Remove an IP from Spamhaus: check the listing, find the list, get delisted
Your IP is listed at Spamhaus, and emails are rejected or land in spam? Spamhaus is the most important blocklist, and almost every listing can be fixed. What matters is which list you're on: the way to removal differs from list to list.
Check the listing: not every message is a listing
The most reliable lookup is the tool at check.spamhaus.org. It shows whether an IP or domain is listed, on which list and why. You can also use Postwacht's blacklist check, which queries Spamhaus and other lists at once.
If you query Spamhaus yourself via DNS, for example with dig or your own script, look closely at the answer:
| Answer | Meaning |
|---|---|
127.0.0.2 to 127.0.0.11 | A real listing. The last number tells you the list: .2 SBL, .3 CSS, .4 to .7 XBL, .10 and .11 PBL. |
127.255.255.252, .254 or .255 | Not a listing. Spamhaus refuses the query, for example because it came through a public resolver such as 8.8.8.8 or 1.1.1.1, or too many queries were made. Query through your own resolver. |
| no answer (NXDOMAIN) | Not listed. |
These false alarms are common: a script reports “listed at Spamhaus” although the resolver was merely blocked.
The Spamhaus lists and what they mean
The often-mentioned list ZEN combines several individual lists:
| List | Meaning | Typical cause |
|---|---|---|
| SBL | Spamhaus-maintained list of known spam sources | Senders with proven unwanted bulk email |
| CSS | Sources with a poor reputation, often many IPs with little mail each | Sending from changing addresses, a suspicious pattern |
| XBL | Infected or abused machines | Malware, a hacked server or account |
| PBL | Addresses from which no direct mail sending is expected | Dynamic IP, home connection, dial-up network |
| DBL | Domains that appear in spam (as sender or link) | A link in the text, a domain used in spam waves |
How to get removed
- Fix the cause. Without that, the listing returns within days, and removal gets harder. Typical causes and solutions are in the article IP or domain on a blacklist.
- Identify the list with the Spamhaus tool. It also says whether you can start the removal yourself.
- Request removal:
- XBL and CSS: usually possible yourself via the tool once the cause is fixed. A CSS listing also expires by itself when the suspicious sending stops.
- PBL: not an accusation, but “no mail server sits here”. If you have a real server with a fixed IP and a matching reverse DNS record, you can have the address removed from the PBL yourself. With dynamic connections, send through your provider's mail server.
- SBL: only through a request to Spamhaus after the cause has been fixed. Describe factually what happened and what you changed.
- DBL: via the form for domains, after you've removed the source (link, redirect, hacked site).
Don't pay anyone for an “instant removal from all lists”. Spamhaus removes listings for free once the cause is fixed. A listing can't be bought off.
After removal
- Run a fresh test to see whether mail arrives. The home page shows all blocklists at a glance.
- Keep your sending calm at first. A sudden wave right after removal quickly leads to the next listing.
- Turn on domain monitoring so you notice a new listing the same day.
Frequently asked questions
How long does removal take?
Self-removal usually takes effect within a few hours. Requests to Spamhaus take longer, depending on the list and on how clearly the cause has been fixed.
My email is still rejected after removal. Why?
The recipient may still be working from a cached copy of the data, or the rejection comes from another list. Check all lists and the error message of the rejection.
My domain is listed, not the IP. What now?
Then the cause lies in content or links, not the server. Look for the domain in emails, forms and redirects, and remove the source before requesting removal.