Spamhaus delisting: each list and its removal path

A bounce that says blocked using zen.spamhaus.org means the receiving server checked your IP against Spamhaus and found it. Spamhaus runs several lists, and the fix depends on which one has you. Some you can clear yourself in ten minutes. One needs a person at Spamhaus to agree with you.

Can I get delisted today? From PBL, XBL and the DBL, usually yes. From CSS, once the traffic has stopped. From the SBL, when Spamhaus decides.

Delisting steps

1. Find which list has you. Look the IP or domain up at check.spamhaus.org, or query from your own resolver as shown below.
2. Fix the cause. For PBL that's a DNS setup. For XBL it's an infected machine. For CSS and SBL it's what you're sending. Removal without the fix gets you relisted.
3. Request removal on the checker page for the listing. PBL, XBL, CSS and DBL are self-service there. SBL removals go through the listing's page as a ticket.
4. Wait. Don't submit again, and don't send from the IP until the removal has gone through. A queue of retries hitting the receiver during the listing extends it.

Return codes

Spamhaus answers a DNS query with an address in the 127 range, and the last number shows which list. Reverse the IP and query the ZEN zone, which combines the IP lists. The domain list is separate.

The TXT query returns a sentence with a link to the listing. The A query returns codes, one line per list that has you:

Answer	List	What it means
127.0.0.2	SBL	Spamhaus staff listed the IP or range as a spam source.
127.0.0.3	CSS	Automated listing for low-reputation sending, usually a single IP.
127.0.0.4	XBL	The IP is compromised: malware, a proxy, or a device that's been hijacked.
127.0.0.10	PBL	Spamhaus marked the range as end-user space that shouldn't send mail directly.
127.0.0.11	PBL	The ISP that owns the range said the same.
127.0.1.2	DBL	The domain is listed as a spam domain. Other 127.0.1.x codes are phishing, malware and abused-but-legitimate variants.

An answer of 127.255.255.254 means you queried through a public resolver such as 8.8.8.8 and Spamhaus refused to answer. It's an error code. Query from your own resolver, or use the web checker.

PBL listings

The Policy Block List covers ranges that were never meant to send mail, and it's the one most people hit on a new server. A PBL listing means the IP range you're in is dynamic or residential space, where mail shouldn't be sent from directly. Nobody is accusing you of spam. Nearly all consumer broadband and a lot of cloud space is in it by default.

Removal is self-service on the checker, for a single IP. Spamhaus asks you to confirm that the IP is static, runs an outbound mail server, has a matching forward and reverse DNS entry, and is assigned to you. Fix the reverse DNS first if it doesn't match, because that's the check people fail. The removal expires after a year, and Spamhaus reverses it at once if it sees spam from the IP.

If your provider doesn't let you set reverse DNS, you're on the wrong provider for a mail server. Relay through a sending service instead and leave the PBL listing where it is.

XBL listings

The Exploits Block List holds IPs that are legitimate but hijacked. Spamhaus saw the IP doing something a mail server doesn't do: running an open proxy, joining a botnet, spraying logins. If it's your office's IP, one machine behind the NAT is compromised. If it's your server, the server is.

Find the machine and clean it before you ask for removal. The removal itself is self-service on the checker and takes effect quickly. If the behavior continues, Spamhaus puts the IP back on and says the problem hasn't been corrected. Listings also expire on their own once the behavior stops.

CSS listings

The CSS is the automated part of the SBL. It lists individual IPs whose recent traffic looked like spam to Spamhaus's systems. That means hitting spam traps, sending in a pattern that matches known spam operations, or sending from a host whose setup looks like a throwaway. The listing is automatic, and nobody at Spamhaus has read your mail.

CSS listings are short and self-expiring. Stop the traffic that caused it, and the listing clears on its own. You can also request removal through the checker. Do it once. The second listing lasts longer, and repeated removals of a still-spamming IP end in the SBL proper. The common legitimate cause is a compromised account on your server sending through an authenticated relay, so check your outbound queue and your authentication logs first.

SBL listings

The Spamhaus Block List is the list people mean when they say Spamhaus. Spamhaus staff make its entries. Each one covers an IP or a whole range and comes with a written case on the listing page, the SBL number in the TXT answer. Reasons run from a spam operation hosted in the range to a hosting provider that ignored abuse reports for too long.

There's no self-service removal. The listing page says what Spamhaus saw and what it wants changed. When you've changed it, you write to Spamhaus through that page, and a person reviews it. If you're on a shared range, the listing is your provider's to clear, and moving to a different provider can be faster. If the listing is escalated, covering a range because the network ignored earlier listings, nothing you do on one IP changes it.

DBL listings

The Domain Block List lists domain names. A domain lands there for appearing in spam, in phishing, or as a redirect used by either, whichever IP the mail came from. A receiver checks the DBL against the sender's domain and against the domains in the message body, so a listed link in a newsletter gets the whole message refused.

Removal is on the checker, by domain. Spamhaus says the DBL is highly automated, most listings expire once the activity stops, and an approved removal takes effect in minutes. If your domain was listed because a page on it was hijacked, take the page down first. The abused-but-legitimate codes exist for exactly that case, and they clear more readily than a plain spam-domain listing.

Before you request removal

Spamhaus makes every removal decision, through its own removal paths. A well-written request makes that decision easy.

Spamhaus never charges for removal. Any site offering paid delisting is trading on the name. If you don't fix the cause, the removal won't last. Spamhaus relists on repeat activity, on every list, and the second listing is longer. Most listings point at a real problem, even when the cause is one compromised mailbox. Find it before you file.

Finding the sender behind a listing

The usual cause of a CSS or SBL listing on a legitimate domain is a sender you didn't know about: a compromised account, a contractor's script, a web form with no rate limit. The listing tells you the IP. The DMARC aggregate reports receivers send list every host that sent as your domain, how much, and whether it passed, which is how you find the ones that aren't yours. Reading a report by hand shows the rows. Our weekly digest reads every report and lists each sender and its result, and on a paid plan we email you the day an unfamiliar one first fails. Your first domain is free.