Greylisting

Greylisting is a spam defence built on one observation: a real mail server retries, and a great deal of spam software does not. On first contact from an unfamiliar sender the receiving server returns a temporary rejection — a 4xx code, meaning try again — and records the attempt. A legitimate sender queues the message and retries minutes later, at which point it is accepted and usually remembered.

For verification this produces a specific kind of ambiguity. The probe reaches the mail server and gets a real answer, but the answer is “not now” rather than yes or no. Nothing about the mailbox has been established. Treating a 4xx as a rejection would mark perfectly good addresses undeliverable, which is the most expensive mistake verification can make: a real customer removed from a list on the strength of an anti-spam measure that was working exactly as designed.

So a greylisted response is unknown, never undeliverable. Unknown is a statement about the evidence rather than about the address — we asked, the server declined to say, and no amount of re-reading the response changes that.

Greylisting is also why verification latency varies between domains. A domain that greylists cannot be resolved inside a single conversation, and waiting out a retry window would mean holding a request open for minutes. The honest answer inside a reasonable time is that the answer is not yet available.