Greylisting on SDF...

Definitions

tuple: a single record combination of sender_IP(SMTP client), envelope_from(MAIL FROM:), and envelope_to(RCPT TO:).

Described

In short, it works like this. All incoming mail delivery attempts are told to "try again later; can't take delivery now". That in itself is not new; and all email transport systems know to expect those responses any time from any place, for any number of different reasons.

Spam mail generally doesn't bother with a second delivery attempt. That's the positive benefit of Greylisting.

Legitimate mail will try again, after a delay determined by them, they will (or should) attempt delivery again. When they do, if it is after the period set by SDF (3 minutes at this writing), SDF will accept the message and whitelist the tuple so that next time they won't be delayed.

Note also that the tuple whitelisting may expire if not used again in some period of time.

MTA IPs may also be whitelisted at the system level

SDF specific implementation

Type/run unquoted "greylist --help"
results shown are not instantaneous, but updated every 2+ minutes or so.
greylist -gv will show the earliest time when the message will be accepted; and the three fields of the tuple.
greylist -wv will show the time when whitelisted entries will expire.

When the very first delivery is attempted, SDF issues a response ...
(host smtp.freeshell.org[192.94.73.18] said: 451 4.7.1 Connection deferred. (in reply to RCPT TO command))

Initial period during which a second delivery attempt will also be rejected: 3 minutes.

When the message is received by SDF, a header line (X-Greylist:) will be added which notes the delay time since first delivery attempt.

Additional Information:

http://www.greylisting.org/
SDF FAQ EMAIL 07

$Id: greylisting.html,v 1.7 2010/01/01 21:58:11 smj Exp $