Greylisting
Greylisting stops much spam sent by tools that never try twice. With it on for one of your domains, the first message from a sender not seen before is answered "try again in a few minutes". Real mail servers try again and their message arrives; the sender is then remembered, so their later mail arrives at once.
It only ever holds mail to your own mailboxes, on the domains you switch it on for. Mail that reaches us through our backup mail server is greylisted the same way.
Switching it on
Tenant owners and admins (and team roles with the Domains part): in the tenant manager at /manage, open Greylisting → Domains and turn it on or off for each domain. It is off unless you switch it on. The same switch is on each domain's page.
The cost: the first message from someone new arrives a few minutes late. Big mail providers that the operator trusts (Gmail, Outlook.com, Yahoo, iCloud and others) are never held.
The report
Greylisting → Report (people with the Mail part) lists every sender greylisting remembers for your mailboxes:
- Sender: the sending server's address, and under it the network it is counted by (its /24, or /64 for IPv6, since big senders retry from another address);
- From → To;
- Tries: deferred / accepted, how many attempts waited and how many were let through;
- When: what comes next for the line (when the hold ends, when a retry is due by, when it passed or when the record expires), with when it was first and last seen under it. Hover over it for every time: first seen, last seen, block expires (a retry is accepted from then), must retry by (a later retry starts over), passed and record expires (when it is forgotten);
- its State: waiting, retry accepted, passed or expired.
The tiles above the table count every line. Filter by address, From or To, or by state; sort with the sort choice or a column heading.
Trusting a sender
If a sender's mail should never wait (a partner, a supplier whose mail is urgent), trust its server:
- In the report, + on its line, then the address alone or its network (/24 or /16; /128 or /64 for IPv6).
- Or under Greylisting → Trusted hosts: enter addresses (
192.0.2.10), networks (198.51.100.0/24) or ranges (192.0.2.0-192.0.2.255), one per line, with a comment. Each can be edited or deleted later. Networks can be no wider than /16 (IPv4) or /32 (IPv6), and a tenant has up to 1,000.
Trusting a host for greylisting only stops greylisting its mail to your mailboxes. Spam filtering and the sender's DMARC policy still apply, so nobody can use a trusted network to pass as someone else. To let a forwarder's mail through DMARC as well, see Trusted forwarders.
Forget this entry (under +) removes a line: that sender's next message waits again.
See also
- Spam and Junk
- Message trace: the greylisting step of each message, and why it was held or let through.