Greylisting Technology: An Effective Approach Against Spam

Greylisting is an anti-spam technique used by some mail servers. It is simple and, for years, remarkably effective.

How it works

When a server sees mail from an unknown combination of sender, recipient and sending server, it answers with a temporary error and asks the sender to try again later. Legitimate mail servers retry automatically. Many spam tools do not.

The benefits

• Cuts a large share of bulk spam at almost no cost
• Needs no content scanning
• Works against throwaway sending infrastructure

The side effects

• First messages from a new sender can be delayed by minutes
• Time-sensitive mail such as password resets may arrive late
• Poorly configured senders that do not retry can lose mail

What it means for verification

A greylisting server may answer a verification probe with a temporary code. A good verifier retries and reports the real status instead of marking the address invalid.

For senders

Use a proper mail server that retries, keep your sending IP and domain stable, and authenticate every message.

How greylisting works step by step

Greylisting is a simple anti-spam trick at the receiving mail server. The server remembers a triplet for each incoming message: the sender, the recipient and the IP address of the sending server.

1. A message arrives from a triplet the server has never seen.
2. The server replies with a temporary error, usually a 4xx code such as 451, which means "try again later".
3. A legitimate mail server queues the message and retries after a few minutes.
4. On the retry the server recognises the triplet, accepts the message and remembers the sender for the future.

Most spam software sends once and never retries, so the junk never arrives. Real servers follow the standard and do retry.

Strengths and weaknesses

• Strong: very cheap to run, needs no content scanning and blocks a large share of bulk spam.
• Weak: the first message from any new sender is delayed, from a few minutes up to an hour in bad cases.
• Weak: senders that rotate IP addresses on every retry can look like a new triplet each time and never get through.
• Weak: spammers can add retry logic, so greylisting works best as one layer among several.

What it means if you send email

• Time-sensitive messages. Password resets, sign-in codes and receipts can be delayed on the first contact with a new recipient domain. Send them from a stable, dedicated IP or provider so retries come from the same address.
• Retry behaviour. Use a mail platform that retries on 4xx errors with a sensible schedule instead of marking the message failed.
• Stable sending identity. Use consistent sender addresses and IPs, and keep SPF, DKIM and DMARC aligned, so the triplet stays the same.

What it means for verification

A greylisting server may answer a verification probe with a temporary code, so the mailbox looks "unknown" at first. A well built verifier waits and retries and then reports the real status, rather than marking the address invalid. If you see many unknown results from one domain, a retry later often resolves them. Do not delete addresses just because of a temporary answer.

Quick checklist

• Expect a delay on first contact, not a failure.
• Make sure your platform retries on temporary errors.
• Keep your sending IPs and addresses stable.
• Treat repeated temporary errors differently from permanent 5xx rejections.

Check a few addresses with the free email checker, or clean a full list with bulk email verification.

Typical retry schedules

Mail servers do not retry at a fixed moment. Most follow a schedule that widens over time, for example after a few minutes, then after about fifteen minutes, then after an hour, and so on for up to several days. Greylisting servers usually require a minimum wait before they accept the second attempt, commonly between five and fifteen minutes. A sender that retries too fast is refused again, and a sender that never retries is treated as spam.

Greylisting compared with other defences

• SPF, DKIM and DMARC: these prove who the sender is. Greylisting does not check identity, it checks behaviour.
• Blocklists: these reject senders already known to be bad. Greylisting also catches new, unknown spam sources.
• Content filters: these read the message. Greylisting works before the message is accepted, so it is cheaper.
• Rate limits: these slow down floods. Greylisting asks each new sender to prove it can retry.

Most receiving servers combine several of these layers.

Why the first message is late

When you write to a company for the first time, its server may greylist you. Your message sits in your provider's queue and goes out again after the first wait. The recipient sees it a few minutes later than normal. Later messages from the same sender to the same recipient usually pass without delay because the server already remembers the triplet.

Troubleshooting a delay

1. Look at the sending log. A temporary error in the first attempt followed by success on the retry confirms greylisting.
2. Check the delay. If a message is held much longer than an hour, the sender's retry settings may be too slow.
3. Look for changing addresses. If your provider uses a pool of sending IPs, each retry may come from a different address and fail again.
4. Test again. Send a second message after the first one was delivered. It should arrive at once.

Advice for transactional messages

Password resets and sign-in codes cannot wait. Use a provider with stable IPs for these messages, keep the retry interval short, and let the user request a new code if the first one is late. For new customers on small business domains, mention in your help page that the first message can take a few minutes.

Frequently asked questions

Is greylisting the same as a spam folder? No. A greylisted message is delayed before it is accepted. A spam folder holds a message that was already accepted.

Does greylisting lose messages? Not when the sender retries correctly. A message is lost only if the sender gives up.

Should I turn it on for my own server? It can cut spam cheaply, but it delays first-contact mail. Weigh that against your users' needs.