Skip to content
Spaw
Get your API key

Greylisting

published · September 10, 2026

Greylisting is a mail server's habit of refusing an unfamiliar sender's first delivery attempt with a temporary error and accepting the retry.

Greylisting is a mail server's habit of refusing an unfamiliar sender's first delivery attempt with a temporary error — a 4xx — and accepting the retry a few minutes later. It is a cheap spam defence: real mail servers retry, and much bulk-sending software does not.

What Spaw answers

A greylisted handshake ends without an answer about the mailbox. smtp_checked is true, mailbox_exists stays null, and smtp_reason is greylisted. The verdict then rests on the free signals alone, which usually means risky with the reason unverified and +10 on the risk score.

Why it is not free

Greylisting is the server's answer, not a failure of ours. The lookup ran, every DNS and list check was performed, and the response is a complete one that happens to leave one field null — so it costs a credit like any other answered lookup. The exception, and the only one, is an outage in the partner infrastructure behind the handshake: that answers provider_unavailable and is not billed, because nothing was established.

Retrying immediately rarely helps. The same address checked again after the greylisting window has passed will often settle, and a repeat inside seven days is free.

Related

markdown version: /glossary/greylisting.md

Verify addresses the same way

The Spaw API runs every check described here on each lookup, with an SMTP handshake that never sends mail. 10 free lookups a month, no card required.

Get your API key

More glossary

  • ASN

    An Autonomous System Number identifies one network that announces its own routes to the internet under a single routing policy.

  • Address register

    An address register is a country's official file of every address its authorities recognise, usually keyed on buildings rather than letterboxes.

  • CIDR

    CIDR notation writes a range of IP addresses as one address and a prefix length, so 203.0.113.0/24 means the 256 addresses sharing those first 24 bits.

  • Catch-all domain

    A catch-all domain is one whose mail server accepts mail addressed to every recipient, whether or not that mailbox exists.

  • Check digit

    A check digit is a digit computed from the rest of an identifier so that a mistyped one usually fails arithmetic before anybody looks it up.

  • Company number

    A company number is the identifier a national registrar assigns to an incorporated company, unique within that register and never within the world.

  • Credit

    A credit is the billing unit of the whole API: one credit buys one fresh lookup that produced a usable answer, on any of the six signals.

  • Datacenter IP

    A datacenter IP is an address inside a range operated by a hosting, cloud or server provider rather than by a consumer access network.