# Presentation: 526330

## Email Update

- Unix Users Feb 2006
- Kevin Hill

## Email Update

- Spam Cop (We’ve been busted!)
- Greylisting- Next Generation Spam Fighting

## Spam Cop

- Spam Cop started blacklisting the email gateways on 2/14/06.
- We complained. No response was given on why we were blacklisted but we were removed on 2/16/06
- We were added again on 2/17/06!
- A few sites had us blacklisted for “back-scatter”
- What we are doing is RFC compliant but that doesn’t always help!

## Spam Cop

- Back-scatter
- Backscatter occurs when an email system accepts a message for delivery and then the system determines that the message can not be delivered and sends an undeliverable mail notification.
- What to do?
- Request that fnal.gov be added to the white list at remote site.
- CD changing email system to prevent back-scatter (enabled 2/21)
- CD Implementing greylisting soon!

## Greylisting

## What It Does

- Requires all email from unknown servers to retry sending their message a short time later.
- Virus infected computers spewing spam (and viruses) won’t retry. (yet).
- Many system administrators report up to 90% spam reduction.

## How Messages Go

- Remote IP: smtp42.somelab.org
- Env Sender: _[John.smith@somelab.org](mailto:John.smith@somelab.org)_
- Env Recpient: _[helpdesk@fnal.gov](mailto:helpdesk@fnal.gov)_
**Combination unseen before –**
**Temprarily Reject Message**

- Remote Server retries delivery at a later time, at least 5 minutes later.

- Remote IP: smtp42.somelab.org
- Env Sender: _[John.smith@somelab.org](mailto:John.smith@somelab.org)_
- Env Recpient: helpdesk@fnal.gov
**Combination in Database –**
**Message Accepted**

## Who uses it

- University of Bergen - the Norwegian university of Bergen is using greylisting on their mail server.
- Texas A&M University - This Texas university is using greylisting: www.tamu.edu/network-services/smtp-relay/greylisting.html
- Leibniz Rechen Zentrum - LRZ is a major German internet hub for academic institutions in southern Germany. They started using greylisting as a method of limiting spam a couple of months ago: www.lrz-muenchen.de/aktuell/ali2052/
- APNIC (Asia Pacific Network Information Centre) - This organisation, one of the five major internet registries of the world, is also using greylisting: www.apnic.net/info/contact/greylisting.html
- RWTH - RWTH is a large German University. They have a page on their greylisting (german) here: www.rz.rwth-aachen.de/infodienste/email/greylisting.php

## How It Works

- Records a triplet consisting of *remote server ip address*, *envelope sender*, and *envelope recipient*.
- If that triplet hasn’t been seen before, enter it in the database and reject the message with a temporary failure code.
- If the triplet has been seen more than 5 minutes before, and less than the expire time for entries, accept the message.

## Possible Fallout

- Some people will see a delay getting email from someone new. This will be between 5 minutes and however long the remote server takes to retry delivery. Generally not more than 1 hour.
- A few sites won’t retry. They are broken, but need to be dealt with.

## Solutions

- Most greylist packages provide downloadable whitelists of known broken/good email servers.
- Local whitelists are maintainable.
- Greylisting package we are looking at has Automatic Whitelists.
- We can maintain an ‘opt-out’ list, for people who prefer to get more spam.

## Our recommended Implementation

- Use SQLGREY for Postfix.
- Uses Mysql for storage of greylist triplets, auto whitelist tables, and opt-out lists.
- Initial greylist retry wait time is 5 minutes.
- Message must be resent within 24 hours or new 5 minute wait will be instituted.
- After 2 successful emails from a Server/Sender Domain pair, that pair is added to the Auto-Whitelist.
- Auto-whitelist entries expire after 60 days without mail from that server/sender domain.

## Rollout Timeline

- Upgrade Hepa machines version of Postfix and install local mysql server. *1 day (Done)*
- Install sqlgrey Greylisting service. Configure postfix to warn only (in the mail logs) to prebuild databases. *15-30 days*
- Monitor Logs for legit mail that isn’t getting through. Ongoing
- Turn greylisting on “for real”.
- Hepa machines currently have enough capacity to upgrade/install one while the other handles all incoming mail, so no downtime required.