[Rspamd-Users] Greylisting oddity.

[Reio Remma]

On 07/12/2019 22:34, Tim Harman via Users wrote:
> On 06/12/2019 11:30 pm, Reio Remma via Users wrote:
>> Hello!
>>
>> I have this specific mail that is being greylisted and the sender
>> tries to resend it every 60 minutes. For some reason it is
>> persistently greylisted.
>>
>> My unmodified greylist config has expire = 86400, timeout = 300 and
>> greylisting works for all other mails.
>>
>> The logs seem identical for all the attempts and they come in from 
>> the same IP.
>>
>> Curiously, they also log: Score too low - skip greylisting, but then
>> get greylisted.
>>
>> Greylist limit is at 4, the mail scores 4.23. Of the more unusual
>> matches I see NEURAL_SPAM_SHORT, which pushes it over the limit.
>>
>> Any ideas?
>
> So, I know to a degree what causes this, but the fix I'm not entirely 
> sure of I'm sorry.
>
> The way neural works is that is is applied after all other checks etc 
> are done.  So yes, you'll see your score of say 4, THEN neural is 
> applied which changes the final score.  It can't be done any other 
> way, due to the fact that neural learning is applied to the result of 
> all the scoring done.  So it has to be applied after (otherwise the 
> result of the neural check would form part of the neural check...)
>
> Why it is repeatedly greylisted though, I can't answer.  Maybe there 
> is a logic bug in the way the score is applied after all other checked 
> have been done.  Or maybe there is truly something different/unique 
> about the repeated delivery attempts that make each attempt appear to 
> be a new attempt, not a repeat of the old attempt.
>
> Tim 

Unfortunately neural kicked in again and I've several mails permanently 
greylisted.

Can anyone advise how to completely disable greylisting? enabled = false 
doesn't seem to work.

It's funny - greylisting was one of the main reasons I wanted to use 
Rspamd, but in several months of use now I've yet to see a single e-mail 
being blocked due to greylist. :) So now I think it's safe to turn it 
off completely.

Thanks,
Reio