In short
Greylisting temporarily rejects the first message from an unknown sender. A real mail server retries a few minutes later and gets in; many spam bots never retry. In cPanel it is enabled in WHM › Email › Greylisting. It works best with the big providers on the trusted list and a short initial delay, because its cost is that the first message from each new sender arrives a few minutes late.
How greylisting works
Every time a message arrives, the server looks at three things: the connecting IP, the sender and the recipient. If that combination is new, it answers with a temporary error (code 451, "try again later") and records it.
- First attempt: unknown combination. Exim answers "451 temporarily rejected".
- Retry: the sender's server tries again after the initial delay. The combination is already recorded, so it is accepted.
- Later messages: the combination stays accepted for days, so there are no more delays with that sender.
Spam programs that send millions of messages from infected machines usually don't keep a retry queue. That is why greylisting stops a large share of spam without analyzing content.
How to enable it in WHM
- Go to WHM › Email › Greylisting.
- Turn the service on with the switch at the top.
- Review the settings using the table in the next section.
- Under Common Mail Providers, trust the big providers and enable automatic updates for them.
- Under Trusted Hosts, add your own servers and those of providers or systems that can't wait.
If you run an external antispam or an inbound relay in front of the server, add its IPs to Trusted Hosts. Otherwise greylisting would see every connection as coming from the same place.
Which values to use
| Option | What it controls | Recommended value |
|---|---|---|
| Initial deferral period | How long a new combination is rejected | 1 to 5 minutes |
| Resend acceptance period | The window in which the sender must retry to be accepted | 240 minutes (4 hours) or more |
| Record expiration | How long an accepted combination lasts without new mail | 3 to 7 days or more |
| Automatically trust IP addresses with valid SPF records | Skips greylisting for senders whose SPF authorizes that IP | On, if your customers can't tolerate delays |
A 1-minute initial delay stops nearly as much as a 15-minute one, because bots never come back. What does change is how long a legitimate customer waits, since every server retries on its own schedule, which can be 5, 15 or 30 minutes.
Typical problems and how to avoid them
| Symptom | Cause | Fix |
|---|---|---|
| Verification codes and password reset links arrive late | Platforms that send from many different IPs, and each new IP waits again | Enable SPF-based trust or add their ranges to Trusted Hosts |
| A supplier says their mail "bounces" | Their server doesn't retry, or takes hours | Add their IP to Trusted Hosts and ask them to check their queue |
| Gmail or Microsoft mail is slow to arrive | Big providers not trusted | Enable Common Mail Providers and their automatic updates |
| Delays look random | The same sender uses several IPs in one range | Raise the acceptance window and trust the known providers |
To see whether greylisting held a specific message, search for the address in the Exim log. Temporary rejections show up as "temporarily rejected", followed by the delivery once the sender retries:
# Today's temporary rejections (greylisting included)
grep "$(date +%F)" /var/log/exim_mainlog | grep -ci "temporarily rejected"
# Check whether a sender was held and when it retried
grep "sender@example.com" /var/log/exim_mainlog | grep -i "temporarily rejected\|<="When it helps and when it doesn't
- It helps on servers that receive a lot of botnet spam, with customers who can tolerate a few minutes of delay from new senders.
- It helps less on servers for shops or platforms that depend on verification codes, payment confirmations or alerts that must arrive instantly.
- It doesn't replace RBLs or SpamAssassin: it is one more layer. Together the three make up cPanel's basic antispam, described in Exim antispam settings in WHM.
- It doesn't stop targeted phishing, which is sent from real servers that retry, often from compromised Microsoft 365 or Gmail accounts. We explain this in cPanel antispam.
Frequently asked questions
Does greylisting cause lost email?
No, if the sender uses a real mail server: it retries and the message arrives a few minutes late. Only mail from systems that never retry is lost, and those are mostly spam programs.
Where is greylisting in cPanel?
The server administrator configures it in WHM › Email › Greylisting. cPanel users can't turn it on or off for their own account.
Does greylisting delay Gmail messages?
Not if the big providers are on the trusted list (Common Mail Providers). That is why you should enable that option and its automatic updates.
How much spam does greylisting stop?
It depends on the server, but it mainly stops botnet spam, which is a large part of the volume. It doesn't stop spam sent from real servers or targeted phishing.
Antispam and antiphishing for your whole cPanel server
Greylisting stops bots. Clisec analyzes the mail that does retry, including phishing sent from real compromised accounts, across every account on your cPanel server.