Several kinds of filters have been created to keep recipients safe from spam. Blacklists, whitelists, IP blocking, domain blacklists, and other tools have been doing a reasonable job, but a huge problem most users face is that even some legitimate emails end up in the spam folder because the filters are not perfect. In this case, graylisting seems to be a perfect way to bring quality emails directly to your inbox and block spam. So, what is a greylist? And what’s the difference between blacklist and greylist?

Definition

Greylisting is a new popular anti-spam technology, similar to whitelisting and blacklisting, deployed by mail servers to prevent spam. It used to test whether a sender is legitimate or not. Incoming emails don’t reach the inbox immediately. Instead, they get temporarily blocked while the receiving server requests the sending server to try sending the email again within a certain time frame.

A legitimate mail server will send the message again, and this time it will reach the recipient’s inbox. However, spam servers do not bother to do this, so the spam will never be resent and thus will not reach the user’s mailbox.

Greylisting vs. Blacklisting

From the Diffsense, we can easily know the definition of greylist and blacklist.

The difference between blacklisting and greylisting is quite obvious. If a sender is blacklisted, no matter how many times they try to send you emails, they will never reach your mailbox (not even the spam folder!).

What greylisting does, on the other hand, is to issue temporary error codes which are to be respected by RFC compliant remote mail servers which should attempt re-delivery. Usually, this is not the case for spammy remote mail servers which are configured to quickly deliver large amounts of messages and skip the queueing of messages in case of temporary error codes. 

The following pic is an example.

How Do Emails Get Greylisted?

Maybe it is not so easy to make it clear. But this article try to make all of you understand it.

When a mail server receives an incoming connection from a remote mail server, it rejects the connection with a temporary error code. But caches the IP address of the sending server as well as the sender and recipient addresses. The sending server should interpret this 451 error code as a temporary error. And it will attempt to resend the message within the time frame specified in the RFCs. (Note: RFCs means Requests for Comments)

When a remote mail server attempts to resend an email, the information is matched against a message in the graylist cache. And then the email server will accept your messages. Further filtering techniques can be applied to the receiving mail server. Email messages stay in the cache for only 24 hours, so some senders have to go through the graylisting process each time. For example, those who send you email infrequently.

Also, each mail server has a different retry scheme that is applied to outbound messages in case of temporary error codes. Usually, between 1 and 30 minutes, the default is 15 minutes. 

What caused your emails to the greylist?

Here is 2 predicable reasons.

1. IP Misconfiguration

The sending IP address should have a Fully Qualified Domain Name (FQDN). It resolves to that IP, as well as a reverse DNS entry for that IP that resolves to the same FQDN. If this setting is not correct, the ISP will find this misconfiguration. And they will graylist your email or block it altogether.

2. Low Sender Reputation

If you sender server has a low reputation will also affect your email sending. It means when an ISP detects a large number of messages coming from your IP, they’re going to apply rate-limiting and increase greylisting. Because they’re not sure if you’re a legitimate sender.

In Conclusion

Even if greylisting delays emails from reaching the inbox, it does a great job filtering the majority of spam messages. At least, it is better than spam and rejection by the recipient mail server.