Fixing Google Greylisting: Stop Email Delays and Restore IP Reputation

1. What is Google Grey-Listing

Grey-listing (also known as "tarpitting") is Google's method of slowing down suspicious mail traffic instead of outright blocking it.

When your mail server (Exim/Postfix) connects via port 25:

• Gmail delays the TCP handshake for 20-30 seconds.

• If your server times out (default: 30s), you'll see:

SMTP timeout after initial connection (0 bytes written): Connection timed out

No bounce returned. Mail is deferred and re-queued.

2. Typical Greylisting Triggers

Trigger	Log Indicators
Spam Burst	100k+ identical subjects: A=dovecot_login:user@domain
Compromised Form	Many entries: cwd=/home/user/public_html/contact/
Auth Failures	Spikes in: 535 incorrect password attempts
Header Issues	Missing/broken SPF, DKIM, or DMARC headers

Gmail flags the sending IP, not individual sender domains.

3. How to Confirm Grey-Listing

Manual Test: Banner Delay

time printf 'quit\r\n' | nc -4 gmail-smtp-in.l.google.com 25

• Normal: Under 3s 220 mx.google.com ESMTP

• Grey-listed: Hangs 20-30s, times out

Postmaster Tools

• Visit: postmaster.google.com

• Add your IP, check IP reputation: Bad / Low = greylisted

4. The 5-Step Recovery Plan

Step 1: Stop Spam Immediately

• Suspend spammy scripts/mailboxes

• Purge queue:

exiqgrep -i -f [email protected] | xargs -r exim -Mrm

Step 2: Perfect Your Email Authentication

Record	Good Value
PTR	203.0.113.10 mail.example.com
HELO	primary_hostname = mail.example.com
SPF	v=spf1 ip4:203.0.113.10 a mx -all
DKIM	Valid via WHM or mail-tester.com
DMARC	v=DMARC1; p=none; rua=mailto:[email protected]

Test setup: mail-tester.com

Step 3: Throttle & Warm-Up

Day	Max Gmail Recipients	Notes
1	100	Person-to-person only
2-3	200-300	No attachments > 2MB
4-7	500-1000	Bounce rate < 0.3%

Apply limits:

sender_rate_limit = 300 / 1h
domain_max_defer_failures = 20
smtp_banner_wait_timeout = 60s

Step 4: Monitor Every 6 Hours

watch -n 3600 'time printf "quit\r\n" | nc -4 gmail-smtp-in.l.google.com 25'

Expect banner delay to reduce daily: 20s 12s 5s <3s

Step 5: Return to Normal

Once:

• Banner delay < 3s

• IP reputation Neutral

Reset safeguards:

sender_rate_limit = 0
domain_max_defer_failures = 5
smtp_banner_wait_timeout = 30s

5. Optional: Move SMTP to a Fresh IP

When recovery is slow or SEO is impacted:

1. Add new IP: 198.51.100.25/32 in WHM > IP Functions

2. Set in Exim:

remote_smtp:
 driver = smtp
 interface = 198.51.100.25

1. Update DNS (A record, PTR, SPF)

2. Begin warm-up from scratch

Leave websites on old IP, isolate email traffic.

6. FAQ

Question	Answer
Manual delist available	No, algorithm-based only
Change hostname to fix it	Only helps if PTR/HELO mismatched
Port 587 bypass greylist	No, MX sees source IP
Full recovery time	3-7 days if low volume + clean

7. One-Page Checklist

 Quarantine spam source
 Purge Exim mail queue
 Match PTR HELO A record
 Validate SPF, DKIM, DMARC
 sender_rate_limit = 300/h
 domain_max_defer_failures = 20
 Gmail banner test < 3s
 Postmaster IP rep Neutral

This playbook also helps resolve Yahoo 421 deferrals and Outlook "Server busy" errors.