Barracuda delisting: the IP list and its removal form

A Barracuda listing looks like this in a bounce. The receiver runs a Barracuda spam appliance or queries Barracuda's list, and the IP your mail came from is on it:

The link in the bounce goes to the lookup for that IP. The removal is a form, it's free, and Barracuda processes most requests within half a day. Barracuda ignores a second request for the same IP, so get the first one right.

Is it my domain or my IP? The IP. Barracuda's list is IP-based. Where Spamhaus can list a domain, Barracuda lists the server the mail came from.

Delisting steps

1. Confirm the listing. Look the IP up on Barracuda Central's lookup page, or query the list from a shell as shown below.
2. Find what got the IP listed and stop it. Look for a compromised mailbox, a script, or a list with dead addresses on it. The form asks you to explain, and Barracuda disregards a request with no real explanation.
3. File the removal request once, with the IP, a working email address, a phone number, and what you fixed.
4. Wait up to 12 hours. Don't file again. Barracuda says multiple requests are ignored.

Lookup from a shell

Barracuda publishes the list as a DNS zone. Reverse the IP and query it:

An answer of 127.0.0.2 means listed. No answer means not listed. Unlike Spamhaus, Barracuda answers through public resolvers, so this works from anywhere.

Check the right IP. If you send through Google Workspace, Microsoft 365, or a sending service, the IP in the bounce belongs to them and the listing is theirs to clear. If you run your own server, it's the address the server connects out from, which behind a NAT is the office's public address rather than the server's own.

How an IP gets on the list

Barracuda calls it the Barracuda Reputation Block List, and the listings come from spam traps and from Barracuda's own appliances. Spam traps are addresses that never belonged to anyone and never signed up for anything, so any mail to them is unsolicited by definition. The appliances sit in front of many company mail servers and report what they see. Hit the traps, or get flagged by enough appliances, and the IP goes on.

The usual causes on a legitimate server are an old mailing list whose addresses have since become traps, or a contact form that sends confirmations to any address typed into it. A user whose password leaked, and whose account sent a few thousand messages overnight, is another. Look at your outbound log for the day before the bounces started and find the spike.

The removal request

The form asks for the server's IP, your email address, your phone number, and the reason for removal. The customer fields are for Barracuda's own customers and you can leave them blank. The reason is the part that matters. Say what the IP is, what caused the listing, and what you changed, in a few sentences.

A reason that works: "This is the outbound mail server for example.com. A compromised user account sent spam between the 3rd and the 4th. We reset the password and flushed the queue, and outbound is back to its normal volume." A reason that doesn't: "Please remove our IP, we don't send spam." Barracuda says requests without valid information are disregarded, and the second reason is one of those.

After the request

Barracuda says removals are typically processed within 12 hours when the explanation is valid. You get no confirmation you can rely on, so check the list again the next morning with the same query. If the IP is still listed after a day, the request wasn't accepted, and filing again won't help. Look harder for the cause and wait for the listing to age before you file a better request.

Don't keep sending to the recipients that bounced while you wait. Each attempt is another connection from a listed IP to a Barracuda appliance, which is more evidence for the listing.

Receivers that use Barracuda

The big consumer mailboxes don't consult Barracuda, so a listing doesn't affect your mail at Gmail, Outlook.com or Yahoo. It affects mail to organizations that bought a Barracuda appliance, which is a lot of mid-sized companies, schools and hospitals. It also affects any server whose admin added the zone to their filter. The bounces show you who's affected.

Finding the sender behind a listing

The listing gives you the IP. If that IP is a server you run, the outbound log has the rest. If it's a service you send through, the DMARC aggregate reports that receivers send list every host that sent as your domain that day, and how much. That's how you spot the account or tool that spiked. Reading a report by hand shows the rows. Our weekly digest reads every report and lists each sender with its volume and result, and on a paid plan we email you the day an unfamiliar sender first fails. Your first domain is free.