Blacklist delisting: what to do when an IP or domain is listed

How a DNSBL works

A DNS-based blocklist is nothing more than a DNS zone. The receiving mail server reverses the IP address of the connecting server, appends the zone of the list and queries for an A record. For the IP 203.0.113.10 the query is 10.113.0.203.zen.spamhaus.org. NXDOMAIN means the IP is not listed. An answer in the 127.0.0.x range means it is listed, and the last octet says why.

At Spamhaus ZEN, 127.0.0.2 means an SBL listing for spam sources, 127.0.0.3 the CSS list for suspicious senders, 127.0.0.4 to 127.0.0.7 the XBL for infected or abused machines, and 127.0.0.10 or 127.0.0.11 the PBL for address ranges from which no direct mail delivery is expected. Domain lists such as Spamhaus DBL and SURBL work the same way, just with the domain name instead of the reversed IP.

$ dig +short 10.113.0.203.zen.spamhaus.org
127.0.0.4

$ dig +short example.com.dbl.spamhaus.org
(no answer: domain not listed)

Which lists matter and which do not

There are dozens of blacklists, and most multi-check tools show all of them. That leads to panic about listings no major receiver evaluates. Only a few matter for deliverability: Spamhaus ZEN with SBL, XBL and PBL is queried by a large share of mail servers worldwide. Spamcop, Barracuda and PSBL are used by many corporate mail servers and appliances. For domains, Spamhaus DBL and SURBL count, and they also check links in the message body.

Largely irrelevant are lists such as UCEPROTECT level 2 and 3, which list entire network blocks or whole provider networks as soon as individual IPs in them misbehave. No major receiver blocks on that basis, and delisting there costs money you should not spend. Google and Microsoft primarily use their own reputation systems rather than public lists; a clean Spamhaus check is no guarantee of delivery there.

• Important: Spamhaus ZEN (SBL, XBL, PBL), Spamcop, Barracuda, PSBL
• Important for domains: Spamhaus DBL, SURBL
• Usually ignore: UCEPROTECT level 2 and 3 and small lists with paid delisting
• Own systems: Microsoft SNDS, Google Postmaster Tools, not DNSBLs

Find the cause first

A delisting without fixing the cause lasts a few hours, because the lists relist automatically. With agency clients the causes are almost always the same: a mailbox with a weak password was taken over and sends thousands of spam messages through the regular server. A contact form on the website without rate limiting or with a forwarding feature is abused as a spam cannon. An outdated CMS plugin executes foreign code that speaks SMTP directly.

Check the mail queue and the server logs for unusual volumes and senders. On shared hosting the listing may also come from a neighbour on the same IP; then only the host can help. An open relay is rare today, but a test takes a minute. A missing PTR record or missing forward-confirmed reverse DNS does not cause a listing, but it worsens the scoring at every receiver.

1. Search the mail server logs and queue of the last days for outliers in volume.
2. Lock suspicious accounts, reset passwords, enforce two-factor authentication.
3. Check web server logs for form spam and suspicious POST requests, update scripts and plugins.
4. Restrict outbound connections on port 25 from the web server to the mail server only.
5. Verify PTR record, HELO name and certificate of the mail server for consistency.

Delisting at the relevant lists

Every list has its own path, and none of the relevant ones charges money. Spamhaus offers an IP lookup on its website that shows the reason and links straight to the delisting form; XBL entries can be removed yourself after cleaning the infection, SBL entries are removed by the Spamhaus team after review. PBL listings concern the address range, not your behaviour; you can have a single IP exempted as a legitimate mail server unless the provider manages the range itself.

Barracuda has a request form that asks for a justification and is usually processed within a day. Spamcop expires on its own: a listing typically ends roughly 24 hours after the last reported spam, and there is no manual delisting. PSBL allows self-removal through its website. At Microsoft you check the status of your IPs in SNDS and file a request through the delist portal for Outlook.com and Microsoft 365. Google Postmaster Tools shows the reputation of your domain and IPs; there is no delisting there, reputation only recovers through clean sending.

Shared hosting, cloud IPs and the PBL

If you send mail directly from a web server at a cloud provider, you often have a PBL listing without ever having sent spam. The PBL is a policy list: providers and Spamhaus enter address ranges that belong to end-user machines or dynamic connections and from which no direct mail delivery is expected. The listing does not say "spammer" but "no mail server should be here".

The solution is rarely delisting but architecture: send transactional mail and form submissions through a mail provider or a dedicated relay service, not directly from the web server. That also solves the problem of neighbours on shared hosting whose behaviour you cannot influence.

Preventing relisting

After delisting the real work begins. Receivers do not forget a bad reputation immediately, and the lists keep watching the IP. Send at reduced volume in the first days, keep bounce and complaint rates low, and make sure SPF, DKIM and DMARC are correct for every sending system so legitimate mail is clearly recognisable as such.

Register the IPs in Microsoft SNDS and the domain in Google Postmaster Tools, because you see reputation drops there earlier than on any blacklist. And create an abuse address that somebody reads: many lists and receivers report problems there before they list.

Monitoring listings

A listing is usually noticed only when a client complains about bounces, and by then hours or days have passed. So check the mail server IPs and the domains of all clients regularly against the relevant lists. It is important to monitor only the lists receivers actually use, otherwise monitoring produces alerts nobody takes seriously.

Monitoring also covers the prerequisites: PTR record, MX reachability, certificates and the authentication records. The MX checker shows you for a domain whether the mail hosts are configured cleanly and whether their IPs appear on the important lists.

Frequently asked questions

How long does delisting take?

At Spamhaus XBL and PSBL minutes to a few hours after self-removal, at Spamhaus SBL and Barracuda usually one to two days after review, at Spamcop about a day without new reports. Microsoft typically takes one to three days. As long as the cause is not fixed, the next listing follows immediately.

Do I have to pay for delisting?

Not at any list that matters for delivery. Spamhaus, Spamcop, Barracuda, PSBL and Microsoft delist for free. Lists that charge for immediate removal are not used by major receivers; ignore them.

My domain is on the DBL but I do not send mail. Why?

The DBL and SURBL rate domains that are linked in spam messages, not just senders. A hacked website hosting phishing pages or redirects is enough for a listing. Clean the website, then request delisting through the Spamhaus lookup page.