Greylisting temporarily rejects mail from unfamiliar senders, exploiting the fact that legitimate mail servers retry while much spam software doesn't — a simple, effective, low-overhead spam reduction technique.
How Greylisting Works
On first contact from an unfamiliar sender/IP combination, the receiving server temporarily rejects the message with a "try again later" response — legitimate mail servers, following standard SMTP retry behavior, try again after a delay and succeed; much spam-sending software doesn't bother retrying, effectively filtering it out.
The Trade-Off: Delivery Delay
Legitimate mail experiences a delay (typically several minutes) on first contact from a new sender — subsequent mail from the same sender delivers normally without delay once the initial retry succeeds; a real but generally acceptable trade-off for the spam reduction benefit.
Installing Postgrey (Postfix Greylisting)
sudo apt install postgrey -yConfiguring Postfix to Use Postgrey
sudo nano /etc/postfix/main.cfsmtpd_recipient_restrictions =
permit_mynetworks,
permit_sasl_authenticated,
reject_unauth_destination,
check_policy_service inet:127.0.0.1:10023Restart Services
sudo systemctl restart postgrey postfixConfiguring the Greylisting Delay
sudo nano /etc/default/postgreyPOSTGREY_OPTS="--delay=300"300 seconds (5 minutes) is a reasonable default — longer delays increase spam filtering effectiveness slightly but also increase legitimate mail delay.
Whitelisting Known-Good Senders (Avoiding Unnecessary Delays)
sudo nano /etc/postgrey/whitelist_clients.localgoogle.com
outlook.comAdd domains/IPs of major, well-known senders you don't want delayed — large legitimate providers with reliable retry behavior generally work fine with greylisting anyway, but whitelisting reduces unnecessary delay for genuinely important, frequent correspondents.
Understanding the Practical Impact
Once a sender/IP combination has successfully retried once, subsequent mail delivers without delay — the delay is genuinely only for the very first contact from any given sender, not a persistent slowdown for regular correspondents.
Combining with Other Anti-Spam Measures
See How to Configure SpamAssassin for Spam Filtering — greylisting is one layer among several; combine with content-based filtering and SPF/DKIM/DMARC validation for comprehensive spam reduction.
Monitoring Greylisting Effectiveness
sudo tail -f /var/log/mail.log | grep postgreyReview logs to understand how much mail is being greylisted and confirm legitimate mail is successfully retrying and delivering as expected.
When Greylisting Might Not Be Appropriate
If you're in a context where any delivery delay is unacceptable (time-critical transactional email, for example), greylisting's inherent delay may not be worth the trade-off — consider whether other spam mitigation techniques might be more appropriate for that specific use case.
Common Errors
Legitimate mail consistently delayed longer than expected — some legitimate senders (particularly those using load-balanced sending infrastructure) may retry from a different IP than the original attempt, effectively resetting the greylist delay each time; whitelisting known problematic senders addresses this.
Continue Reading
- How to Configure SpamAssassin for Spam Filtering
- How to Install and Configure Postfix as a Mail Transfer Agent
- How to Troubleshoot Email Not Sending or Going to Spam
Browse more articles in Email Hosting & Deliverability.
