Measuring the role of greylisting and nolisting in fighting spam

Spam has been largely studied in the past yearsfrom different perspectives but, unfortunately, it is still an openproblem and a lucrative and active business for criminals andbot herders. While several countermeasures have been proposedand deployed in the past decade, their impact and effectivenessis not always clear. In particular, on top of the most commoncontent-and sender-based anti-spam techniques, two minorapproaches are popular among system administrators to copewith this annoying problem: greylisting and nolisting. Thesetechniques exploit known features of the Simple Mail TransferProtocol (SMTP) protocol that are not often respected by spambots. This assumption makes these two countermeasures reallysimple to adopt and, at least in theory, quite effective. In this paper we present the first comprehensive studyof nolisting and greylisting, in which we analyze these spamcountermeasures from different perspectives. First, we measuretheir world-wide deployment and provide insights from theirdistribution. Second, we measure their effectiveness against areal dataset of malware samples responsible to generate over70% of the global spam traffic. Finally, we measure the impactof these two defensive mechanisms on the delivery of normalemails. Our study provides a unique and valuable perspective ontwo of the most innovative and atypical anti-spam systems. Ourfindings may guide system administrators and security expertsto better assess their anti-spam infrastructure and shed somelight on myths about greylisting and nolisting.