Spam Tarpitting

[cearnshaw]

Do grey listing failures count towards the spam tarpitting trigger count? It's pretty easy to spot spammers in the logs just by looking for IP addresses that are sending to multiple recipients on our domain, most of which result in grey list failures. The problem is that they will keep retrying and eventually get past our greylisting time limit. Thus, I would like to be able to automatically block any IP having more than a certain number of greylist failures within a specified time. Would the spam tarpitting feature accomplish this? Thanks!

Cam

[rob]

The tarpitting limit is not triggered by grey listing unfortunately, but of course the solution could be to tweak the grey listing timings. If you haven't tried it, I would recommend trying the bayesian, because when setup correctly, offers the ultimate SPAM protection.

[cearnshaw]

Thanks for the response Rob. Yes, we do grey listing, Bayesian and SPF checks, all of which have helped tremendously. But just about any IP address outside of our own subnet sending to more than four or five addresses simultaneously is a spammer, so blocking them just seemed a simple way to catch 90% of the spam. When I see multiple recipient entries in the logs I often block the sender's IP manually in our firewall, but what I catch is just a drop in the bucket, and it's often just closing the gate after the horse has left.

Cam