Skip to main content

Proxy 25

Understanding and Resolving ISP Throttling and Greylisting — Proxy25
ISP Throttling · Greylisting · SMTP · Deliverability · 2026

Understanding and Resolving ISP Throttling and Greylisting

Omar's batch of forty thousand contacts took four days to clear when it should have taken four hours. His authentication was intact. His warmup metrics were clean. His list had been verified. The problem was in two lines of retry logic treating different failure types as identical.

J
Jon
Proxy25
14 min read
2026

Four days to deliver what should have taken four hours

Proxy25 is a verification infrastructure company. We build the IP layer that verification tools run on — addresses with years of SMTP interaction history with major mail servers, so that verification queries get honest responses rather than defensive ones. That is the problem this business was built to solve.

Which is why when Omar called in March, my first instinct was that he had reached the wrong place.

Omar ran email operations at a mid-sized SaaS company. He managed sending infrastructure the way someone manages plumbing — you maintain it, you do not think about it much, and you notice it fast when something goes wrong. He had been doing this long enough that most deliverability problems had a shape he recognized. The March problem did not have a shape he recognized.

He had kicked off a batch of forty thousand contacts on a Tuesday afternoon. New sending domain, six weeks into a warmup, a sequence he had run successfully on smaller cohorts. By Wednesday morning, forty percent of the sends were sitting undelivered — not bounced, not rejected, sitting. The queue was processing. SMTP connections were completing. The server logs were full of 4xx response codes, and the system was retrying them on schedule. Each retry produced the same 4xx. The batch was not moving.

Batch delivery status — 40,000 contacts
Wednesday AM
40%
undelivered · queue stalled
Thursday
22%
undelivered · still retrying
Friday
8%
undelivered · slow progress
Weekend
Cleared
four days later
Expected delivery window: four hours. Actual: four days — caused entirely by a mismatch between the retry behavior the system was running and the retry behavior the throttle type required.

When I pulled his SMTP logs, the problem was in the response codes — specifically in the extended status codes appended to every 4xx response. Two ISPs had been returning a specific class of throttling response since early Tuesday. His system had been treating those responses as generic temporary deferrals and retrying them on a fixed five-minute interval.

The five-minute interval is correct behavior for one kind of 4xx event. It was the wrong behavior for the kind his system had actually encountered. That mismatch — between the retry behavior the system was running and the retry behavior the throttle type required — is why four days happened instead of four hours.


The two systems that both say "try again later" — and mean different things

Omar's retry logic treated every 4xx as the same signal. It is not. When an SMTP connection returns a 4xx response code, it is communicating one thing: this delivery attempt cannot complete right now, try again. What it is not communicating is which of two fundamentally different systems produced that response.

ISP-Level Throttling
A rate management decision
The ISP has evaluated connection volume from the sending IP over a recent window
Rate exceeds what their infrastructure will accept from this origin right now
Not a reputation judgment — a capacity enforcement decision
Throttle lifts when sending rate drops, not when retry timing changes
Fix: reduce connection rate — not change retry interval
Greylisting
A consistency test
Server records the first connection attempt as a triplet: sending IP + sender + recipient
Returns a 4xx and waits
Same triplet retrying after minimum delay window = whitelist
Testing consistency, not volume — spam infrastructure sends once and moves on
Fix: wait minimum delay, retry from same recognized source
Omar's specific mismatch — what cost four days
What he was hitting
421 4.7.0
ISP throttle — requires reduced connection rate
but treating as
What he was responding as if
450 4.7.1
Greylisting — retry same source after five minutes
The result: Five-minute retry interval at the same connection rate → another 421 4.7.x every five minutes → queue stays full → four days of the right answer to the wrong problem.

Why the threshold moves — and why Omar's hit it when it did

ISPs run receiving mail infrastructure for large user populations. That infrastructure has finite processing capacity. When one sending source generates connection volume that consumes a disproportionate share of that capacity, the ISP throttles that source to protect capacity for all other senders.

The throttle ceiling is not fixed. It is a dynamic limit that reflects the ISP's current load, the connection history of the specific sending IP, and how much capacity the ISP is willing to allocate to that source relative to competing demand at that exact moment. An IP with two years of consistent sending to a specific ISP has established an allocation expectation the ISP's system has calibrated against. The same IP sending at three times its historical rate hits the ceiling at a lower absolute volume than it would during low-traffic hours.

Omar had sent to that regional ISP at volumes up to ten thousand messages per day during warmup. The March batch sent twenty-two thousand messages to that ISP's address space in a six-hour window on a Tuesday afternoon. His daily ceiling with that ISP was roughly eight to ten thousand messages. He had sent more than twice that in six hours.

He did not know his ceiling existed. His sending platform showed him overall delivery metrics. It did not show him per-ISP volume breakdown — the number that would have told him, before the send, that the March batch required either a longer delivery window or a split approach pacing volume to each ISP's share of the address list.


Reading extended SMTP status codes

SMTP response codes communicate in two layers. The three-digit code — 421, 450, 452 — indicates the class of failure. The extended status code appended to many responses narrows the failure category enough to distinguish throttle type. Most retry logic evaluates the three-digit code class and applies a uniform retry behavior. The extended code is logged, not acted on.

In Omar's logs, the extended codes were unambiguous:

Code What it actually means Required action
421 4.7.0
421 4.7.1
ISP-level rate policy or connection limit enforcement. Does not mean "retry in five minutes." Means "reduce the rate at which you are connecting to this infrastructure." A five-minute retry at the same rate produces another 421 4.7.x. Batch does not progress.
Reduce rate
450 4.7.1
Most commonly associated with greylisting — server is deferring based on the sender's unrecognized status, not volume rate. This is the code class that five-minute retry intervals are designed for. A correctly timed retry from the right source clears this response.
Interval retry
452 4.2.2
Mailbox storage limit at the recipient level. Not throttling or greylisting. Not a signal about the sender at all. Resolves when the recipient's mailbox has capacity, typically within hours.
Wait hours
421 4.3.2
System-level unavailability at the receiving ISP — not targeted at the sending IP, affecting all inbound connections. Requires a wait of several hours before retry and is unrelated to the sender's connection rate or reputation.
Hold & wait
!

Adding differentiated retry behavior based on the extended status code class requires parsing the extended code from each response and mapping code classes to different behavioral responses. It is a few hours of development work. The extended codes are already in the logs. The logic just needs to read them.


ISP feedback loops — and why warmup metrics can mislead

Omar's domain throttled at a lower ceiling than he expected given his warmup volume. The engagement signal component of ISP feedback loop architecture is part of why.

Most senders understand ISP feedback loops as complaint reporting systems. That is one component. What most senders do not know: major ISPs also aggregate and share engagement signal through FBL infrastructure — open rates, delete-without-open rates, move-to-inbox rates from recipients actively choosing to route mail to inbox — tracked at the IP and domain level and factoring into the ceiling calculations that determine where ISP-level throttles engage.

A sender whose mail is consistently deleted without being opened — not marked as spam, simply ignored at high rates — accumulates negative engagement signal over time. The ISP's capacity allocation for that sender's IP adjusts downward. The sender encounters throttling at volumes that previously processed without friction, without any increase in actual complaint rate, without any change in sending behavior.

Omar's sending domain was six weeks old. Warmup had generated engagement signal from seeded addresses — controlled mailboxes that open and engage with warming mail to establish positive sending history. Real recipients, receiving mail from an unfamiliar domain, engage differently. Delete-without-open rates from real recipients on a new domain run higher than warmup metrics suggest, because warmup metrics measure delivery acceptance and seeded engagement, not the organic engagement quality that FBL systems track.

The regional ISP he hit hardest had six weeks of delivery acceptance and seeded engagement from his domain. When the March batch arrived at more than double the established daily volume, the ISP's throttle calculation reflected the full picture — including the gap between warmup metrics and the engagement signal his domain had actually generated with real recipients.


Two greylisting failure modes — both presenting identically

Omar's issue was ISP throttling. But greylisting failures are the most common thing I see misdiagnosed as IP reputation problems at Proxy25, and it is worth being specific about the two failure modes that produce persistent greylisting outcomes.

🔄
Retry originating from outside the recognized subnet
A server receives a connection from IP 203.0.113.10, returns a 4xx and records the triplet. The retry arrives from 203.0.113.84 — same /24 subnet, which many servers recognize as the same sending source. A retry from 198.51.100.22 — a different /24 entirely — does not match. The server does not associate the retry with the original triplet. The message stays on the greylist until the TTL expires, typically twelve to twenty-four hours.
Fix: maintain connection state across the retry cycle so retries originate from an IP the server recognizes as associated with the original attempt
⏱️
Minimum delay violations
Greylisting servers set their own minimum retry delay — sixty seconds at some, five minutes at others, ten or fifteen minutes at enterprise implementations. A retry that arrives at four minutes will be rejected by a server expecting five. Not because the triplet is unrecognized, but because the minimum delay condition has not been met. The response code is identical to any other temporary failure. The response text typically includes time condition language: "please try again later" or "too early."
Fix: minimum retry delay of 12 minutes for any greylisting-related 4xx — clears the minimum delay window for the significant majority of implementations

The retry architecture that handles both: a minimum retry delay of twelve minutes for any greylisting-related 4xx event, which clears the minimum delay window for the significant majority of greylisting implementations. Exponential backoff on subsequent retries, which distinguishes the retry pattern of legitimate infrastructure from spam infrastructure that retries at fixed short intervals.


How Omar and I cleared the stuck queue

The batch had been in partial-delivery state for two and a half days when Omar reached out. The immediate question was how to get the remaining undelivered messages cleared without making the throttle condition worse.

!

The approach that works for ISP throttling recovery is the one that feels wrong from a throughput perspective: pull back substantially on the connection rate to the throttling ISPs. Most teams' instinct when a batch is stuck is to maintain pressure — keep the retries coming, let the system work through it. For volume throttling, maintained pressure at the triggering rate is what sustains the throttle condition.

1
Drop connection rate to 20% of the throttle-triggering rate
We dropped Omar's connection rate to the two throttling ISPs to twenty percent of the rate that had triggered the throttle. Not pausing — reducing to a rate below their capacity threshold.
0–90 minutes
2
Hold and watch for first 2xx acceptance codes
The 421 4.7.0 responses gradually decreased. The first 250 acceptance codes appeared at the two-hour mark — the ISP's throttle ceiling recalibrating as the incoming connection rate dropped below the enforcement threshold.
90 min–2 hours
3
Increase rate by 15% and hold for 30 minutes
No return to 421 4.7.x. Increased again. We checked acceptance rate at each step before continuing to scale up. Each increment was followed by a thirty-minute observation window before the next.
2–4 hours
4
Back to pre-throttle rate — ISPs accepting without friction
By hour four, the connection rate was back to the pre-throttle level and the ISPs were accepting connections without friction. The remaining undelivered messages in the queue cleared in the following six hours.
4–10 hours total
Before intervention
2.5 days
Retry behavior sustaining throttle condition every five minutes
With correct approach
10 hrs
Rate reduction → 2xx codes appear → scale back up → queue clears

The throttle had been recoverable from the first hour. The retry behavior had prevented the recovery from happening. Four days happened because the system was applying the right fix to the wrong problem, every five minutes, for ninety-six hours.


The volume framework — built before the send, not during recovery

Before the March batch, Omar sized his sends based on total recipient count and overall daily volume targets. He did not think about how the recipient list distributed across ISP address space, and he did not have a per-ISP volume ceiling to work from.

Before any batch exceeding 150% of previous maximum daily volume
MX resolution on the recipient list — identifies which ISP handles each recipient domain. Output: per-ISP count showing how many messages the batch routes to each ISP's address space.
Flag any ISP receiving >150% of established daily ceiling for this sending domain. This is a predictable, specific throttle risk — not theoretical.
Either slice the batch to stay within per-ISP ceiling, or extend the send window so flagged ISP volume distributes over multiple days.
Track per-ISP acceptance rate in 30-minute intervals during any active send. The first 30 minutes of the March batch showed a drop from 94% to 31% on the regional ISP. That signal was there from the start. The monitoring was not structured to surface it.

The MX resolution step takes about twenty minutes on a list of Omar's size. It is the step that would have told him, before Tuesday afternoon, that the March batch was routing twenty-two thousand messages to a regional ISP whose ceiling with his domain was eight to ten thousand per day. That number changes the batch sizing decision before the send — not during a four-day recovery window after it.


Four questions before the next large batch

There is a version of March's problem waiting in every email operation that sizes sends on total recipient count without accounting for per-ISP distribution. The throttle announces itself as a four-day delivery window and a queue that will not clear.

1
What is the per-ISP distribution of this recipient list?
Resolve the MX records for each recipient domain and map the batch to ISP address space before the send starts. Any ISP receiving substantially more than the established daily ceiling from this sending IP is a throttle risk — not a theoretical one, but a specific, predictable one based on the history that ISP has with that sending IP. This step takes twenty minutes. The alternative takes four days.
2
Does the retry logic differentiate by extended status code?
A system retrying 421 4.7.0 on the same interval as 450 4.7.1 is applying greylisting retry behavior to ISP throttle responses. The fix is parsing the extended code class and mapping it to the appropriate behavioral response — rate reduction, interval-based retry, or hold-and-wait — rather than applying a single retry behavior to the full 4xx class. A few hours of development work. The extended codes are already in the logs.
3
Is per-ISP acceptance rate tracked during sends?
Aggregate delivery rate and total queue depth do not surface per-ISP throttle events until the overall numbers have deteriorated significantly. Per-ISP acceptance rate in thirty-minute windows surfaces a throttle event at the ISP level while the overall batch metrics still look manageable, leaving time to respond before the queue becomes the story.
4
How was the warmup engagement quality assessed?
Warmup metrics based on seeded address engagement measure delivery acceptance. FBL engagement signal at major ISPs reflects real recipient behavior — open rates, delete-without-open rates, move-to-inbox actions. A domain whose warmup metrics look clean but whose real-recipient engagement has been low carries a narrower effective ceiling than the warmup metrics imply. Knowing this before a large batch means sizing to the real ceiling rather than the warmup-implied one.

Omar answered none of these before March. He answers all of them now. Four questions before the send. Four days if you skip them.

The same history depth that widens volume ceilings determines response accuracy

Proxy25 provides verification proxy infrastructure with SMTP interaction history built across major ISPs over years of consistent querying — the same history depth that determines volume ceiling width on the sending side determines response accuracy on the verification side.

Start with 500 free credits → No credit card required