Thank you. These are good points. As for adding an administrative burden, if I understand greylisting correctly, the delay will only be incurred for first-time senders. Once an email is resent within a certain time window, the sender is remembered, and no more delaying takes place for his or her subsequent incoming messages.

As for your second concern, I agree: spammers can work around this easily.

And I have thought of yet another concern: in order to remember those senders who have resent their message within the proper time window, an ever-growing database of addresses needs to be maintained. No entries could ever be removed from this list, if previously encountered senders are to be allowed to avoid the greylisting delay.

Of course, this resource of perpetually increasing size could be avoided if every incoming message is subject to a greylisting delay, but that gets us back to the case where legitimate users are penalized with a delay.

All this is food for thought, and I now want to reflect on this more before jumping into the greylisting world.