I just started getting some weirdness with some email sent to my mail
servers. Greylisting "come back later" (451) messages are being
interpreted (it appears) by remote MTAs as a 5xx level error, meaning they
immediately abort send attempts and bounce the email! I have never seen
this before.
I've seen it from two separate remote MTAs so far, but from reports I'm
getting in, it's happening on more.
Here's what I get from umce3cip03.ad.umanitoba.ca:
Remote Server returned '554 5.0.0 <[50.71.247.87] #5.0.0 smtp; 5.1.0 -
Unknown address error 550-'<foobar(a)tecnopolis.ca>... 451 4.7.1 Greylisting
in action, please come back later' (delivery attempts: 0)>'
On my server sendmail log I see:
Aug 16 08:43:15 pog sendmail[14379]: v7GDhFav014379: Milter:
to=<foobar(a)tecnopolis.ca>, reject=451 4.7.1 Greylisting in action, please
come back later
So umce3cip03.ad.umanitoba.ca appears to be taking my 451 and turning it
into a 500/554/510 permanent error.
I also see this from yahoomail, but that's a different situation because
yahoo is always considered "broken mta" in milter-greylist and we must
whitelist all of their servers... but, the usual/previous symptom was
yahoo would keep retrying as normal, just with a different IP each time,
thus never passing greylisting. And now yahoo is doing the same thing as
umce3cip03.ad.umanitoba.ca above (when I haven't yet whitelisted the
particular IP that day, grrr):
Sorry, we were unable to deliver your message to the following address.
<foo(a)tecnopolis.ca>:
550: <foo(a)tecnopolis.ca>... 451 4.7.1 Greylisting in action, please
come back later
So at least 2 MTAs, probably more, are changing 451 greylist into 5xx. Is
there some new massive change out there to basically take greylist MTAs as
broken? Is there a way to find out what MTA (or outsourced service
provider) umce3cip03.ad.umanitoba.ca is using? Perhaps there is just one
brand that unilaterally decided on this action?
I can find no google hits on any of this. :-(
There is an easy workaround/gotcha: if people wait the greylist timeout
(usually 2 to 20 minutes) and then resend the same to-from-ip tuple email,
it will go through as their server will have been whitelisted in the
interim! But that makes it harder to troubleshoot this problem because it
then becomes transient.
If any MUUGers have problems with MUUG mailing lists bouncing, please
resend your email after 1 hr if it hasn't showed up yet (you can check the
website mail list archives section) and/or please email me directly with
your bounce email message (twice, wait 20 mins!) so I can solve this for
both MUUG servers and my own.
If this problem is a) permanent/deliberate, and b) widespread, I think
that spells the death of greylisting (grrrrr...) and the nearing of "spf
strict" enabling.