Fix Domain or IP Blacklisted on Spamhaus (SBL/XBL/PBL)

What's happening

Spamhaus operates the most influential reputation lists on the internet: SBL (Spamhaus Block List, IP-based for verified spam sources), CSS (Composite Snowshoe, IP-based for snowshoe spam patterns), XBL (Exploits Block List, IP-based for compromised hosts), PBL (Policy Block List, IP-based for end-user IPs that should not send mail directly), and DBL (Domain Block List, domain-based).

A listing on any of these lists triggers immediate delivery failures at most major receivers. Bounce text typically reads 550 5.7.1 Service unavailable; client host blocked using Spamhaus or 554 5.7.1... blocked using zen.spamhaus.org. Microsoft 365 specifically uses Spamhaus zen aggregate as input to its filtering.

Listings vary in remediation difficulty. PBL (residential dynamic IP) is permanent for that IP class — fix is to use a dedicated mail server in business IP space. SBL listings require remediating the cause (open relay, compromised host, listed domain) and submitting a delisting request. XBL listings require cleaning the compromise and submitting a request.

Why it matters

Mail delivery failure to most of the receiving internet. Major receivers using Spamhaus zen reject every message from a listed IP. Recovery during the listing window is impossible — outbound mail bounces.

Reputation damage outlasts the listing. Even after delisting, receivers remember the prior reputation hit. Mail-Tester and Google Postmaster Tools show degraded reputation for weeks.

Customer complaints, missed transactions, lost revenue. For B2C: password resets and order confirmations bounce. For B2B: sales cadences fail to deliver, and prospects' mail security teams flag your domain as untrustworthy.

Common causes

• Compromised host sending spam (XBL listing).
• Open SMTP relay forwarding mail without authentication (SBL listing).
• Marketing send to a purchased list triggering spam-trap hits (SBL or DBL).
• Sending from a residential or dynamic-pool IP (PBL listing — typically not delistable).
• Domain registered for phishing or hosting malware (DBL listing).
• Snowshoe spam pattern across many low-volume IPs in a related range (CSS listing).

Detect this on your site

Run a quick scan with the Email Checker. The tool surfaces this exact issue with the records and context needed to apply the fix below.

How to fix it

1. 1

   Confirm the listing

   Visit check.spamhaus.org and enter your IP and domain. The site shows which lists you are on (SBL, CSS, XBL, PBL, DBL). Each listing has a SBL or DBL reference number — record it. Also check MXToolbox blacklist check for cross-reference with other major lists (Barracuda, Cisco Talos, Composite Blocking List).

2. 2

   Identify and fix the underlying cause

   SBL: review the SBL reference page — it lists the spam sample and the time window. Find that mail in your logs and identify whether it was a compromised account, a list-purchase send, or a misconfigured relay. XBL: scan your servers for malware (rkhunter, chkrootkit), patch, change credentials, audit outbound mail logs. DBL: investigate why your domain was tagged — phishing pages, redirector abuse, malware hosting.

3. 3

   Tighten outbound controls before delisting

   Add SMTP authentication if missing. Limit per-account send volume to detect compromise early. Enable DMARC reporting to catch unauthorized use. Implement complaint feedback loop with major ISPs (Microsoft, Yahoo). Spamhaus delisting requires evidence of cause remediation.

4. 4

   Submit the delisting request

   Visit lookup.spamhaus.org for your IP/domain. Click "Request a delisting". Provide a clear explanation of the cause and your remediation steps. Be specific — generic "we fixed it" responses are denied. Spamhaus reviews manually; turnaround is typically 12-72 hours.

5. 5

   Wait for delisting and verify

   Once approved, the listing is removed within hours. Check check.spamhaus.org again and confirm the IP/domain is clean. Send a Mail-Tester probe and confirm the Spamhaus row reads pass. Repeat for any other lists you appeared on.

6. 6

   Rebuild reputation gradually

   Even after delisting, reputation is degraded. Ramp send volume slowly over 2-4 weeks. Send only to engaged recipients first. Monitor Google Postmaster Tools and Microsoft SNDS for reputation recovery. A re-listing within 30 days is much harder to remove than the first one.

Example

# Check IP against Spamhaus zen aggregate
dig +short 45.113.0.203.zen.spamhaus.org
# 127.0.0.2 = SBL
# 127.0.0.4 = CSS
# 127.0.0.10 / .11 = PBL
# 127.0.0.3 = SBL CSS combined
# 127.0.0.[5-7] = XBL
# (no result) = not listed

# Check domain against Spamhaus DBL
dig +short example.com.dbl.spamhaus.org

DNSBL queries against Spamhaus zen and DBL. Return code interprets the listing type.

Related fixes