Greylisting issues in XG v18

Hi NH1 

Greylisting will prevent spam by rejecting a message the first time. It is presented to Sophos XG Firewall by notifying the sending server that it is currently busy. When the message is re-transmitted by the sending server, Sophos XG Firewall will recognize the combination of IP, sender e-mail address and receiver e-mail address and accept the mail.

Thanks, yes I understand that.

But it is rejecting the same email attempt up to 6 times BEFORE it then it finally lets it through. Not after the first rejection - creating an extra time delay.

Is there a time delay written into the logic, or does it just take a few minutes to register in a database before it is able to recognize the email as a previous attempt?

For example here is a redacted one from the mail log.

Thanks, yes I understand that.

But it is rejecting the same email attempt up to 6 times BEFORE it then it finally lets it through. Not after the first rejection - creating an extra time delay.

Is there a time delay written into the logic, or does it just take a few minutes to register in a database before it is able to recognize the email as a previous attempt?

For example here is a redacted one from the mail log.

Hi NH1 

This data set is checked against the SMTP proxy's internal database; if the data set has not been seen before, a record is created in the database along with a special timestamp describing it. This data set causes the email to be rejected for a period of five minutes. After that time the data set is known to the proxy and the message will be accepted when it is sent again. Note that the data set will expire after 30 days if it is not updated within this period.

Awesome, thanks for your reply.

Don't think the 5 minute delay is mentioned in any descriptions of greylisting - they all just say after the first.

But with that helpful knowledge of the functionality I will enable it again, as it does get rid of a lot of spam!

Hi NH1 

Thank you for your feedback, I will forward this to concern team.

Please reach out to us for further assistance.