Guides

Barracuda delisting: check the IP, fix the cause, file once

Last updated 2026-09-09

A Barracuda listing looks like this in a bounce. The receiver runs a Barracuda spam appliance or queries Barracuda's list, and the IP your mail came from is on it:

The link in the bounce goes to the lookup for that IP. The removal is a form, it's free, and Barracuda processes most requests within half a day. They process each IP once, so the request has to be right.

Is it my domain or my IP? The IP. Barracuda's list is IP-based. Where Spamhaus can list a domain, Barracuda lists the server the mail came from.

Delisting in four steps

1. Confirm the listing. Look the IP up on Barracuda Central's lookup page, or query the list from a shell as shown below.
2. Find what got the IP listed and stop it. A compromised mailbox, a script, a list with dead addresses on it. The form asks you to explain, and a request with no real explanation is disregarded.
3. File the removal request once, with the IP, a working email address, a phone number, and what you fixed.
4. Wait up to 12 hours. Don't file again. Barracuda says multiple requests are ignored.

Check the list from a shell

Barracuda publishes the list as a DNS zone. Reverse the IP and query it:

An answer of 127.0.0.2 means listed. No answer means not listed. Unlike Spamhaus, Barracuda answers through public resolvers, so this works from anywhere.

Check the right IP. If you send through Google Workspace, Microsoft 365, or a sending service, the IP in the bounce belongs to them and the listing is theirs to clear. If you run your own server, it's the address the server connects out from, which behind a NAT is the office's public address rather than the server's own.

How an IP gets on the list

Barracuda calls it the Barracuda Reputation Block List, and the reputation comes from two sources. One is spam traps, addresses that never belonged to anyone and never signed up for anything, so any mail to them is unsolicited by definition. The other is Barracuda's own appliances, which sit in front of many company mail servers and report what they see. Hit the traps, or get flagged by enough appliances, and the IP goes on.

That's why the common causes on a legitimate server are the ordinary ones. An old mailing list with addresses that have since been turned into traps. A contact form sending confirmations to whatever address was typed. A user whose password leaked, whose account sent a few thousand messages overnight. Look at your outbound log for the day before the bounces started and find the spike.

Write the removal request

The form asks for the server's IP, your email address, your phone number, and the reason for removal. The customer fields are for Barracuda's own customers and you can leave them blank. The reason is the part that matters. Say what the IP is, what caused the listing, and what you changed, in a few sentences.

A version that works: this is the outbound mail server for example.com, a compromised user account sent spam between the 3rd and the 4th, the password was reset and the queue flushed, and outbound is back to its normal volume. A version that doesn't: please remove our IP, we don't send spam. Barracuda says requests without valid information are disregarded, and the second kind is what that means.

After the request

Barracuda says removals are typically processed within 12 hours when the explanation is valid. You get no confirmation you can rely on, so check the list again the next morning with the same query. If the IP is still listed after a day, the request wasn't accepted, and filing again won't help. Look harder for the cause, wait for the listing to age, and the next request is the one to get right.

Don't keep sending to the recipients that bounced while you wait. Each attempt is another connection from a listed IP to a Barracuda appliance, which is more evidence for the listing.

Whose problem a Barracuda listing is

Not everyone's. The big consumer mailboxes don't consult Barracuda, so a listing costs you nothing at Gmail, Outlook.com or Yahoo. It costs you the organisations that bought a Barracuda appliance, which is a lot of mid-sized companies, schools and hospitals, and any server whose admin added the zone to their filter. The bounces are the map of who's affected.

Find what sent the mail

The listing gives you the IP. If that IP is a server you run, the outbound log has the rest. If it's a service you send through, the DMARC aggregate reports receivers send list every host that sent as your domain that day and how much, which is how you spot the account or tool that spiked. Reading a report by hand shows the rows. Our weekly digest reads every report and lists each sender with its volume and result, and on a paid plan we email you the day an unfamiliar sender first fails. Your first domain is free.

DomainCanary is a DMARC monitoring service that turns your domain's aggregate reports into one weekly email.