Guides

Spamhaus delisting: find the list, fix the cause, ask once

Last updated 2026-09-09

A bounce that says blocked using zen.spamhaus.org means the receiving server checked your IP against Spamhaus and found it. Spamhaus runs several lists, and which one has you decides the fix. Some you can clear yourself in ten minutes. One needs a person at Spamhaus to agree with you.

Can I get delisted today? From PBL, XBL and the DBL, usually yes. From CSS, once the traffic has stopped. From the SBL, when Spamhaus decides.

Delisting in four steps

1. Find which list has you. Look the IP or domain up at check.spamhaus.org, or query from your own resolver as shown below.
2. Fix the cause. For PBL that's a DNS setup. For XBL it's an infected machine. For CSS and SBL it's what you're sending. Removal without the fix gets you relisted.
3. Request removal on the checker page for the listing. PBL, XBL, CSS and DBL are self-service there. SBL removals go through the listing's page as a ticket.
4. Wait. Don't submit again, and don't send from the IP until the removal has gone through. A queue of retries hitting the receiver during the listing extends it.

Read the return code

Spamhaus answers a DNS query with an address in the 127 range, and the last number says which list. Reverse the IP and query the ZEN zone, which combines the IP lists. The domain list is separate.

The TXT query returns a sentence with a link to the listing. The A query returns codes, one line per list that has you:

Answer	List	What it means
127.0.0.2	SBL	Spamhaus staff listed the IP or range as a spam source.
127.0.0.3	CSS	Automated listing for low-reputation sending, usually a single IP.
127.0.0.4	XBL	The IP is compromised: malware, a proxy, or a device that's been hijacked.
127.0.0.10	PBL	Spamhaus marked the range as end-user space that shouldn't send mail directly.
127.0.0.11	PBL	The ISP that owns the range said the same.
127.0.1.2	DBL	The domain is listed as a spam domain. Other 127.0.1.x codes are phishing, malware and abused-but-legitimate variants.

An answer of 127.255.255.254 isn't a listing. It means you queried through a public resolver such as 8.8.8.8 and Spamhaus refused to answer. Query from your own resolver, or use the web checker.

PBL: the range was never meant to send mail

The Policy Block List is the one most people hit on a new server. A PBL listing means the IP range you're in is dynamic or residential space, where mail shouldn't be sent from directly. Nobody is accusing you of spam. Nearly all consumer broadband and a lot of cloud space is in it by default.

Removal is self-service on the checker, for a single IP, and Spamhaus asks you to confirm four things: the IP is static, it runs an outbound mail server, it has a matching forward and reverse DNS entry, and it's assigned to you. Fix the reverse DNS first if it doesn't match, because that's the check people fail. The removal expires after a year and is reversed at once if spam is seen from the IP.

If your provider doesn't let you set reverse DNS, you're on the wrong provider for a mail server. Relay through a sending service instead and leave the PBL listing where it is.

XBL: something on that IP is infected

The Exploits Block List holds IPs that are legitimate but hijacked. Spamhaus saw the IP doing something a mail server doesn't do: running an open proxy, joining a botnet, spraying logins. If it's your office's IP, one machine behind the NAT is compromised. If it's your server, the server is.

Find the machine and clean it before you ask for removal. The removal itself is self-service on the checker and takes effect quickly. If the behaviour continues, the IP goes back on, and Spamhaus says why in as many words: the problem hasn't been corrected. Listings also expire on their own once the behaviour stops.

CSS: your sending looked like spam, automatically

The CSS is the automated part of the SBL. It lists individual IPs whose recent traffic looked like spam to Spamhaus's systems: hitting spam traps, sending in a pattern that matches known spam operations, or sending from a host whose setup looks like a throwaway. No person listed you. Nobody at Spamhaus has read your mail.

CSS listings are short and self-expiring. Stop the traffic that caused it, and the listing clears on its own. Removal through the checker is available. Use it once. The second listing lasts longer, and repeated removals of a still-spamming IP end in the SBL proper. The common legitimate cause is a compromised account on your server sending through an authenticated relay, which is why the first thing to check is your outbound queue and your authentication logs.

SBL: a person at Spamhaus decided

The Spamhaus Block List is the list people mean when they say Spamhaus. Its entries are made by staff, cover an IP or a whole range, and come with a written case on the listing page, the SBL number in the TXT answer. Reasons run from a spam operation hosted in the range to a hosting provider that ignored abuse reports for too long.

There's no self-service removal. The listing page says what Spamhaus saw and what it wants changed. When you've changed it, you write to Spamhaus through that page, and a person reviews it. If you're on a shared range, the listing is your provider's to clear and the fastest fix may be a different provider. If the listing is escalated, covering a range because the network ignored earlier listings, nothing you do on one IP changes it.

DBL: the domain, not the IP

The Domain Block List works on names. A domain lands there for appearing in spam, in phishing, or as a redirect used by either, whichever IP the mail came from. A receiver checks the DBL against the sender's domain and against the domains in the message body, so a listed link in a newsletter gets the whole message refused.

Removal is on the checker, by domain. Spamhaus says the DBL is highly automated, most listings expire once the activity stops, and an approved removal takes effect in minutes. If your domain was listed because a page on it was hijacked, take the page down first. The abused-but-legitimate codes exist for exactly that case, and they clear more readily than a plain spam-domain listing.

Delisting is Spamhaus's call

Nothing on this page makes Spamhaus remove a listing. The removal paths are theirs, the decisions are theirs, and the most a well-written request does is make the decision easy. Three things before you file.

Spamhaus never charges for removal. Any site offering paid delisting is trading on the name. A removal without a fix is a short removal. Every list relists on repeat activity, and the second listing is longer. And a listing is about a real problem in the great majority of cases, even when the problem is one compromised mailbox rather than you. Find it.

After delisting: find what got you listed

The usual cause of a CSS or SBL listing on a legitimate domain is a sender you didn't know about: a compromised account, a contractor's script, a web form with no rate limit. The listing tells you the IP. The DMARC aggregate reports receivers send list every host that sent as your domain, how much, and whether it passed, which is how you find the ones that aren't yours. Reading a report by hand shows the rows. Our weekly digest reads every report and lists each sender and its result, and on a paid plan we email you the day an unfamiliar one first fails. Your first domain is free.

DomainCanary is a DMARC monitoring service that turns your domain's aggregate reports into one weekly email.