This can be particularly fun if the sender uses Amazon SES for example, because Amazon randomly rotates through its mail servers on each retry attempt, so a sim

This can be particularly fun if the sender uses Amazon SES for example, because Amazon randomly rotates through its mail servers on each retry attempt, so a simple greylisting implementation (based on exactly matching the full IP) delays the mail by not just one, but possibly multiple retry intervals until by chance Amazon happens to use to original server again. So you either need to whitelist Amazon SES (and possibly a few other providers behaving similarly), or use a greylisting implementation which doesn't match the full IP (I think Mailcow by default e.g. uses /19 for matching IPv4 addresses). A previous mail hoster of mine did the former, i.e. Greylisting based on the full IP, and what was even worse, their support staff totally denied any knowledge of it and tried to claim it wasn't their fault that any e-mails from Amazon (Amazon itself and anything using SES) would arrive with random amounts of large delay.