Greylisting, and why it fools verifiers

The idea dates to the early 2000s and it works because spam software of the era did not retry. Send once, get rejected, move on to the next target. A real mail server treats a 4xx as an instruction to try again later, which it does, and the message goes through on the second attempt.

For a mail server that is a delay of a few minutes. For a verifier it is a trap, because a verifier makes one connection and reads one response. The 4xx arrives, and a verifier that scores it as invalid has just deleted a working address.

The response text sometimes says greylisted and sometimes says nothing useful. There is no dedicated code, so 450 and 451 both appear and neither is exclusively greylisting.

The correct handling is to retry on a schedule that respects the greylist window, which is typically a few minutes to an hour, and to report unknown if it persists. What you must not do is convert a temporary failure into a permanent verdict.

It is nearly free to run, it catches a meaningful share of low-effort spam, and the cost to legitimate senders is a delay rather than a loss.

It is common on self-hosted mail servers and on smaller business domains, which means it clusters exactly on the kind of B2B addresses a sales team cares about.

Large providers mostly do not use it, because a few minutes of delay on billions of messages is a poor trade. That makes it a small-domain phenomenon and easy to underestimate from a consumer list.