What greylisting phase is used?

[Dan Swartzendruber]

I was playing with a test install of postfix+dovecot+rspamd.  From my experiment using telnet to port 25 to simulate an SMTP dialog, it looks like the 451 code is returned after the 'data' command is sent.  I was kinda surprised, since other greylisting packages I've used seem to return the 4XX code during the recipients phase.  I don't guess it really matters, but I was wondering why greylisting would be done this late?  Thanks!

[Andrew Lewis]

I suppose it's as effective as greylisting at any other point in SMTP
transaction albeit more expensive (it at least has the advantage of
being somewhat targeted in its application) - reason why it would be
like this would be because rspamd wants to see an actual entire
message before making a filtering decision.

It is of course up to you if you wish to honor the recommendation to
greylist: you can ignore it and/or remove it from the metric. If you
want greylisting at some other phase of SMTP transaction I'm afraid
you'd probably want to use something other than rmilter for that (or
patch it appropriately).

Best,
-AL.

[Dan Swartzendruber]

Thanks for the reply.  I'm fine with it this way - just curious.

[Vsevolod Stakhov]

Actually, greylisting should be done on End-Of-Message state. On rcpt
stage, there is no information of *ALL* recipients for a message or you
need to check greylisting after *each* recipient which might be bad
especially if remote SMTP server terminates connection after the first
error received (many lame php SMTP servers acts like this).

Greylisting on DATA is good but on End-Of-Data you can greylist by
content which is extremely useful when you have SMTP senders from
different networks (like gmail, for example).

--
Vsevolod Stakhov