Brad Knowles wrote:
At 9:21 PM -0400 2003/09/07, Chris Lewis wrote:For example, I can tell you that 2.5% of the email that got through would have been caught except for latency delays in our BLs... ;-)
Do you know what the latency delays are? For example, if you implemented greylisting and enforced a minimum 30 minute delay before you allowed them to get through the greylist, for what percentage of these messages would that 30 minute delay have been enough for them to show up on the BLs?We're considering greylisting as an adjunct to our filters. However, since we have 8 inbound gateways, it could get rather messy. A simple-minded implementation with a half hour delay would have a four hour worst-case delay... Not acceptable.
Have you incorporated tools like DCC or Razor into your methodology? Do you know how greylisting with a minimum delay time (e.g., 30 minutes) would effect DCC and/or Razor, in terms of their efficiency?[1] Do also consider that our 2.58% number is based over a 14 _day_ interval. There's no way of telling the distribution of that DNSBL "catchup" over the 14 days. I don't think the DNSBL latencies on individual IPs is anywhere near close to the latency of update. Ie: there's no particular reason why a given IP hits the third party DNSBL detector at the same time it first hits you. It takes time (as much as hours) for decent/"polite" open relay/proxy testing.