- Greylisting, defined
- Greylisting is an anti-spam technique where a server temporarily rejects mail from an unfamiliar sender, expecting a legitimate sender to retry and a spammer not to.
The server returns a 4xx code on first contact and records the sender, recipient and address it came from. A real mail server retries within minutes and is let through. Most bulk spam software never comes back.
For verification this is awkward, because a single-pass check sees only the temporary rejection. Reading that as invalid produces false negatives on entirely good addresses.
Handling it properly means retrying after a delay and treating the second answer as the real one. A verifier that never retries will quietly misclassify every greylisted domain it meets.
How ZapBounce reports it
We retry rather than score the first 4xx. If the second attempt still will not commit, the address is returned as unknown and is not billed, because a delay is not evidence about the mailbox.
Five minutes at the door
Here's how it plays out on a server running a common greylisting filter. At 10:02:14 a sender it has never seen offers mail for pat@ at a small law firm. The server replies 450 4.2.0 Recipient address rejected: Greylisted, and writes down three things: the connecting IP, the envelope sender and the recipient.
A properly built mail server queues the message and tries again. If the second attempt arrives after the waiting period, often 300 seconds, the same three values match the note and the message goes through. Try again at 10:03 and you'll get the same 450, because the timer hasn't run out.
After a handful of successful deliveries, many filters add the sending IP to an automatic allow list and stop delaying it. That's why greylisting barely touches established senders and falls hardest on anyone who is new to the receiving server.
Why rotating IPs makes a verifier worse at this
The retry only counts if it looks like the same sender coming back. Verifiers often spread probes across a pool of addresses to stay under rate limits. If the first probe leaves from one IP and the retry leaves from another, the server sees two strangers and greylists both.
So the question for a verification vendor isn't only whether they retry. Ask whether the retry comes from the same address with the same envelope sender, and how long they wait. A retry fired after ten seconds is wasted on a server that wants five minutes.
This has a cost in speed, and it's fair to say so. A list with many greylisting domains can't be finished in one fast pass, since the second answer is the real one and it isn't available yet. When a vendor returns every result within seconds, some of those 4xx replies were either guessed at or filed as invalid.
Greylisting: common questions
How long does greylisting usually last?
Minutes for a retrying sender. The server remembers the sender, recipient and IP triplet, and lets subsequent mail through for a period after the first success.
Does greylisting mean the address is bad?
No. It says nothing at all about the mailbox. It is a test of whether the sender behaves like a real mail server.
Why do some verifiers mark greylisted addresses invalid?
Because a single-pass check is cheaper. It also produces false negatives on good addresses, which is the tradeoff being made on your behalf.