Greylisting explained for marketers: why some mail is delayed

Greylisting is an anti-spam technique in which a receiving mail server temporarily rejects the first delivery attempt from a sender it has not seen before, using a 4xx SMTP code such as 450 or 451, and accepts the message when the sender retries a few minutes later. Legitimate mail servers always retry; most spam software does not. For marketers it means a share of every campaign is delayed rather than delivered on the first attempt, shows up as a deferral or soft bounce in the ESP report, and almost always arrives within an hour. It is not a rejection and it is not a reputation problem.

What is greylisting?

When your ESP's server connects to a recipient's server, the recipient identifies the attempt by a triplet: the sending IP address, the envelope sender (MAIL FROM) and the recipient address (RCPT TO). A greylisting server keeps a record of the triplets it has seen. If the triplet is new, it answers RCPT TO with a temporary failure instead of accepting the message. The sending server, following the SMTP standard, queues the message and tries again. On the retry the triplet is recognised, the message is accepted, and the triplet is remembered for weeks so later mail goes straight through.

The logic is simple. Spam tools that blast millions of messages from compromised machines rarely implement retry queues. A real mail server retries as a matter of course. So the first-attempt rejection costs legitimate senders a short delay and costs spammers the message entirely.

Which SMTP codes mean greylisting?

The first digit is a 4, which means "temporary, try again". The 4.7.x enhanced status code points at a policy decision rather than a technical fault. Some servers say "greylist" in the text; many do not. The full set of codes Verifyre reports is on the status codes page, and the hard versus soft distinction is covered in hard bounce vs soft bounce.

Why do mail servers greylist?

• It is cheap and effective. No content scanning, no reputation lookups, just a small database of triplets, and it blocks a large share of spam at almost no cost.
• It buys time. By the time the retry arrives, blocklists and content filters may have caught up with a spam campaign that was unknown minutes earlier.
• It is common in specific places. Self-hosted Postfix and Exim servers, many European hosting providers, universities and government bodies. Gmail, Outlook.com and Yahoo do not greylist in the classic sense, but they apply similar deferrals to senders with little reputation.

What does greylisting look like in your ESP reports?

Your ESP's sending servers handle the retry automatically. What you see depends on when you look.

• During the send: some messages shown as deferred, pending, queued or "in transit". That is the ESP's queue waiting for the retry window.
• Within an hour: most of them flip to delivered as the retries succeed, with a later delivery time than the rest.
• After the ESP gives up: a message that never got through after 24 to 72 hours of retries is recorded as a soft bounce, usually with the 4xx code and the server's text.

So greylisting shows up as deferrals that resolve, and only becomes a soft bounce when a server keeps rejecting every attempt. A cluster of 450 or 451 soft bounces concentrated on a handful of domains is greylisting that did not clear, usually because the server's window and your ESP's retry schedule never lined up.

How long do the delays last?

The first retry from a typical ESP comes after 5 to 15 minutes, and the greylisting server usually accepts on the first or second retry.

• Minutes: the common case. Most greylisted messages are delivered within 15 to 30 minutes of the first attempt.
• Up to a few hours: when the sender's retry schedule backs off (15 minutes, then 30, then 1 hour, then 2) and the first retry fell inside the server's minimum delay.
• Days or never: rare, and a sign of something else, such as a server that greylists every attempt from new IPs or an ESP retry schedule that stops too early.

Once the triplet is accepted it is whitelisted for a period, often 30 to 60 days, so the next campaign to the same contact from the same IP is not delayed. Senders on rotating shared IPs can hit it repeatedly, because the triplet changes with every IP.

What does greylisting mean for email verification?

Verification uses the same SMTP conversation as sending, stopping before any message is transmitted, so a greylisting server greylists the verifier too. The RCPT TO gets a 450 and the server has said nothing about the mailbox.

Verifyre handles this by retrying on a schedule from the same sending identity, so the triplet is recognised and the server gives a real answer on the second or third attempt. Most greylisted addresses resolve to deliverable or undeliverable within the verification window. Where a server never answers definitively, the address is returned as unknown with the 4xx reply recorded, rather than guessed either way. The transcript in the email checker shows the retry sequence, and the mechanics of the conversation are in what is email verification.

An unknown verdict caused by greylisting means the domain exists, has working mail servers and is actively filtering, a healthier signal than a dead domain. Treat those addresses as sendable with caution rather than removing them.

What should marketers do about greylisting?

Do:

1. Nothing to the list. Greylisting is not a bad address. Do not suppress contacts because their first delivery was deferred.
2. Read the soft bounce codes. Separate 450 and 451 from 452 (mailbox full). The former are delays; the latter is a list quality signal.
3. Keep the envelope sender stable. A consistent MAIL FROM domain keeps the triplet the same from send to send, so the whitelist entry keeps working.
4. Prefer a dedicated IP at volume. Over roughly 100,000 messages a month, a dedicated IP makes greylisting a one-time cost per recipient domain.
5. Allow time before judging a campaign. Look at delivery after two hours, not two minutes.

Do not:

• Resend to deferred contacts. The ESP is already retrying. A second campaign creates a new triplet and a new delay, plus a duplicate when the first lands.
• Count greylisting toward your soft bounce threshold. Three deferrals that resolved are not three soft bounces.
• Switch ESP or IP to escape it. A new IP means every triplet is new again and every greylisting server starts from scratch.

Key takeaways

• Greylisting is a temporary 4xx rejection of an unfamiliar sender triplet; the message is accepted on retry.
• The codes are 450 or 451, usually with enhanced status 4.7.1, and they mean "later", not "no".
• In ESP reports it appears as deferrals that resolve within minutes to hours, and only becomes a soft bounce if retries fail for days.
• For verification it produces a retried check and, at worst, an unknown verdict, never a false undeliverable.
• Keep the list and the sending identity stable, read the soft bounce codes, and do not resend.

Frequently asked questions

Is greylisting the same as a soft bounce?

A soft bounce is what your ESP records when retries fail for its whole retry window. Greylisting is one cause of temporary rejections, and in most cases the retry succeeds and no bounce is recorded.

Does greylisting hurt my sender reputation?

No. It is applied to senders the server has not seen, not to senders it distrusts, and the deferral is not reported to reputation systems.

Should I remove addresses that come back as unknown because of greylisting?

No. The domain is live and filtering, which is a good sign. Keep them, send to them with the rest of the list, and re-verify later if they never engage.