Greylisting problems

Question

Hey, 
 what is bothering me a lot is that Greylisting is not working. That feature does help with Spam but it is not helpful when the mails arrive sometimes half-a-day or even 4 days later. Also when any mail goes through exactly that constellation of sender and receipient should get listed in a database and the next mail should just go through. That also does not work! 
 Sophos Support told me that they are reworking the mail module completely. I saw a lot of changes in 17.1 GA regarding the mail module but it does not look like they rewrote it. And now with v17.1.2 there are no major changes in the mail module again and nothing about Greylisting can be seen in the changelog. I really hope that Sophos is about to do something in that direction! 
 Anyone else having problems with Greylisting?

FloSupport · Answer

Hi Jelle 
 The XG flushes the sender server IP from the trusted list after a month or a week of inactivity, whichever comes first. Yes, the XG still performs the normal checks for incoming mail, as the trusted list only affects greylisting. 
 Hope that helps! 
 Regards,

FloSupport · Answer

Hi Jelle 
 The current behavior of greylisting as you mentioned is outlined in the SFOS help . 
 
 Select Use greylisting if you want the firewall to temporarily reject inbound emails from IP addresses of unknown email servers. Legitimate servers retry sending the rejected emails at regular intervals and the firewall accepts these mails, greylisting the sender&rsquo;s IP address for a specific period. 
 
 After enabling the Greylisting feature, the Sophos XG Firewall first rejects all emails from unknown senders with SMTP status code 421 and send a response to the sender mail server with "Your email could not be delivered. Please try again later." If the sender is legitimate, the sending mail server will keep that rejected email in its delivery queue for next send attempt. 
 The XG Firewall will then wait for the re-delivery of the same email by the sender mail server. Since the sender is legitimate, the sender mail server will re-send the same email which the XG Firewall will recognize. The XG Firewall will then accept the email and keep the sender mail server's IP address in the trusted mail server list. 
 Regards,