OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Re: Greylisting: soft fail if grey listing server down

From: Aaron Wolfe (aawolfegmail.com)
Date: Sat May 10 2008 - 19:13:59 CDT


On Sat, May 10, 2008 at 8:09 PM, Wietse Venema <wietseporcupine.org> wrote:

> Geert Hendrickx:
> > On Sat, May 10, 2008 at 09:18:47AM -0400, Wietse Venema wrote:
> > > Marc G. Fournier:
> > > > What happens then? Does the remote end see that as a hard failure,
> or a
> > > > soft one? Is there a setting (like
> unknown_local_recipient_reject_code =
> > > > 450) that I can set to make it soft, so that email isn't lost at
> times
> > > > like this?
> > >
> > > Oh ye of small faith. Postfix always replies with 4xx if it doesn't get
> a
> > > definite reply.
> >
> > For milters there is milter_default_action = accept.
>
> This is because Sendmail provides it, not because it is a good idea.
>
> > Can this be implemented for policy daemons as well?
>
> I don't like dropping the shields down because some service dies.
>
> It causes people to lose confidence in Postfix, because it results in
> unpredictable behavior. There is enough bad software on the Internet.
>

Would it be possible (and make sense) to have an option to specify somehow
that a particular policy filter is non essential and it's failure should be
considered equivalent to "DUNNO" or similar?

I have had more than one situation where a daemon failed and the resulting
mail delays were unfortunate and really unnecessary as the mail system
(besides the policy filter) was working fine. In our case, dropping this
filter from our UCE fighting checks would not have resulted in "shields
down" or more spam, just extra work for the more resource intensive checks
later on in the chain.

-Aaron