odd (to me) autowhitelist behavior

this morning i joined an on-line forum, and was surprised
when very
quickly thereafter i received confirmation mail.  usually
this is
the kind of situation where i'm used to waiting an hour for
the first
mail from a new site.

the logs show that the client was auto-whitelisted on its
second
try.  now, this is a sender from whom i've never received
mail
before.

postgrey is run like this:
    /usr/sbin/postgrey -d
--unix=/var/spool/postfix/postgrey/socket 
	--max-age=120 --auto-whitelist-clients=1 --delay=2100 
	--greylist-text Try again later (%s seconds)

the two relevant log snippets look like this.  first the
client
is told to go away, and then it's accepted just 5 minutes
later.  (i've
added an extra 'xx' in front of all domain names.)

    Dec 14 10:36:53 colo3 postgrey[2618]: action=greylist,
reason=new, client_name=mout.perfora.net,
client_address=74.208.4.196, sender=wayanxxolpcnews.com, recipient=pgf-olpcxxfoxharp.boston.ma.us 
    Dec 14 10:36:53 colo3 postfix/smtpd[22603]: NOQUEUE:
reject: RCPT from mout.perfora.net[74.208.4.196]: 450
<pgf-olpcxxfoxharp.boston.ma.us>: Recipient address
rejected: Try again later (2100 seconds); from=<wayanxxolpcnews.com> to=<pgf-olpcxxfoxharp.boston.ma.us> proto=ESMTP
helo=<mout.perfora.net>
    ...
    Dec 14 10:41:54 colo3 postgrey[2618]: action=pass,
reason=client AWL, client_name=mout.perfora.net,
client_address=74.208.4.194, sender=wayanxxolpcnews.com, recipient=pgf-olpcxxfoxharp.boston.ma.us 
    Dec 14 10:41:54 colo3 postfix/smtpd[22589]: 2E70FEF2F4:
client=mout.perfora.net[74.208.4.194]
    Dec 14 10:41:54 colo3 postfix/cleanup[22607]:
2E70FEF2F4: message-id=<3oUem0-1J3 Cap1pkB-0004A8infong503.perfora.net>
    Dec 14 10:41:54 colo3 postfix/qmgr[8326]: 2E70FEF2F4:
from=<wayanxxolpcnews.com>, size=1990, nrcpt=1
(queue active)
    Dec 14 10:41:54 colo3 postfix/smtpd[22589]: disconnect
from mout.perfora.net[74.208.4.194]
    Dec 14 10:41:54 colo3 postfix/smtp[22608]: 2E70FEF2F4:
to=<pgf-olpcxxfoxharp.boston.ma.us>,
relay=mail.xxfoxharp.boston.ma.us[24.61.85.42], delay=0,
status=sent (250 ok 1197646914 qp 25084)



what is it i don't understand about how postgrey works, that
this
message should have gotten through so quickly?  what sort of
dump
command can i run to understand why the autowhitelisting
would happen
so fast?

many thanks,
paul
=---------------------
 paul fox, pgffoxharp.boston.ma.us (arlington, ma, where
it's 29.1 degrees)

-- 
Unsubscribe mailto:postgrey-requestlist.ee.ethz.ch?subject=unsubscribe
Archive     http://lists.ee.ethz
.ch/postgrey
WebAdmin    http://lists.ee.ethz
.ch/lsg2.cgi

Zitat von Paul Fox <pgffoxharp.boston.ma.us>:

> this morning i joined an on-line forum, and was
surprised when very
> quickly thereafter i received confirmation mail. 
usually this is
> the kind of situation where i'm used to waiting an hour
for the first
> mail from a new site.
>
> the logs show that the client was auto-whitelisted on
its second
> try.  now, this is a sender from whom i've never
received mail
> before.
>
> postgrey is run like this:
>     /usr/sbin/postgrey -d
--unix=/var/spool/postfix/postgrey/socket 
> 	--max-age=120 --auto-whitelist-clients=1 --delay=2100

> 	--greylist-text Try again later (%s seconds)
>
> the two relevant log snippets look like this.  first
the client
> is told to go away, and then it's accepted just 5
minutes later.  (i've
> added an extra 'xx' in front of all domain names.)
>
>     Dec 14 10:36:53 colo3 postgrey[2618]:
action=greylist,   
> reason=new, client_name=mout.perfora.net,   
> client_address=74.208.4.196, sender=wayanxxolpcnews.com,   
> recipient=pgf-olpcxxfoxharp.boston.ma.us
>     Dec 14 10:36:53 colo3 postfix/smtpd[22603]:
NOQUEUE: reject:   
> RCPT from mout.perfora.net[74.208.4.196]: 450   
> <pgf-olpcxxfoxharp.boston.ma.us>: Recipient
address rejected: Try   
> again later (2100 seconds); from=<wayanxxolpcnews.com>   
> to=<pgf-olpcxxfoxharp.boston.ma.us> proto=ESMTP   
> helo=<mout.perfora.net>
>     ...
>     Dec 14 10:41:54 colo3 postgrey[2618]: action=pass,
reason=client  
>  AWL, client_name=mout.perfora.net,
client_address=74.208.4.194,   
> sender=wayanxxolpcnews.com, recipient=pgf-olpcxxfoxharp.boston.ma.us
>     Dec 14 10:41:54 colo3 postfix/smtpd[22589]:
2E70FEF2F4:   
> client=mout.perfora.net[74.208.4.194]
>     Dec 14 10:41:54 colo3 postfix/cleanup[22607]:
2E70FEF2F4:   
> message-id=<3oUem0-1J3 Cap1pkB-0004A8infong503.perfora.net>
>     Dec 14 10:41:54 colo3 postfix/qmgr[8326]:
2E70FEF2F4:   
> from=<wayanxxolpcnews.com>, size=1990, nrcpt=1
(queue active)
>     Dec 14 10:41:54 colo3 postfix/smtpd[22589]:
disconnect from   
> mout.perfora.net[74.208.4.194]
>     Dec 14 10:41:54 colo3 postfix/smtp[22608]:
2E70FEF2F4:   
> to=<pgf-olpcxxfoxharp.boston.ma.us>,   
> relay=mail.xxfoxharp.boston.ma.us[24.61.85.42],
delay=0, status=sent  
>  (250 ok 1197646914 qp 25084)
>
> what is it i don't understand about how postgrey works,
that this
> message should have gotten through so quickly?  what
sort of dump
> command can i run to understand why the
autowhitelisting would happen
> so fast?

Be aware that the second try come from an other IP address
despite the  
same name! Have a look in your logs for
"74.208.4.194" and you should  
see why it is/get whitelisted.

Regards

Andreas


-- 
Unsubscribe mailto:postgrey-requestlist.ee.ethz.ch?subject=unsubscribe
Archive     http://lists.ee.ethz
.ch/postgrey
WebAdmin    http://lists.ee.ethz
.ch/lsg2.cgi

listaccount wrote:
 > 
 > Be aware that the second try come from an other IP
address despite the  
 > same name! Have a look in your logs for
"74.208.4.194" and you should  
 > see why it is/get whitelisted.

ah ha!  thanks very much.  yes, that explains it.

paul
=---------------------
 paul fox, pgffoxharp.boston.ma.us (arlington, ma, where
it's 31.3 degrees)

-- 
Unsubscribe mailto:postgrey-requestlist.ee.ethz.ch?subject=unsubscribe
Archive     http://lists.ee.ethz
.ch/postgrey
WebAdmin    http://lists.ee.ethz
.ch/lsg2.cgi

Zitat von Paul Fox <pgffoxharp.boston.ma.us>:

> listaccount wrote:
>  >
>  > Be aware that the second try come from an other
IP address despite the
>  > same name! Have a look in your logs for
"74.208.4.194" and you should
>  > see why it is/get whitelisted.
>
> ah ha!  thanks very much.  yes, that explains it.


The error was an "me too!" event 


> paul
> =---------------------
>  paul fox, pgffoxharp.boston.ma.us (arlington, ma, where
it's 31.3 degrees)

Andreas from Freiburg, Germany where its around 0 degrees



-- 
Unsubscribe mailto:postgrey-requestlist.ee.ethz.ch?subject=unsubscribe
Archive     http://lists.ee.ethz
.ch/postgrey
WebAdmin    http://lists.ee.ethz
.ch/lsg2.cgi