Having spam filter is one thing, but the question is still, should just mark the incoming e-mail as spam and forward it and then leave it to the user or should be delete all incoming spam? Just deleting spam generates another problem that I often have had when communicating with companies that uses spam filters; the spam filter often triggers on IT security related terms and quite often I had to check with the people if they really got the e-mail or not.
So when talking around within the OS2 World staff and how to handle spam, Tommy Jansson - our sysop, mentioned that we could give it a try to set up a greylisting function that takes the first hit of all incoming e-mail.
So how does greylisting work? What happen is that each time a given mailbox receives an email from an unknown contact (ip), that mail is rejected with a "try again later"-message. This, in the short run, means that all mail gets delayed at least until the sender tries again - but this is where spam loses out! Most spam is not sent out using RFC compliant MTAs; the spamming software will not try again later.
If we take a look at the last 6 days that the server has been up and running it has so far rejected 30.885 e-mails (I actually didn't think that we received that much spam!).
{mosimage}
So if we look at the next picture we can there se that we have in total during the last 6 days received 1661 e-mails where 6 has been cleaned out for virus and 88 was marked as spam. If I compare this to one of the other mail servers that I have and where greylisting isn't in use (yet) the number of e-mails marked as spam is way higher, but still sent on to the users where Thunderbird does an amazing work to clean out spam. Still, I receive data that I don't want and greylisting seems to work fine so far. At least it gives us hopefully a few extra hours to identify spam and get the spam filters updated.
{mosimage}
If you are wondering about the blue peak on sent e-mail from the server - this when I sent out an e-mail to around 1700 e-mail about the server update earlier this week. But I hope that this little greylisting test might give some of you an idea how to fight spam.
Comments to this article can be found here .