# milter-greylist config hints



## qsecofr (Jun 14, 2010)

Hi,
Just installed milter-greylist from ports and hooked it up to sendmail.  It's running with a basic config file options, but have a couple questions.

Ive got loopback and 192.168 private subnet in list "my network".  Should I add my static, routable IP, or is that too easy to spoof?

The "broken mta" list is static in the config file.  Is there a more dynamic list that I should somehow follow?

The config file has a bunch of DNSRBL hosts.  Are they all current & free for individuals to use?  I've got one DNSBL hardcoded in my sendmail mc file.  It's probably better to get it out of there and use what I hope is a more robust list in the greylist.conf file.

The reject 451 message logged in /var/log/maillog reads "Greylisting in action, please come back later."  If greylist.conf recommends not to tell other MTAs how long the greylist period is, should I tell them that greylisting is being used at all?  Or am I mistaken about the other MTAs seeing 451 text?

I saw previous recommendations for short greylist delay.  But am still a bit unclear on exactly what the autowhite is.  And so I don't have a good idea of how long i want to set the autowhite delay.  Would appreciate if someone could help clarify.  The man page didn't drill it home for me.

Any other helpful hints much appreciated.  thanks.


----------



## hydra (Jun 15, 2010)

About the 4xx message, it doesn't matter what you send back - a host that is RFC aware will try later (depending on the configuration, it may take 10 minutes, 3 hours...). It is just a paranoid option to set it to something different, but that can mean that the interested admins (that are responsible for sending legal e-mail) cannot debug when they cannot send mail to yourself (in case you would change the message for example to '451 FATAL: Filesystem error').

Yes, it is possible that spammers read your message and resend you the spammy mail, but greylisting already did its job, it at least slowed them down. Besides, greylisting is not the ultimate anti-spam weapon. From my experience, leave the message as it is, or set it to something different that will be easily understood by the admins (451 grey list - visit us later).


----------

