list, a method to figure out mail servers from the domain SPF record and some other configuration tips:

http://www.schirmacher.de/display/INFO/SPAM filtern mit Greylisting

Other references:

http://greylisting.org/
http://theinternetco.net/projects/exim/greylist
http://www.debian-administration.org/articles/167
http://www.tldp.org/HOWTO/Spam-Filtering-for-MX/exim-greylisting.html
http://spod.cx/blog/greylisting_with_exim_spamassassin.shtml
http://users.aber.ac.uk/auj/spam/