For years, greylisting was one of the most useful tools a mail admin had. Then sign-in codes became standard, more email became time-sensitive and spammers learned to retry. Here's what changed, and what we use instead.
Why greylisting worked
The idea was simple. When a message arrives from a sender your server hasn't seen before, refuse it for now and ask the sender to try again later. Real mail servers retry after a delay. Spam software, built to send as much as possible, usually didn't bother.
For a long time that one rule stopped a large share of spam without reading a single message.
Sign-in codes can't wait
Multi-factor sign-in is everywhere now. When someone asks for a code, they need it in seconds. A five-minute greylist delay on a code that expires in ten means people get locked out, help desk tickets pile up, and admins end up allowing the very senders greylisting was supposed to check.
More email is time-sensitive
Password resets, order confirmations, shipping notices, appointment reminders and verification links often expire quickly. Greylisting treats every unknown sender the same, so mail from a service someone signed up for a minute ago is delayed at the exact moment they're waiting for it.
Spammers learned to retry
Greylisting depended on spam software giving up. Today's spam often goes out through properly configured mail servers that retry like any other. The retry test no longer separates spam from real mail.
Large senders rotate IP addresses
Big email providers send from large pools of IP addresses. A greylisted message is often retried from a different address, which the greylist treats as a brand new sender. The message waits again, or gets lost.
What to use instead
No single trick fills the gap greylisting leaves. What works is checking each message as it arrives, quickly enough that nothing waits.
SpamFoo does this as each message arrives. When a new sender shows up, it doesn't stall the message. It checks the sender's SPF, DKIM and DMARC results and the reputation of the sending domain and IP address, then reads the message for what it's asking the reader to do. Real mail goes straight through, and spam is caught without making anyone wait.
Stop delaying the mail people are waiting for
SpamFoo checks every message as it arrives, with no greylist delay.
Source: M. Kucherawy and D. Crocker, "Email Greylisting: An Applicability Statement for SMTP," RFC 6647, Internet Engineering Task Force (IETF), June 2012.