Astaro introduced the greylisting feature with v8 and introduced two new rbls grey.rbl.ctipd.astaro.local and black.rbl.ctipd.astaro.local. The emails in grey.rbl.ctipd.astaro.local are greylisted automatically even if greylisting is turned off globally.
Two problems, first emails are greylisted when greylisting is not enabled and second these mails are also counted under top spam senders in the daily executive report.
Screenshot 1: Top spam senders report
Screenshot 2: Notice the second IP in top senders being greylisted.
Here are the logs, for the same sender in screenshot2:
/var/log/smtp/2010/11/smtp-2010-11-06.log.gz:2010:11:06-08:10:22 gatekeeper exim[5959]: 2010-11-06 08:10:22 SMTP connection from [98.139.53.208]:38522 (TCP/IP connection count = 1)
/var/log/smtp/2010/11/smtp-2010-11-06.log.gz:2010:11:06-08:10:22 gatekeeper exim[3855]: 2010-11-06 08:10:22 H=nm17-vm0.bullet.mail.ac4.yahoo.com [98.139.53.208]:38522 Warning: fakeasg81beta.com profile excludes greylisting: Skipping greylisting for this message
/var/log/smtp/2010/11/smtp-2010-11-06.log.gz:2010:11:06-08:10:22 gatekeeper exim[3855]: 2010-11-06 08:10:22 H=nm17-vm0.bullet.mail.ac4.yahoo.com [98.139.53.208]:38522 Warning: fakeasg81beta.com profile excludes AV scan: Skipping SMTP inline AV scan for this message
/var/log/smtp/2010/11/smtp-2010-11-06.log.gz:2010:11:06-08:10:23 gatekeeper exim[3855]: 2010-11-06 08:10:23 id="1003" severity="info" sys="SecureMail" sub="smtp" name="email rejected" srcip="98.139.53.208" from="HIDDEN_ADDRESS@yahoo.com" to="bill@fakeasg81beta.com" size="-1" reason="rbl" extra="grey.rbl.ctipd.astaro.local"
/var/log/smtp/2010/11/smtp-2010-11-06.log.gz:2010:11:06-08:10:23 gatekeeper exim[3855]: 2010-11-06 08:10:23 H=nm17-vm0.bullet.mail.ac4.yahoo.com [98.139.53.208]:38522 F= temporarily rejected RCPT : Delivery from 98.139.53.208 is deferred. Send again or check at Check IP Reputation | Commtouch - Messaging and Web Security Technology. Reference code: tid=0001.0A020302.4CD553BF.0087
/var/log/smtp/2010/11/smtp-2010-11-06.log.gz:2010:11:06-08:10:23 gatekeeper exim[3855]: 2010-11-06 08:10:23 SMTP connection from nm17-vm0.bullet.mail.ac4.yahoo.com [98.139.53.208]:38522 closed by QUIT
/var/log/smtp/2010/11/smtp-2010-11-06.log.gz:2010:11:06-08:12:59 gatekeeper exim[5959]: 2010-11-06 08:12:59 SMTP connection from [98.139.53.208]:43093 (TCP/IP connection count = 1)
/var/log/smtp/2010/11/smtp-2010-11-06.log.gz:2010:11:06-08:12:59 gatekeeper exim[3878]: 2010-11-06 08:12:59 H=nm17-vm0.bullet.mail.ac4.yahoo.com [98.139.53.208]:43093 Warning: fakeasg81beta.com profile excludes greylisting: Skipping greylisting for this message
/var/log/smtp/2010/11/smtp-2010-11-06.log.gz:2010:11:06-08:12:59 gatekeeper exim[3878]: 2010-11-06 08:12:59 H=nm17-vm0.bullet.mail.ac4.yahoo.com [98.139.53.208]:43093 Warning: fakeasg81beta.com profile excludes AV scan: Skipping SMTP inline AV scan for this message
/var/log/smtp/2010/11/smtp-2010-11-06.log.gz:2010:11:06-08:12:59 gatekeeper exim[3878]: 2010-11-06 08:12:59 id="1003" severity="info" sys="SecureMail" sub="smtp" name="email rejected" srcip="98.139.53.208" from="HIDDEN_ADDRESS@yahoo.com" to="bill@fakeasg81beta.com" size="-1" reason="rbl" extra="grey.rbl.ctipd.astaro.local"
/var/log/smtp/2010/11/smtp-2010-11-06.log.gz:2010:11:06-08:12:59 gatekeeper exim[3878]: 2010-11-06 08:12:59 H=nm17-vm0.bullet.mail.ac4.yahoo.com [98.139.53.208]:43093 F= temporarily rejected RCPT : Delivery from 98.139.53.208 is deferred. Send again or check at Check IP Reputation | Commtouch - Messaging and Web Security Technology. Reference code: tid=0001.0A020302.4CD553BF.0087
/var/log/smtp/2010/11/smtp-2010-11-06.log.gz:2010:11:06-08:12:59 gatekeeper exim[3878]: 2010-11-06 08:12:59 SMTP connection from nm17-vm0.bullet.mail.ac4.yahoo.com [98.139.53.208]:43093 closed by QUIT
/var/log/smtp/2010/11/smtp-2010-11-06.log.gz:2010:11:06-08:16:29 gatekeeper exim[5959]: 2010-11-06 08:16:29 SMTP connection from [98.139.53.208]:20174 (TCP/IP connection count = 1)
/var/log/smtp/2010/11/smtp-2010-11-06.log.gz:2010:11:06-08:16:29 gatekeeper exim[4096]: 2010-11-06 08:16:29 H=nm17-vm0.bullet.mail.ac4.yahoo.com [98.139.53.208]:20174 Warning: fakeasg81beta.com profile excludes greylisting: Skipping greylisting for this message
/var/log/smtp/2010/11/smtp-2010-11-06.log.gz:2010:11:06-08:16:29 gatekeeper exim[4096]: 2010-11-06 08:16:29 H=nm17-vm0.bullet.mail.ac4.yahoo.com [98.139.53.208]:20174 Warning: fakeasg81beta.com profile excludes AV scan: Skipping SMTP inline AV scan for this message
/var/log/smtp/2010/11/smtp-2010-11-06.log.gz:2010:11:06-08:16:29 gatekeeper exim[4096]: 2010-11-06 08:16:29 id="1003" severity="info" sys="SecureMail" sub="smtp" name="email rejected" srcip="98.139.53.208" from="HIDDEN_ADDRESS@yahoo.com" to="bill@fakeasg81beta.com" size="-1" reason="rbl" extra="grey.rbl.ctipd.astaro.local"
/var/log/smtp/2010/11/smtp-2010-11-06.log.gz:2010:11:06-08:16:29 gatekeeper exim[4096]: 2010-11-06 08:16:29 H=nm17-vm0.bullet.mail.ac4.yahoo.com [98.139.53.208]:20174 F= temporarily rejected RCPT : Delivery from 98.139.53.208 is deferred. Send again or check at Check IP Reputation | Commtouch - Messaging and Web Security Technology. Reference code: tid=0001.0A020302.4CD553BF.0087
/var/log/smtp/2010/11/smtp-2010-11-06.log.gz:2010:11:06-08:16:29 gatekeeper exim[4096]: 2010-11-06 08:16:29 SMTP connection from nm17-vm0.bullet.mail.ac4.yahoo.com [98.139.53.208]:20174 closed by QUIT
/var/log/smtp/2010/11/smtp-2010-11-06.log.gz:2010:11:06-08:23:29 gatekeeper exim[5959]: 2010-11-06 08:23:29 SMTP connection from [98.139.53.208]:32806 (TCP/IP connection count = 1)
/var/log/smtp/2010/11/smtp-2010-11-06.log.gz:2010:11:06-08:23:29 gatekeeper exim[4345]: 2010-11-06 08:23:29 H=nm17-vm0.bullet.mail.ac4.yahoo.com [98.139.53.208]:32806 Warning: fakeasg81beta.com profile excludes greylisting: Skipping greylisting for this message
/var/log/smtp/2010/11/smtp-2010-11-06.log.gz:2010:11:06-08:23:29 gatekeeper exim[4345]: 2010-11-06 08:23:29 H=nm17-vm0.bullet.mail.ac4.yahoo.com [98.139.53.208]:32806 Warning: fakeasg81beta.com profile excludes AV scan: Skipping SMTP inline AV scan for this message
/var/log/smtp/2010/11/smtp-2010-11-06.log.gz:2010:11:06-08:23:29 gatekeeper exim[4345]: 2010-11-06 08:23:29 id="1003" severity="info" sys="SecureMail" sub="smtp" name="email rejected" srcip="98.139.53.208" from="HIDDEN_ADDRESS@yahoo.com" to="bill@fakeasg81beta.com" size="-1" reason="rbl" extra="grey.rbl.ctipd.astaro.local"
/var/log/smtp/2010/11/smtp-2010-11-06.log.gz:2010:11:06-08:23:29 gatekeeper exim[4345]: 2010-11-06 08:23:29 H=nm17-vm0.bullet.mail.ac4.yahoo.com [98.139.53.208]:32806 F= temporarily rejected RCPT : Delivery from 98.139.53.208 is deferred. Send again or check at Check IP Reputation | Commtouch - Messaging and Web Security Technology. Reference code: tid=0001.0A020302.4CD553BF.0087
/var/log/smtp/2010/11/smtp-2010-11-06.log.gz:2010:11:06-08:23:30 gatekeeper exim[4345]: 2010-11-06 08:23:30 SMTP connection from nm17-vm0.bullet.mail.ac4.yahoo.com [98.139.53.208]:32806 closed by QUIT
/var/log/smtp/2010/11/smtp-2010-11-06.log.gz:2010:11:06-08:37:30 gatekeeper exim[5959]: 2010-11-06 08:37:30 SMTP connection from [98.139.53.208]:28751 (TCP/IP connection count = 1)
/var/log/smtp/2010/11/smtp-2010-11-06.log.gz:2010:11:06-08:37:30 gatekeeper exim[4905]: 2010-11-06 08:37:30 H=nm17-vm0.bullet.mail.ac4.yahoo.com [98.139.53.208]:28751 Warning: fakeasg81beta.com profile excludes greylisting: Skipping greylisting for this message
/var/log/smtp/2010/11/smtp-2010-11-06.log.gz:2010:11:06-08:37:30 gatekeeper exim[4905]: 2010-11-06 08:37:30 H=nm17-vm0.bullet.mail.ac4.yahoo.com [98.139.53.208]:28751 Warning: fakeasg81beta.com profile excludes AV scan: Skipping SMTP inline AV scan for this message
/var/log/smtp/2010/11/smtp-2010-11-06.log.gz:2010:11:06-08:37:30 gatekeeper exim[4905]: 2010-11-06 08:37:30 [98.139.53.208] F= R= Verifying recipient address with callout
/var/log/smtp/2010/11/smtp-2010-11-06.log.gz:2010:11:06-08:37:31 gatekeeper exim[4905]: 2010-11-06 08:37:31 1PEixW-0001H7-3C HIDDEN_ADDRESS@yahoo.com H=nm17-vm0.bullet.mail.ac4.yahoo.com [98.139.53.208]:28751 P=smtp S=12889 id=961292.73873.qm@web57107.mail.re3.yahoo.com
/var/log/smtp/2010/11/smtp-2010-11-06.log.gz:2010:11:06-08:37:31 gatekeeper exim[4905]: 2010-11-06 08:37:31 SMTP connection from nm17-vm0.bullet.mail.ac4.yahoo.com [98.139.53.208]:28751 closed by QUIT
/var/log/smtp/2010/11/smtp-2010-11-06.log.gz:2010:11:06-08:37:40 gatekeeper smtpd[4908]: SCANNER[4908]: id="1000" severity="info" sys="SecureMail" sub="smtp" name="email passed" srcip="98.139.53.208" from="HIDDEN_ADDRESS@yahoo.com" to="bill@fakeasg81beta.com" subject="........deleted for privacy........." queueid="13BuMO-0001H7-01" size="10066"
Regards
Bill.
