Any news?

I did as you asked but I am not fond of pasting the debug log here in public as it contains mail addresses, ssl ciphers and cert fingerprints. If I can mail it or paste it privat I am happy to do so.

Please understand I am not willing to invest hours of work to *mask* thousands of lines in a logfile. It was much faster to dig into it myself. The issue with your greylisting implementation is that although you talk about "triplets" in the comments of greylisting.py (iredapd plugin) you use the full ip-address of the connecting mailserver. You do this with IPv4 and IPv6:

2016-09-22 18:04:52 DEBUG [SQL] query greylisting tracking:
SELECT init_time, blocked_count, block_expired, record_expired
               FROM greylisting_tracking
              WHERE     sender='user@sender-domain.com'
                    AND recipient='user@recipient-domain.com'
                    AND client_address='2a00:1450:400c:c09::22d'
              LIMIT 1
2016-09-22 18:04:52 INFO [2a00:1450:400c:c09::22d] Client has not been seen before, greylisted.

SELECT init_time, blocked_count, block_expired, record_expired
               FROM greylisting_tracking
              WHERE     sender='user@sender-domain.com'
                    AND recipient='user@recipient-domain.com'
                    AND client_address='14.186.220.202'
              LIMIT 1
2016-09-22 17:24:26 INFO [14.186.220.202] Client has not been seen before, greylisted.

While smaller ISPs and companies mostly use only one or two IPv4 addresses for their mailserver large ISPs use clusters with many more addresses (Google, 1&1, Microsoft, etc.). The larger the amount of addresses the smaller the chance to see the same address again within a reasonable time frame. This is the reason why usually greylisting ist done using only a portion of the address. For IPv4 the vast majority of mailservers use a /24 mask why it is called 'triplet' (the first three octets only). For IPv6 I see /112 or /96 masks very often.

Long story short. The implementation of greylisting in iredapd as it is now will cause more issues than it will solve unless we get two new variables to define the mask for IPv4 and IPv6 addresses in settings.py.

Instead of solving the root cause of the issue (using cidr instead of single ip) you suggest a solution that will only work with some domains. You can close this thread. I solve the issue myself.