Re: We need an IETF BCP for GREY LISTING

John Levine wrote:
> > I think the only real value in this extension would be to reward clients
> > that recognize it, by providing their users with more predictable
> > service (=less delay, more uniform delay).
> When I wrote my CEAS paper on greylisting, I found that very little
> legit mail is affected by it.  A reasonable greylister only delays the
> first message seen from an IP, and after that whitelists it.  (I
> realize there are greylisters that delay every new [IP,from] or
> [IP,from,to] but the solution is not to do that.)  Very little legit
> mail comes from an IP you've never seen before.
>
> Every discussion list I know comes from a single IP or a very small
> set of IPs, so the first message or more likely the subscription
> confirmation might be delayed, but nothing after that.
>
> I really don't see anything to fix.
The issue is that its no longer just the "first" but now extended 
further into more attempts where a particular SMTP recommended initial 
short frequency with a backoff is becoming less effective.
This is not just mailing list operations and discussion list, but GL 
servers are now being adopted at the business and corporate level.
The worst case I have seen so far is how a large group of different 
email domains are all served by the same GL hosting MX servers.  So if 
you had, for example, 100 different email destination domains, but 
they are all served by the same hosting service (maybe as part of a 
filtering service),  you now have a very complex queuing issue when 
the rejection is beyond the 1st attempt.
When you add that many DNS records have very short TTLs, i.e. 5 
minutes, if you 2nd attempt more than 5 minutes, then any DNS caching 
benefits you might have are lost.  There are many parts to all this.
Mind you, it you let it all fly and don't pay attention to it, 
eventually the mail will all get sent and unless anyone reported an 
issue, you may not even know it took 1 to 24+ hours with many wasted 
attempts in-between because of an unknown blocking time remote site 
requirement.
The overall issue is the growing wasted attempts (higher overhead) and 
far longer delivery times which in my view, defeats the main purpose 
behind Greylisting.
--
HLS