Blocklists and how to get delisted

A DNS blocklist (DNSBL) publishes addresses and domains that have sent spam, hosted malware or behave like compromised machines. Mail servers query the list for every connection and reject or score accordingly.

How a lookup works

The address is reversed and appended to the list's zone: 4.3.2.1.zen.spamhaus.org. An answer in 127.0.0.x means listed, and the last octet encodes the reason. No answer means clean. Some lists refuse queries from public resolvers, which is why whois.me.uk runs its own resolver for the scan.

Which lists matter

• Spamhaus ZEN and DBL: used by most large receivers. A listing here blocks mail almost everywhere.
• SpamCop: automated, based on user reports; listings expire in about a day.
• Barracuda, PSBL, Mailspike: widely used by appliances and filters.
• UCEPROTECT levels 2 and 3 list whole networks and are treated as noise by most receivers.
• Domain lists (SURBL, URIBL, DBL) match domains found in message bodies, not sending addresses.

Getting delisted

1. Find the cause. Check for a compromised mailbox (sudden outbound volume), a web form or script sending mail, an open relay, or malware. The listing reason code and the list's lookup page usually say what was seen.
2. Fix it and confirm the traffic has stopped.
3. Fix reverse DNS and HELO if they are wrong.
4. Use the delisting link shown on our Reputation facet for each list. Most remove within 24 hours; Spamhaus CSS listings self-expire once the behaviour stops.
5. Add a Watch so a repeat listing alerts you instead of your customers.

Do not request delisting before fixing the cause; repeated re-listings make the next removal harder.