What is greylisting?

When mail arrives from a sender the server hasn't seen, it replies with a temporary code such as 450 or 451 and notes three things: the connecting IP, the envelope sender and the recipient. A real mail server queues the message and tries again a few minutes later. Most bulk spam software never comes back, so the filter costs honest mail a short delay and stops a lot of junk.

For email verification, greylisting hides the answer. A verifier's probe is a new sender by definition, so its first RCPT TO often gets the 4xx instead of a 250 or a 550. That reply says nothing about whether the mailbox exists.

A single-shot check misreads it in one of two ways. Score the 4xx as invalid and you delete good addresses. Score it as valid and you mail a mailbox nobody confirmed.

Timing is set by the receiving server, often around five minutes, and a retry only counts when it comes back from the same IP with the same envelope sender. So greylisting domains slow a bulk job more than almost any other kind of server.

It shows up most on small and self-hosted company domains, where an admin runs the filter on their own server. That's why a list heavy in company domains meets greylisting far more often than a list of consumer addresses.

Here's how it plays out on a server running a common greylisting filter. At 10:02:14 a sender it has never seen offers mail for pat@ at a small law firm. The server replies 450 4.2.0 Recipient address rejected: Greylisted, and writes down three things: the connecting IP, the envelope sender and the recipient.

A properly built mail server queues the message and tries again. If the second attempt arrives after the waiting period, often 300 seconds, the same three values match the note and the message goes through. Try again at 10:03 and you'll get the same 450, because the timer hasn't run out.

After a handful of successful deliveries, many filters add the sending IP to an automatic allow list and stop delaying it. That's why greylisting barely touches established senders and falls hardest on anyone who is new to the receiving server.

A retry only counts if it looks like the same sender coming back. Verifiers often spread probes across a pool of IP addresses to stay under rate limits. If the first probe leaves from one IP and the retry leaves from another, the server sees two strangers and greylists both.

So ask two things. Does the retry come from the same IP with the same envelope sender? And how long does it wait? A retry fired after ten seconds is wasted on a server that wants five minutes.

Then look at how the report labels the rows that never cleared. A greylisted address filed as unknown, with the 450 printed beside it, is one you can re-check tomorrow. The same address filed as invalid drops off your list for good, and a real reader goes with it.