Greylisting, explained

Greylisting is an anti-spam technique where a receiving server temporarily rejects mail from an unfamiliar sender with a 4xx response, expecting a legitimate server to retry a few minutes later. Most spam software never retries, so the tactic filters a lot of junk cheaply.

What it looks like

The first delivery attempt gets something like:

451 4.7.1 Greylisted, please try again in 300 seconds

A compliant mail server queues the message and retries. Once the sender/recipient/IP triple is proven, it is whitelisted for a period and future mail flows immediately.

Why it matters for verification

A verifier that connects once and gives up will record unknown for every greylisted domain. That is not an error in the address — it means the check could not complete. Good verification handles it by:

• Retrying after a delay from the same IP
• Tracking which domains greylist and scheduling accordingly
• Reporting "unknown" honestly instead of guessing "valid"

If you run your own checks, expect a meaningful share of business domains behind Proofpoint, Mimecast or Barracuda to greylist.

What to do with unknown results

• Re-run the check a few hours later; most resolve.
• If it stays unknown after two or three attempts, treat it like a catch-all address: segment it and warm up.
• Never bulk-delete unknowns — they contain plenty of valid customers.

Greylisting vs blocking

Greylisting is a temporary 4xx and resolves itself. A 5xx block is permanent and points at a reputation or policy problem — see sender reputation and hard bounce vs soft bounce.