What is Greylisting?

Greylisting is an anti-spam method used by mail transfer agents (MTAs) to defer incoming email from senders not yet seen in a sender-recipient-IP triple. When a message arrives from an unknown combination, the receiving MTA returns a temporary failure response (typically a 4xx SMTP code, such as "450 4.7.1 Greylisted, try again later"). The sending server is expected to queue the message and retry delivery after a delay, usually a few minutes to a few hours.

Legitimate mail servers, following the SMTP specification (RFC 5321), will retry delivery automatically. Many bulk spammers, however, use lightweight scripts that send and forget, never retrying a failed attempt. By deferring on the first attempt, greylisting stops a significant portion of low-effort spam without needing to inspect message content. Once a triple has been seen and successfully delivered after retry, the receiving MTA adds it to a whitelist, allowing future messages from that sender to that recipient from that IP to pass immediately.

Greylisting is often deployed as a first-layer filter before more resource-intensive checks like content scanning or DNS-based blackhole lists. It works well against volume-based spam but can cause delivery delays, which is a trade-off. Administrators typically set a retry window (for example, 300 seconds) and a whitelist expiration (for example, 30 days). The technique does not require constant updates like signature-based filters and places minimal computational load on the receiving server.