I've been using Postgrey with Postfix for over a year now, and practically got rid of the spam problem for my own email, and for work, for the year.

Alas a distressing development is that there is now a spam bot that retries.

Haven't got any technical low down, but the bot seems to retry every 303 seconds (approximately), and does this several times. I increased the greylist initial delay to 310 seconds on one server at work, since the database there is already well populated with most email servers this shouldn't hurt much, and increases the chances the bot will end up one the dynamic blacklist we use before it tries again. Been a little discussion on the Postgrey mailing list for those interested.

Only a trickle of such spam so far, and its distribution is very uneven, suggesting only one spammer is using this type of bot, and he is targetting big domains (or possibly a very old lists of email addresses, or domains).

Guess it was only a matter of time.

Been looking at further checks, trying to note ways in which these bots defer from genuine email servers. One idea I saw on BSD, was to use the passive fingerprinting to slow port 25 traffic from all Microsoft Windows clients, although I wonder how accurate the passive finger printing is, and the hotmail users might not be impressed, this seems a plausible approach.

Ideas on implementing later, or anyone who can get hold of one of these retrying bots so it can be analysed properly, let me know.