Email blacklists: how to check, why you got listed and how to get removed

How a DNS blocklist works

A DNSBL publishes its data in DNS, which makes checking it as fast as any other DNS lookup. When a mail server connects to a receiver, the receiver takes the connecting IP address, reverses its four parts, appends the blocklist's zone name and asks for an A record. The convention is described in RFC 5782:

query:   10.2.0.192.zen.spamhaus.org.  A
listed:  127.0.0.2   (an address in 127.0.0.0/8)
clean:   NXDOMAIN    (the name does not exist)

• An answer in 127.0.0.0/8 means the IP is listed. The exact value says which sub-list or reason, and many lists also publish a TXT record at the same name with a short explanation and a link.
• NXDOMAIN - "no such name" - means the IP isn't listed.
• IPv6 addresses work the same way, but the address is written out in full and reversed nibble by nibble (one hex digit at a time).
• Domain blocklists skip the reversal: the receiver looks up the domain itself, such as example.com.dbl.spamhaus.org. They're used for the sender's domain and, more often, for domains in links inside the message.

What happens next is up to the receiver. Some reject the connection outright, with an error such as 554 5.7.1 that names the list; others only add the listing to a spam score. That's why a listing on a small list may do nothing while one on Spamhaus blocks mail almost everywhere.

The lists that matter most

Spamhaus

Spamhaus is the most widely used. Its IP lists are combined into a single zone, ZEN, which is what most receivers query:

Two practical notes. Spamhaus's public lists are free only for low-volume, non-commercial use. And Spamhaus refuses queries that come through large public DNS resolvers: instead of a real answer you get an error code such as 127.255.255.254, which does not mean you're listed. If you test with dig through 8.8.8.8 or 1.1.1.1, results are meaningless - use Spamhaus's web checker instead.

Barracuda, SpamCop and others

• Barracuda Reputation Block List (BRBL), zone b.barracudacentral.org, is used by Barracuda's appliances and by other servers. A bounce that mentions a Barracuda device but not this zone may be one company's own filter rule, which only that company can change.
• SpamCop (bl.spamcop.net) lists IPs reported by its users. Listings expire on their own: an IP is delisted automatically 24 hours after the last report.
• Many other lists exist, and large providers such as Gmail and Microsoft also keep internal reputation systems that aren't public. A listing on an obscure list that no major receiver uses can usually be ignored.

How to check whether you're listed

1. Read the bounce. A rejection caused by a blocklist almost always names it, often with a lookup link. That tells you exactly which list and which IP or domain.
2. Find your sending IP. Open a message you sent in its raw form and look at the Received: header added by the first external server - it shows the IP your mail left from. With a hosted provider, that's the provider's IP, not yours.
3. Use each list's own lookup: the Spamhaus IP and Domain Reputation Checker (check.spamhaus.org), Barracuda Central's lookup page and SpamCop's blocking-list lookup. They show the listing reason and the removal steps.
4. Check your domain too, not only the IP: a domain on the DBL affects every message that mentions it, whatever server it's sent from.

Why IPs and domains get listed

• A compromised account or website. The most common cause today: a stolen mailbox password or a hacked contact form sends thousands of spam messages through your server.
• An infected device behind the IP - the usual reason for an XBL listing, often from an office network where one computer runs malware.
• Spam traps. Lists operate addresses that never subscribed to anything. Mailing them means your list contains bought, scraped or very old addresses.
• Complaints and sudden volume. A large campaign to a cold list from a new IP looks exactly like spam.
• Sending from address space that shouldn't send mail - a home connection or a dynamic range (PBL), or a server without proper reverse DNS.
• An open relay - a misconfigured server that forwards mail for anyone.

How to get delisted

Whatever the list, the order is the same: stop the cause, then ask for removal.

1. Find and stop the source. Change compromised passwords, remove malware, close open relays, pause campaigns to questionable lists. Check your server's mail queue and logs for messages you didn't send.
2. Fix the basics. Reverse DNS on the sending IP, SPF, DKIM and DMARC.
3. Request removal through the list's own process:
   • Spamhaus XBL and CSS: request removal in the reputation checker after fixing the problem; one request covers both lists. If the problem continues, the listing comes back.
   • Spamhaus SBL: only the owner of the IP range (your hosting or network provider) can request removal, by contacting the SBL team once the issue is resolved. An SBL listing must be resolved before XBL or CSS removals are possible.
   • Spamhaus PBL: removal only makes sense for a static IP that really runs a mail server, with proper forward and reverse DNS. For a normal office or home connection, send through your mail provider instead.
   • Barracuda: submit the removal request form with the IP and a short explanation; Barracuda says valid requests are typically processed within 12 hours. Repeated requests are ignored.
   • SpamCop: no request needed - the listing expires 24 hours after the last report.
4. Be wary of paid "delisting services". Spamhaus states that removal from its lists is always free and that anyone offering removal for a fee is running a scam.

Delisting removes the block, not the history. Receivers' own reputation data recovers more slowly, so ramp volume back up gradually, as described in the warm-up guide.

Shared IP addresses

Most hosted mail services and email platforms send mail for many customers from the same pool of IP addresses. That cuts both ways. As Google's sender guidelines put it, the activity of every sender on a shared IP affects the reputation of all of them: one customer sending spam can get the address listed, and the listing then affects everyone. On the other hand, you can't request delisting for an IP you don't control, and you don't have to - it's the provider's job, and a well-run provider stops abusive senders before lists notice. If your provider's IP is listed, report it to them with the bounce text. A listing of your domain on the DBL, however, follows you to any provider.

How AnyMail protects its shared sending IP

AnyMail sends mail for its customers from a shared IP with matching forward and reverse DNS, so the guardrails are built in: every outgoing message is scored for spam, high-confidence spam is held for review instead of delivered, senders who repeatedly trip the filter lose the ability to send until an administrator clears them, and each mail server has an hourly sending cap that starts lower and rises over its first two weeks. Combined with one-click unsubscribe on every external message, that keeps the complaints and spam-trap hits that lead to listings away from the address everyone shares. For the content side, see the guide to why mail goes to spam.