Blocking spam sessions with greylisting and block listing based on client behavior

Greylisting and real-time block listing are two common mechanisms for spam filtering. The former can efficiently reduce the number of spam sessions, but can be easily evaded if spammers retry spam delivery within a period of time. The latter can detect and reject the clients with poor reputation during SMTP sessions by looking up an external blacklist. Its weaknesses are the high false-positive rate and a lack of locality. We design a method of dynamically updating the greylist and block list based on the delivery behavior of spammers to block spam sessions in time. The method is implemented on a mail gateway in a senior high school. In our experiments with the real-world mail traffic for a month, the method can block 70.29% and 69.21% of the known and possible messages in the spam sessions with greylisting and block listing. The forward and reverse DNS lookups are also adopted to further reduce the false-positive rate to under 0.01%. Therefore, the required system resources for further spam filtering on mail servers can be greatly saved by blocking most of the spam sessions in time.