Postgrey causing 15+ minute delays for legitimate incoming emails – best way to handle this?

Hi,

I’m running Mail-in-a-Box v74 and I’ve recently noticed that some legitimate incoming emails can take 10–15 minutes (or sometimes longer) to arrive.

After checking /var/log/mail.log , it appears that Postgrey is causing the delay.

My current Postgrey configuration is:

--inet=127.0.0.1:10023 --delay=180 --dbdir=/home/user-data/mail/postgrey/db

So the configured greylisting delay is only 180 seconds, but the actual delay can be much longer because the sending SMTP server decides when to retry.

For example, I have legitimate emails from Accor that are initially rejected:

postgrey: action=greylist, reason=new
postfix/smtpd: NOQUEUE: reject: RCPT ...
450 4.2.0 Recipient address rejected: Greylisted

One example:

13:04:48  First delivery attempt → greylisted
13:19:50  Sender retries → accepted
13:19:55  Message delivered to my mailbox

So this legitimate email was delayed by about 15 minutes.

I have another current example from an @accor.com sender relayed through Trend Micro:

15:58:44 connect from repost01.tmes.trendmicro.eu
postgrey: action=greylist, reason=new
sender=HA4A5@accor.com
recipient=<my address>

Postfix responded:

450 4.2.0 Recipient address rejected: Greylisted

and the remote server had still not retried when I checked later.

Other senders behave differently. For example, an Apple mail was greylisted but Apple retried about 5 minutes later and the message was then delivered normally.

Once Postgrey accepts a message, everything seems fine on my server: spam filtering and LMTP/Dovecot delivery generally take only a few seconds. The Postfix queue is also empty.

So my questions are:

  1. Is greylisting still considered useful/recommended with current Mail-in-a-Box versions?
  2. Is there a supported way in Mail-in-a-Box to disable Postgrey/greylisting?
  3. Would disabling it have a significant impact on spam with the other anti-spam mechanisms used by MIAB?
  4. Alternatively, is there a recommended way to whitelist major/legitimate mail infrastructures without maintaining a large manual whitelist?
  5. If I modify the Postgrey/Postfix configuration, what is the recommended way to make the change persistent across Mail-in-a-Box updates?

I understand the purpose of greylisting, but waiting 15+ minutes for things like login codes, booking confirmations, password-reset emails, etc. can be quite inconvenient.

I’d be interested to know how other Mail-in-a-Box users handle this and whether disabling greylisting is considered reasonable nowadays.

Thanks!

  1. You can run a grep on the sender you suspect the recipient domain belongs to (Canonical/Ubuntu in the example below), although this is not always obvious.

The problem is with mail senders such as Mailgun or Mailjet, which are email-sending services paid for by other companies to send emails from multiple addresses. Allowing the entire “mailjet” domain, for example, would authorize all emails from companies using their services.

Example :
grep postgrey /var/log/mail.log | grep -iE “ubuntu|canonical” | tail -5
Sep 24 16:01:48 box postgrey[468447]: action=greylist, reason=new, client_name=smtp-relay-services-0.canonical.com, client_address=185.125.188.250/32, sender=noreply@login.ubuntu.com, recipient=yourmail
Sep 24 16:01:48 box postfix/smtpd[522769]: NOQUEUE: reject: RCPT from smtp-relay-services-0.canonical.com[185.125.188.250]: 450 4.2.0 : Recipient address rejected: Greylisted, see Postgrey Help; from=noreply@login.ubuntu.com to= proto=ESMTP helo=<smtp-relay-services-0.canonical.com>
Sep 24 16:06:36 box postgrey[522831]: action=pass, reason=client whitelist, client_name=smtp-relay-services-1.canonical.com, client_address=185.125.188.251/32, sender=noreply@login.ubuntu.com, recipient=yourmail
Sep 24 16:09:58 box postgrey[522831]: action=pass, reason=client whitelist, client_name=smtp-relay-services-0.canonical.com, client_address=185.125.188.250/32, sender=noreply@login.ubuntu.com, recipient=yourmail

then you can create a /etc/postgrey/whitelist_clients.local file that will persist across updates, instead of modifying /etc/postgrey/whitelist_clients, which will be overwritten each time and add to it :

ubuntu.com
canonical .com

  1. do a systemctl restart postgrey.service

greylisting is almost useless nowadays, and cause more problems than resolves. Turn it off by allowing all mail without greylisting.

is there an option in mailinabox to disable it ? or if I do it manually, I have to disable it at each upgrade ?