What is greylisting
Greylisting is an anti-spam technique where a mail server temporarily rejects incoming mail from an unknown sender. The assumption is that a legitimate mail server will retry delivery after a few minutes, while a spam bot will not.
How it works
When an unknown sender triplet — sending IP, sender address, recipient address — is seen for the first time, the receiving server returns SMTP code 450, a temporary failure. SMTP requires the sending server to queue the message and retry later. The greylisting filter typically accepts the retry after 5 to 15 minutes and records the triplet so future mail from the same sender passes without delay.
Most spam bots skip the retry entirely. That is the whole bet greylisting makes, and it works well enough that the technique cuts a meaningful share of junk traffic at very low compute cost.
Who uses it
Greylisting is built into Postgrey (for Postfix), SQLgrey, and milter-greylist, and a number of commercial anti-spam appliances include it as well. Some hosting providers enable it by default. Large mail services like Gmail or Outlook do not use it — they have enough other filtering signals that the delay trade-off is not worth it.
Effect on email validation
For email verification services, greylisting is a real problem. During SMTP validation, the server responds 450 to the RCPT TO command. Without a retry, a naive validator reads that as the address not existing — a false negative.
Validators that handle this properly implement retry logic: after receiving a 450, they wait and try again. Some also keep a cache of known greylisting servers so they can schedule the delay from the start rather than discovering it mid-check.
How uChecker handles greylisting
uChecker detects 450 responses and retries the check automatically after the appropriate delay. This reduces false negatives on servers that use greylisting and gives accurate results where simpler validators would just give up.
What it looks like from the sender's side
The first message to an address gets a temporary rejection — 450 or 451 with wording along the lines of "try again later". A well-behaved mail server queues the message and retries within minutes, and the second attempt goes through. Spam runs usually do not retry: moving on down the list is cheaper.
For the receiver this is a nearly free filter. For the sender it means the first message is delayed by fifteen minutes to an hour — critical for a confirmation code, irrelevant for a newsletter.
Why it matters for validation
A checking service that sends one probe and never retries will hit the temporary rejection and may file a live address as dead. This is one of the reasons two services disagree on the same list.
The correct behaviour is to recognise the temporary code, set the address aside and return to it later. If a service reports "unknown" rather than "invalid" for such an address, that is a sign it handles greylisting honestly.