postgreyreport1
Fatal report for postfix greylisting policy server
Usage
postgreyreport [options ...]
does DNS/A
lookups
for
sender
@domain
and
compares
sending
IP
if match
displays
"MX"
"A"
or
"MX/24"
or
"A/24"
depending
on
LIST
Overview
postgreyreport opens postgrey.db as read-only; reads a maillog via STDIN, extracts the triplets for any Greylisted lines and looks them up in postgrey.db. if the difference in first and last time seen is less than --delay=N then the triplet is considered fatal and displayed to STDOUT
The report sorts by client IP address
Note:
unless you are using --lookup_by_subnet or excluding all known MTA pools you will likely have false fatal reports for "BigISPs". A message that was tried from every IP in SMTP pool before making it through will show up in the report for all of the attempted source IPs
Usage
It is best to run postgreyreport against a maillog that is at least several hours old (yesterdays?) ( you be the judge on how old is acceptable ). if you run the report against a live maillog you are not giving legit MTA's enough time to try again and you will have lots of inaccurate information.
- •
-
Ex usage:
zcat /var/log/maillog.0.gz | ./postgreyreport [options] > postgreyreport.logorzcat /var/log/maillog.0.gz | \./postgreyreport --nosingle_line --check_sender=mx,a \--separate_by_subnet=":==================\n"# 94 "=" total, some were omitted for clarity
- •
-
Ex Output: ( POD wrapping will mess this up, view source )
:============================================================================================unknown 4.29.43.31[email protected] [email protected][email protected] [email protected][email protected] [email protected][email protected] [email protected][email protected] [email protected][email protected] [email protected][email protected] [email protected]:============================================================================================lsanca1-ar5-127-189.biz.dsl.gtei.net 4.33.127.189A [email protected] [email protected][email protected] [email protected]:============================================================================================smtpout.mac.com 17.250.248.83[email protected] [email protected]smtpout.mac.com 17.250.248.88MX [email protected] [email protected]:============================================================================================
History
- Debian 13 (Trixie): the text shown here
- Debian 12 (Bookworm)
- Debian 11 (Bullseye)
- Debian 10 (Buster)
- Debian 9 (Stretch)
- Debian 8 (Jessie)
- Debian 7 (Wheezy)
- Debian 6.0 (Squeeze)
- Debian 5.0 (Lenny)
- Debian 4.0 (Etch)
- Debian 3.1 (Sarge)