Greylisting: why it can delay email

Greylisting can temporarily defer delivery from an unknown source to check that the sending server tries again. That wait can also affect legitimate messages.

The cPanel Greylisting documentation describes the control available for each domain. Timings and exceptions are set by the server administrator in WHM.

It works like this:

1. The first unknown combination of sending IP, sender and recipient receives a temporary error.
2. A correctly configured SMTP server keeps the message and tries again according to its own intervals.
3. If the new attempt matches the expected combination and arrives after the configured minimum period, the system accepts the delivery.
4. The combination stays recognised for the time set by the administrator. These periods are configurable, so you cannot assume they are always 5 minutes or 30 days.

Some software used to send spam does not retry properly, so greylisting cuts down those messages. Other senders do retry and are not blocked by this mechanism.

If messages reach you very late, check whether the deferral really comes from greylisting. The sender's retry intervals can stretch the wait.

Some providers also use several IPs when they retry. Depending on how the receiving server is configured, this can stop the combination from being recognised and increase the delay. A valid SPF policy can help when the system is set up to trust it, but on its own it does not guarantee that greylisting is skipped.

You can review and change the status for each domain in cPanel > Configure Greylisting.

Check the cause before changing it

Open Track Delivery for the sender, recipient and time of the incident. Look for the temporary response and the later retries. A delay caused by quota, connection or a different filter is not fixed by turning greylisting off.

If you decide to turn it off, note the domain and its previous status, save and check a new delivery from one of your own accounts. The change applies to the domain; it does not make the sender immediately retry a message it had already deferred.

For recurring cases, give support the delivery times and responses. Do not add general exceptions to SpamAssassin hoping they will change how greylisting works: they are separate controls.