the_title();

Greylisting

Over the next few weeks we are upgrading all hosting accounts with a a new anti spam feature. The upgrades will start with spam server accounts, plus accounts, business users before completing on personal hosting accounts.

In our tests the new anti spam system has reduced incoming receipt of spam email by 90%. The system works by challenging incoming email with a series of basic tests. Those that fail these tests are rejected before they reach your account.

The new feature is known as ‘greylisting’. For more information on the technicalities of this system please click here .

When your server is due for upgrading you will be contacted at your registered email address a week in advance. We appreciate that some users may not want their mail filtered and at this point can disable the feature on an account basis by request. We do however strongly recommend the use of this system.

14 Comments

  1. What about reseller accounts? They’re not mentioned.

  2. Greylisting is also coming to the reseller servers. I believe the details are still being worked out internally. I would not expect any great delay on this though, from our test results we are very keen to get this out network wide ASAP.

  3. You say that you can “disable the feature on request”. By “request” do you mean it will be necessary for me to raise a support ticket? If so can I ask that instead you please give an option in control panel to enable/disable this feature? I currently get no spam at all so I don’t want the greylisting feature enabled. However, I would both like the status of the feature to be shown in control panel and to enable me to switch it on or off without needing manual intervention from your support staff.

  4. Greylisting should eventually be controllable via online automated methods. Exactly when I cannot say for certain. With the level of spam we are seeing across our network the priority is to get the vast majorty of accounts updated ASAP.

    You should receive an email a week in advance of your servers update, you just need to reply to that and ask for the feature to be disabled on your account.

    I personally would advise againts this, we have seen some excellent results in testing.

  5. Is this a new system that all accounts will benefit from, or is this an upgrade to the existing anti-spam filtering? If so, I take it anti-spam will remain a chargeable extra?

  6. Fantastic news. Cheers guys!

  7. As I am getting no spam at all at present for me greylisting is not only inappropriate, but it may actually make matters worse. Legitimate mail may be caught by false positives. I appreciate not everyone else is in the same situation as myself, but there are cases like mine where greylisting is not welcome.

  8. The only test we are running is to check if incoming mail is being sent by a legitimate mail server. The content of the mail itself is not being checked. I believe in testing we experience zero false positives.

  9. Will the existing white list set up in the spam guardian still be used by the new system?

  10. Will the whitelist of good ip’s be seperate for every different user or will they be pooled into one big whitelist? I don’t see how you can say there will be zero false positives by the way as I’m sure there are some geniune email servers that arn’t perfectly configured.

  11. Excellent, guys !

    I have had to interface with SMTP servers which use greylisting for about the last 2 years. In my experience greylisting is very effective against “fire-and-forget” spam systems, while having no adverse effect against mail sent from properly-configured MTA’s. Whilst David Barker’s comment that “some genuine servers are not perfectly configured” is true, I believe that in this hostile world there is no excuse for improperly-configured servers ! If an ISP or other service provicer cannot configure a server properly, they shouldn’t be in that business.

    One question for 34SP. Will there be a trace in a message’s headers stating that message went through the first-time greylisting challenge process ?

    Thanks, and Happy New Year to the crew ast 34SP.

  12. Greylisting as a ‘technology’ has been around for several years and is used by thousands of hosts across the internet, we didnt implement it until such time that we could give users the choice to activate or de-activate it if they wanted (due to the delay it can add).

    In reference to the ‘geniune email servers that arn’t perfectly configured.’ – then this really should not be the case, all greylisting does is send a ‘temporary failure’ back to the sending mail server, this can (and does) happen regularly on all mail servers – so really there is absolutly no excuse for a mailserver not to resend. The main issue of resending is when a sender uses a varying sending IP block that some issues can arise. There are a number of known servers that do come into this catogery and there is a regularly updated list of these on the internet at http://cvs.puremagic.com/viewcvs/greylisting/schema/whitelist_ip.txt?rev=1.16&view=auto which we do have all whitelisted and will update with others as necessary.

    All emails that ‘get through’ the system are recorded as a full triplet set, thats the ‘mail from’ ‘recipent to’ and ‘ip address’ it is then that exact set that is no longer challenged on a resend, as per above the sending ip block however is given some room – as it is only the eg 192.168.1 part that is checked – so a mailserver could send the mail from 192.168.1.2 and then resend from 192.168.1.3 and it would be allowed through still.

    In reference to ‘headers stating that message went through the first-time greylisting challenge process’ – the answer to this is no, there will be no change in the headers of the email at all

  13. Interesting. I’d certainly be interested in knowing more about this and perhaps trying it out. When will my server be upgraded? One question though:

    1. Will the user be able to add and subtract names on their own white list? Or will this involve an email to 34sp each time as the text above seems to suggest?

    I think it should be configurable by the user on a per email account basis and have a user white list. I can see some email addresses that should be let straight through and some of my email addresses that spam-b%$£ts don’t have yet so could just pass the email unchallenged.

  14. I see information about this for the first time today. How do i stop the function coming in before it is turned on? I get maybe twenty spam last year so do not consider this intervention is appropriate for my accounts since it is hardly an epidemic.

    That is the level I have always enjoyed simply by being intelligent with my mailboxes. People should never use a catch all address, use unusual mailbox names (not admin, owner, etc) and never publish their account addresses on public sites, then they would not find spam such a problem to begin with.