Hi Mike, I can help with this.
Greylisting it tremendously effective however it can cause a lot of problems if it is not done selectively. We worked closely with Matt Bramble and a few other Declude "power users" to develop ways to apply greylisting only when it is most likely to be beneficial. Blanket greylisting is dangerous in that not everything plays well with greylisting. Also, you'll always have those users who are expecting an immediate email from someone, and greylisting is going to delay it if they have not successfully passed greylisting before. Rather than greylisting everyone (which you can do If you want), what we did is to allow you to specify a number of criteria that will trigger greylisting. In these cases, greylisting is not triggered until something suspicious is encountered. Because Interceptor/Alligate is designed from the ground up to examine every aspect of the SMTP conversation, there are several points in the transaction where greylisting can be invoked. These include the senders reputation based on our MXRate rating, the originating country, volume, recent history, suspicious HELOs, blacklist hits, and several other items. This provides a much more effective way to employ greylisting without inconveniencing most users or senders. In fact, most end users never realize greylisting is being used. The idea here is to determine if something is probably spam, and if we have reason to believe that it may be, then impose a greylist check. You do not have to educate your users this way, and you will have far less complaints. Hope this helps. Brian From: [email protected] [mailto:[email protected]] On Behalf Of Michael Graveen Sent: Monday, May 18, 2009 3:57 PM To: [email protected] Subject: RE: [Declude.JunkMail] BackScatter Hi David, Can you elaborate on why SmarterMail's greylisting is dangerous? In SmarterMail all mail gets greylisted until it "passes". When it passes subsequent email get's whitelisted (for a period of time). There is a greylist exclusion list for mail server that are known not play well. How does this differ from the Alligate/Declude combination? Thanks, Mike _____ Hi Todd, Alligate has way better greylisting capabilities than SmarterMail. SmarterMails implementation is somewhat dangerous. You need to be able to accurately qualify which messages should be greylisted. Alligate is the only greylisting implementation that does this. I don't believe you would have this problem if you were running Interceptor or the Alligate/Declude combination, and I am sure other Alligate/Declude users would agree with me. If you are interested, I can work with you to give you an upgrade path to Declude Interceptor from your current license. David Barker VP Operations Declude Your Email security is our business 978.499.2933 office 978.988.1311 fax <mailto:[email protected]> [email protected] From: [email protected] [mailto:[email protected]] On Behalf Of Todd Richards Sent: Saturday, May 16, 2009 6:11 PM To: [email protected] Subject: RE: [Declude.JunkMail] BackScatter Thanks Craig. From all indications our server is tightened down pretty good right now. We moved from Imail to SM at the start of April, and I implemented grey listing at the start of May. So we did have a fair amount of backscatter in between until I really understood what greylisting could do. Unfortunately, I can't talk the bosses into dropping another $800 or so to try and fix the problem. I know others have used ASSP with success, so I might look at that. SmarterMail's greylisting seems to be a lot better than what the rules in Declude offer. I might look at implementing ASSP in front of SM. I've heard a lot of people talk about the advantages of running something in front of your mail server. So it might be time. Todd From: [email protected] [mailto:[email protected]] On Behalf Of Craig Edmonds Sent: Saturday, May 16, 2009 1:53 PM To: [email protected] Subject: RE: [Declude.JunkMail] BackScatter Hi Todd, I think grey listing prevents backscatter coming INTO your mail server, it does not prevent you getting on blacklists. If you are on a blacklist then I think you need to figure out how your smtp server is configured because it would indicate an issue somewhere. Since using Alligate (www.alligate.com <http://www.alligate.com/> ) as the first line of defence in front of declude, we have had zero black listings and all the backscatter has disappeared. The backscatter rules in declude really blow which is why I would highly recommend looking at Alligate as your smtp gateway. Kindest Regards Craig Edmonds 123 Marbella Internet W: www.123marbella.com <http://www.123marbella.com/> E : [email protected] From: [email protected] [mailto:[email protected]] On Behalf Of Michael Graveen Sent: 16 May 2009 13:54 To: [email protected] Subject: re: [Declude.JunkMail] BackScatter I think Greylisting reduces backscatter. Greylisting stops the majority of the SPAM from ever reaching our mail server, so it never has a chance to get bounced back because of a non existent user, etc. Mike _____ Hi Everyone - We've been having a few issues with mail servers refusing our mail. Today I ran a test on DNSStuff and found that our IP is on BackScatter.org. They are referencing an event on 4/27, and supposedly we will be removed after 4 weeks if they haven't had any other issues. Of course we can pay to have it removed sooner. I'm not sure if being listed in their DB is the main culprit to the server refusals that I've seen? We switched over to SmarterMail in mid-April. Since 4/27, we have implemented grey listing. Is grey listing a good first line of defense? Is there anything else I should be doing to prevent back scatter? Thanks for your thoughts on this. Todd --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [email protected], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [email protected], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [email protected], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [email protected], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [email protected], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [email protected], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [email protected], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
