[Rspamd-Users] Greylisting oddity.

[Tim Harman]

On 06/12/2019 11:30 pm, Reio Remma via Users wrote:
> Hello!
> 
> I have this specific mail that is being greylisted and the sender
> tries to resend it every 60 minutes. For some reason it is
> persistently greylisted.
> 
> My unmodified greylist config has expire = 86400, timeout = 300 and
> greylisting works for all other mails.
> 
> The logs seem identical for all the attempts and they come in from the 
> same IP.
> 
> Curiously, they also log: Score too low - skip greylisting, but then
> get greylisted.
> 
> Greylist limit is at 4, the mail scores 4.23. Of the more unusual
> matches I see NEURAL_SPAM_SHORT, which pushes it over the limit.
> 
> Any ideas?

So, I know to a degree what causes this, but the fix I'm not entirely 
sure of I'm sorry.

The way neural works is that is is applied after all other checks etc 
are done.  So yes, you'll see your score of say 4, THEN neural is 
applied which changes the final score.  It can't be done any other way, 
due to the fact that neural learning is applied to the result of all the 
scoring done.  So it has to be applied after (otherwise the result of 
the neural check would form part of the neural check...)

Why it is repeatedly greylisted though, I can't answer.  Maybe there is 
a logic bug in the way the score is applied after all other checked have 
been done.  Or maybe there is truly something different/unique about the 
repeated delivery attempts that make each attempt appear to be a new 
attempt, not a repeat of the old attempt.

Tim