Greylisting is an anti-spam technique where a mail server temporarily rejects emails from unknown senders. The sending server is expected to retry delivery after a delay (typically 1-15 minutes). Legitimate mail servers will retry, while many spam sources will not, effectively reducing spam without blocking legitimate mail.

• Initial Connection: First email delivery attempt from unknown sender (triplet: sender IP, sender address, recipient address)
• Temporary Rejection: Server responds with 4xx temporary error code (usually 450 or 451) asking sender to try again later
• Retry Period: Legitimate mail servers wait a specified period (usually 1-15 minutes) before retrying
• Acceptance: After retry delay, server accepts the email and adds triplet to whitelist for future deliveries

• High: Explicit greylisting keywords in response + subsequent acceptance after delay
• Medium: Temporary rejection codes (450/451) + subsequent acceptance
• Low: Inconsistent behavior or unclear rejection pattern
• None: No greylisting detected - consistent acceptance or rejection

• Spam Reduction: Blocks 50-90% of spam without false positives, as most spam sources do not retry
• Resource Efficient: Minimal server resources required compared to content filtering
• No False Positives: Legitimate mail is always delivered, just with a slight delay
• Compliant: Works within SMTP RFC standards - temporary rejection is expected behavior

• Delivery Delay: Initial emails from new senders are delayed by 1-15 minutes
• Time-Sensitive Issues: Can cause problems with password resets, verification codes, and urgent communications
• Legitimate Failures: Some legitimate mail servers or services may not retry properly
• Resource Usage: Requires database to track triplets and manage whitelist

• Use shorter retry delays (1-5 minutes) to minimize user impact
• Implement automatic whitelisting of known good servers
• Provide bypass mechanisms for time-sensitive emails
• Combine with SPF, DKIM, and DMARC for better protection
• Monitor false positive rates and adjust policies accordingly
• Whitelist common email services (Gmail, Outlook, etc.) to reduce delays

• Greylisting typically delays first-time emails by 1-15 minutes
• Look for SMTP codes 450 or 451 as indicators of greylisting
• Most greylisting implementations whitelist senders after successful retry
• Greylisting is most effective when combined with other anti-spam measures
• Some mail servers use adaptive greylisting that adjusts based on sender reputation