On 10/08/2026 13:19, Boris Mutina via mailop wrote:
Hello,
need advice about greylisting practices. Here's the scenario:
- sender at example1.com sends automatic emails using the MTA
infrastructure of his provider
- recipient at example2.com greylists provider's IP_1
- provider retries from IP_2 which gets greylisted too, again.
Tried to dig into RFC6647. Chapter 4.1 describes 'Unintended Mail
Delivery Failures', in particular "although example.com has sought to
improve its email throughput by having two servers, it has, in fact,
amplified the problem of legitimate mail delay introduced by
greylisting.". Considering MTA cluster of sender's provider with 4k IPv4
and 2^80 IPv6, the issue grows.
On the other hand there are recommendations that recipient at
example2.com adopted, except 5.5 which seems to be too risky. This point
discusses /24 blocks which is enough risky to "ungreylist" - spammers
tend to abuse more than one IP from the /24 blocks.
The provider recommends "adjusting anti-spam/greylisting configuration
to properly handle messages sent from rotating IP addresses". And I have
no clue what does he mean by that.
Any advices, opinions? Many thanks.
IIRC, you were using Rspamd, and Rspamd [1] uses 2 distinct hashes to
resolve exactly the issue you describe:
* meta hash is based on SMTP envelope from, all sorted SMTP recipients,
and masked sender IP
* data hash is based on the message body (up to max_data_len), subject,
all sorted SMTP recipients, and MIME From address
So if meta hash will change in your scenario, data hash will remain the
same, efficiently allowing to bypass greylisting from distinct /24
source IPs.
[1]: https://docs.rspamd.com/modules/greylisting
_______________________________________________
mailop mailing list
[email protected]
https://list.mailop.org/listinfo/mailop
