Dave Crocker wrote:
Graylisting is generally acknowledged to have current tactical utility
but something that spammers will adapt to whenever they feel the need.
Actually, I think greylisting will have longer-term uses than that.
Forcing spammers to be pinned to the same IP address for a while gives
techniques like DNS-based blocklists time to catch up. So while it's
trivial to adapt to greylisting, it makes your zombie machine more
likely to be recognized as such during the retransmission. I think
the OP had a good point about being able to make better decisions in
non-realtime, but I think his mechanism for deferring the decision is
seriously flawed.
Regards,
David.