John Leslie wrote:
More useful is something like, "Hotmail MTA #49 is sending more spam than usual right now: more severe graylisting might be called for."
What good does graylisting do to a real MTA? Unless MTA #49 is sending you enough email that forcing it to requeue causes it problems, it won't do anything useful.
We've tended to let our automated defenses "fire where they may". If MTA #49 is sending us so much spam that the defenses fire, they fire, and we don't whitelist.
If the problem gets bad enough, we block /24s worth. With MSN and Yahoo, that turns out to work particularly well, because at least with Nigerian floods and their provisioning methods, specific /24s tend to be substantially worse than others.
Then we make a big public & private noise. And sometimes things get better.