Docs/Security Features/Greylisting

Greylisting

Temporarily defer emails from unknown senders to reduce spam.

How Greylisting Works

Greylisting is an anti-spam technique that temporarily rejects emails from unknown sender/recipient/IP combinations. The key insight is that legitimate mail servers will retry delivery, while most spam bots won't.

  1. First email from unknown triplet → DEFER (450 temporary rejection)
  2. Sender retries after delay → Email accepted, triplet whitelisted
  3. Future emails from same triplet → Immediately accepted

Enable Greylisting

In the dashboard, go to Settings → Greylisting and toggle "Enable Greylisting".

Configuration Options

  • Initial Delay: How long senders must wait before retrying (default: 5 minutes)
  • Whitelist Duration: How long to remember accepted triplets (default: 30 days)
  • Apply to Inbound Only: Skip greylisting for authenticated users
Recommendation

Start with a 5-minute delay. This catches most spam bots while minimizing delays for legitimate email.

Whitelist Domains

Some senders shouldn't be greylisted (e.g., important partners, mailing lists). Add them to the whitelist:

  1. Go to Greylisting → Whitelist
  2. Add domain or email address
  3. These senders will bypass greylisting

View Greylist Entries

The dashboard shows all current greylist entries under Greylisting → Current Entries. You can:

  • See pending (waiting to retry) and passed (whitelisted) entries
  • Manually whitelist an entry
  • Delete entries to force re-greylisting

Effectiveness

Greylisting typically blocks 80-90% of spam with minimal impact on legitimate email. It's most effective when combined with RBL checking.

Note

Greylisting causes a delay for the first email from each new sender. If time-sensitive emails are a concern, whitelist known important senders.

Troubleshooting

Email Delayed Too Long

  • Check if the sender's mail server has slow retry settings
  • Reduce the initial delay setting
  • Whitelist the sender domain

Spam Still Getting Through

  • Some sophisticated spam bots do retry - combine with RBL checking
  • Consider increasing the initial delay
  • Review and tighten other policies