I just want to take a moment to shake a finger at the guy who came into a conversation to complain that greylisting is broken, and finished it by talking about transparent redirection. Shame on you

I'm not saying that greylisting isn't broken. It's a hack. I think everyone knows that. The thing is that every effective anti-spam tech is a broken hack. All of them. Content blacklisting (a'la spamassassin), bayesian statistical content scanning, greylisting, and (arguably) RBLs. They all break something in order that spammers can't use SMTP to do what SMTP is supposed to do. The only non-broken-hack way to deal with spam is to read your email and delete what you don't care about.

You don't need to redirect connections to log them. You can log connections using iptables without changing the packets at all. You can log entire transactions with a number of packages, also without redirecting them.

Less hackish is simply blocking access to port 25 entirely. Ask visitors to use a VPN, or to use SMTP over SSL (port 465), or to use MSA (port 587) to send messages. My previous employer did that, and no one ever complained.

As an added bonus, blocking port 25 makes logging irrelevant.