IP or domain on a blacklist? How to find the cause and get delisted
If your mail server's IP or your domain is on a blocklist (blacklist), your emails land in spam or are rejected. The good news: most listings can be fixed. The right order is important – first remove the cause, then request removal.
What blocklists are
Blocklists (also called DNSBL or RBL) are directories of IP addresses and domains that send spam. Mail servers query them via DNS for every incoming email. There are two kinds:
- IP lists contain server addresses, e.g. Spamhaus ZEN, Barracuda or SpamCop.
- Domain lists contain domains that appear in spam – as the sender or as a link in the body, e.g. Spamhaus DBL, SURBL or URIBL.
Not every list carries the same weight. Spamhaus is used by a great many mail servers, and a listing there has noticeable consequences. Small lists are often only used for scoring.
How to recognize a listing
- Emails bounce with an error message containing the name of a list, such as
554 … listed at zen.spamhaus.org. - Emails to certain providers suddenly land in spam without you having changed anything.
- A test shows a hit. Postwacht queries eight IP lists and three domain lists in every test.
Find the cause first
A list doesn't add you for no reason. If you request removal without fixing the cause, you'll be listed again within days – and get less leniency next time. The most common causes:
| Cause | Typical sign | Solution |
|---|---|---|
| Hacked mailbox | Suddenly thousands of emails from one account, often at night | Change the password, end sessions, enable 2FA, clear the queue |
| Abused contact form | Many confirmation emails to unknown addresses | Add bot protection, don't send a copy to the entered address |
| Malware on the network | Listing on lists for infected computers (e.g. Spamhaus XBL) | Find and clean the computer, allow outbound port 25 only for the mail server |
| Open relay | Server accepts mail for external domains from anyone | Restrict relaying to authenticated users |
| Purchased or old address lists | Many bounces, spam traps hit | Only work with confirmed addresses (double opt-in), remove inactive recipients |
| IP from a dial-up network | Listing on a policy list (e.g. Spamhaus PBL) | Send via a real mail server or your provider's server |
The most important lists and their rules
| List | How to get removed |
|---|---|
| Spamhaus (SBL, XBL, CSS, DBL) | Via the lookup tool at check.spamhaus.org, which also shows the reason for the listing. After fixing the issue, you can usually remove XBL and CSS listings yourself. |
| Spamhaus PBL | Not an accusation of spam, but “no mail server should send directly from this IP”. For real servers with a fixed IP and clean reverse DNS, you can remove the listing yourself. |
| Barracuda | Removal via the form at barracudacentral.org, usually within 12 to 24 hours. |
| SpamCop | Expires by itself after about 24 hours if no new complaints arrive. |
| UCEPROTECT level 1 | Expires by itself after about a week without new hits. There's no reason to pay for express removal. Levels 2 and 3 cover entire networks and are hardly used by large providers. |
| Microsoft (Outlook.com) | No public list. For rejections, Microsoft's delisting form for senders helps, plus the SNDS program to monitor your IPs. |
Beware of offers to remove you “from all lists immediately” for money. Reputable lists remove you free of charge once the cause has been fixed. Nobody can buy their way off Spamhaus.
How to stay off them in the first place
- Set up SPF, DKIM and DMARC properly – so nobody can credibly send in your name (guide).
- Set a proper reverse DNS record.
- Limit outgoing email: a limit per mailbox and hour slows down a hacked account before it does damage.
- Only send newsletters to confirmed recipients and remove hard bounces immediately.
- Test regularly: that way you notice a listing before recipients complain.
With the test on the home page you'll see in under a minute whether your server IP or a domain from your email is on one of the important lists.