Configuring greylisting
Go to Security > Greylist to configure greylisting and to view greylist-exempt senders.
This section contains the following topics:
- About greylisting
- Viewing the pending and individual automatic greylist entries
- Manually exempting senders from greylisting
- Viewing the consolidated automatic greylist exemptions
- Configuring the greylist TTL and initial delay
About greylisting
Greylist scanning blocks spam based on the behavior of the sending server, rather than the content of the messages. When receiving an email from an unknown server, the FortiMail unit will temporarily reject the message. If the mail is legitimate, the originating server will try to send it again later (RFC 2821), at which time the FortiMail unit will accept it. Spammers will typically abandon further delivery attempts in order to maximize spam throughput.
Advantages of greylisting include:
- Greylisting is low-maintenance, and does not require you to manually maintain IP address lists, block lists or safe lists, or word lists. The FortiMail unit automatically obtains and maintains the required information.
- Spam blocked by greylisting never undergoes other antispam scans. This can save significant amounts of processing and storage resources. For this reason, enabling greylisting can improve FortiMail performance.
- Even if a spammer adapts to greylisting by retrying to send spam, the greylist delay period can allow time for FortiGuard Antispam and DNSBL servers to discover and blocklist the spam source. By the time that the spammer finally succeeds in sending the email, other antispam scans are more likely to recognize it as spam.
Workflow of greylist scanning
|
Greylisting is omitted if the matching access control rule’s Action is RELAY. For more information on antispam features’ order of execution, see Order of execution. |
When an SMTP client first attempts to deliver an email message through the FortiMail unit, the greylist scanner examines the email message’s combination of:
- sender email address in the message envelope (
MAIL FROM:) - recipient email address in the message envelope (
RCPT TO:) - IP address of the SMTP client
The greylist scanner then compares the combination of those attributes to manual and automatic greylist entries. The greylist scanner evaluates the email for matches in the following order:
- manual greylist entries, also known as exemptions (see Manual greylist entries)
- consolidated automatic greylist entries, also known as autoexempt entries (see Automatic greylist entries)
- individual automatic greylist entries, also known as greylist entries
|
|
For more information on the types of greylist entries, see Automatic greylist entries and Automatic greylist entries. |
According to the match results, the greylist scanner performs one of the following:
- If a matching entry exists, the FortiMail unit continues with other configured antispam scans, and will accept the email if no other antispam scan determines that the email is spam. For automatic greylist entry matches, each accepted subsequent email also extends the expiry date of the automatic greylist entry according to the configured time to live (TTL) (automatic greylist entries are discarded if no additional matching email messages are received by the expiry date).
- If no matching entry exists, the FortiMail unit creates a pending individual automatic greylist entry (see Viewing the pending and individual automatic greylist entries) to note that combination of sender, recipient, and client addresses, then replies to the SMTP client with a temporary failure code. During the greylist delay period after the initial delivery attempt, the FortiMail unit continues to reply to delivery attempts with a temporarily failure code. To confirm the pending automatic greylist entry and successfully send the email message, the SMTP client must retry delivery during the greylist window: after the delay period, but before the expiry of the pending entry.
Subsequent email messages matching a greylist entry are accepted by the greylist scanner without being subject to the greylisting delay.
For information on how the greylist scanner matches email messages, see Matching automatic greylist entries. For information on configuring the greylisting delay, window, and entry expiry/TTL, see Configuring the greylist TTL and initial delay.
Matching automatic greylist entries
While the email addresses in the message envelope must match exactly, the IP address of the SMTP client is a less specific match: any IP address on the /24 network will match.
For example, if an email server at 192.168.1.99 is known to the greylist scanner, its greylist entry contains the IP address 192.168.1.0 where 0 indicates that any value will match the last octet, and that any IP address starting with 192.168.1 will match that entry.
This greylist IP address matching mechanism restricts the number of IP addresses which can match the greylist entry while also minimizing potential issues with email server farms. Some large organizations use many email servers with IP addresses in the same class C subnet. If the first attempt to deliver email receives a temporary failure response, the second attempt may come from an email server with a different IP address. If an exact match were required, the greylist scanner would treat the second delivery attempt as a new delivery attempt unrelated to the first. Depending on the configuration of the email servers, the email message might never be delivered properly. Approximate IP address matching often prevents this problem.
For very large email server farms that require greater than a /24 subnet, you can manually create greylist exemptions. For more information, see Manual greylist entries.
Automatic greylist entries
The automatic greylisting process automatically creates, confirms pending entries, and expires automatic greylist entries, reducing the need for manual greylist entries. The automatic greylisting process can create three types of automatic greylist entries:
- pending (see Viewing the pending and individual automatic greylist entries)
- individual (see Viewing the pending and individual automatic greylist entries)
- consolidated (see Viewing the consolidated automatic greylist exemptions)
Pending entries are created on the initial delivery attempt, and track the email messages whose delivery attempts are currently experiencing the greylist delay period. They are converted to confirmed individual entries if a delivery attempt occurs after the greylist delay period, during the greylist window.
The automatic greylisting process can reduce the number of individual automatic greylist entries by consolidating similar entries after they have been confirmed during the greylisting window. Consolidation improves performance and greatly reduces the possibility of overflowing the maximum number of greylist entries.
Consolidated automatic greylist entries include only:
- the domain name portion of the sender email address
- the IP address of the SMTP client
They do not include the recipient email address, or the user name portion of the sender email address. By containing only the domain name portion and not the entire sender email address, a consolidated entry can match all senders from a single domain, rather than each sender having and matching their own individual automatic greylist entry. Similarly, by not containing the recipient email address, any recipient can share the same greylist entry. Because consolidated entries have broader match sets, they less likely to reach the time to live (TTL) than an individual automatic greylist entry.
For example, example.com and example.org each have 100 employees. The two organizations work together and employees of each company exchange email with many of their counterparts in the other company. If each example.com employee corresponds with 20 people from example.org, the FortiMail unit used by example.com will have 2000 greylist entries for the email received from example.org alone. By consolidating, these 2000 greylist entries are replaced by a single entry.
Not all individual automatic greylist entries can be consolidated. Because consolidated entries have fewer message attributes, more email messages may match each entry, some of which could contain different recipient email addresses and sender user names than those of the originally greylisted email messages. To prevent spam from taking advantage of the broader match sets, requirements for creation of consolidated entries are more strict than those of individual automatic greylist entries. FortiMail units will create a consolidated (autoexempt) entry only if the email:
- does not match any manual greylist entry (exemption)
- passes the automatic greylisting process
- passes all configured antispam scans
- passes all configured antivirus scans
- passes all configured content scans
- does not match any safe lists
If an email message fails to meet the above requirements, the FortiMail unit instead maintains the individual automatic greylist entry.
|
|
If an email message matches a manual greylist entry, it is not subject to automatic greylisting and the FortiMail unit will not create an entry in the individual or consolidated automatic greylist or autoexempt list. |
After an individual automatic greylist entry is consolidated, both the consolidated autoexempt entry and the original greylist entry will coexist for the length of the greylist TTL. Because email messages are compared to the autoexempt list before the greylist, subsequent matching email will reset only the expiry date of the autoexempt list entry, but not the expiry date of the original greylist entry. Eventually, the original greylist entry expires, leaving the automatic greylist entry.
Manual greylist entries
In some cases, you may want to manually configure some greylist entries. Manual greylist entries are exempt from the automatic greylisting process, and are therefore not subject to the greylist delay period and confirmation.
For example, a manual greylist entry can be useful when email messages are sent from an email server farm whose network is larger than /24. For very large email server farms, if a different email server attempts the delivery retry each time, the greylist scanner could perceive each retry as a first attempt, and automatic greylist entries could expire before the same email server retries delivery of the same email. To prevent this problem, you can manually create an exemption using common elements of the host names of the email servers.
For more information on creating manual greylist entries, see Manually exempting senders from greylisting.
Configuring the greylist TTL and initial delay
The Setting tab lets you configure time intervals used during the automatic greylisting process.
For more information on the automatic greylisting process, see About greylisting.
To configure greylisting intervals
- Go to Security > Greylist > Setting.
- Configure the following:
|
GUI item |
Description |
|
TTL |
Enter the time to live (TTL) that determines the maximum amount of time that unused automatic greylist entries will be retained. Expiration dates of automatic greylist entries are determined by the following two factors:
For more information on automatic greylist entries, see Viewing the greylist statuses. |
|
Greylisting period |
Enter the length of the greylist delay period. For the initial delivery attempt, if no manual greylist entry (exemption) matches the email message, the FortiMail unit creates a pending automatic greylist entry, and replies with a temporary failure code. During the greylist delay period after this initial delivery attempt, the FortiMail unit continues to reply to additional delivery attempts with a temporary failure code. After the greylist delay period elapses and before the pending entry expires (during the greylist window), any additional delivery attempts will confirm the entry and convert it to an individual automatic greylist entry. The greylist scanner will then allow delivery of subsequent matching email messages. For more information on pending and individual automatic greylist entries, see Viewing the pending and individual automatic greylist entries. |
Manually exempting senders from greylisting
The Exempt tab displays manual greylist entries, which exempt email messages from the automatic greylisting process and its associated greylist delay period.
|
|
Greylisting is omitted if the matching access control rule’s Action is RELAY. For more information on antispam features’ order of execution, see Order of execution. |
For more information on the automatic greylisting process, see About greylisting. For more information on manual greylist entries, see Manual greylist entries.
To view and configure manual greylist entries
- Go to Security > Greylist > Exempt.
- Click New to add an entry or double-click an entry to modify it.
- Configure the following:
A dialog appears.
No pattern can be left blank in a greylist exempt rule. To have the FortiMail unit ignore a pattern, enter an asterisk (*) in the pattern field. For example, if you enter an asterisk in the Recipient Pattern field and do not enable Regular Expression, the asterisk matches all recipient addresses. This eliminates the recipient pattern as an item used to determine if the rule matches an email message.
See also
Configuring the block lists and safe lists
Managing the global block and safe list
Example: Manual greylist entries (exemptions)
Example Corporation uses a FortiMail unit that is operating in gateway mode, and uses greylisting to reduce the quantity of spam they receive at their protected domain, example.com.
Example Corporation wants to exempt some email from the initial greylist delay period by creating manual greylist entries (exemptions to the automatic greylisting process) that match trusted combinations of SMTP client IP addresses and recipient email addresses.
Rule 1
Example Corporation has a number of foreign offices. Email from these offices does not need to be greylisted.The IP addresses of email servers in the foreign offices vary, though their host names all begin with “mail” and end with “example.com”.
Rule 1 uses the recipient pattern and the reverse DNS pattern to exempt from the automatic greylisting process all email messages that are sent to recipients at example.com, and are being delivered by an email server with a host name beginning with “mail” and ending with “example.com”.
Rule 2
Example Corporation works closely with a partner organization, Example Org, whose email domain is example.org. Email from the example.org email servers does not need to be greylisted. The IP addresses of email servers for example.org are within the 172.20.120.0/24 subnet, and have a host name of mail.example.org.
Rule 2 uses the recipient pattern, sender IP/ netmask, and reverse DNS pattern to exempt from the automatic greylisting process all email messages that are sent to recipients at example.com by any email server whose IP address is between 172.20.120.1 and 172.20.120.255 and whose host name is mail.example.org.