Email blocklist · The UCEPROTECT-Network
Email backscatter: what it is, and how to get off Backscatterer.org
By Samuel Chenard · CEO & Co-Founder, Palisade · Reviewed July 19, 2026
Backscatter is misdirected bounce mail: your server accepts a message, then sends a non-delivery report to a forged sender who never wrote to you. Backscatterer.org (ips.backscatterer.org, run by the UCEPROTECT-Network) lists IPs that do this for four weeks. The fix is to reject invalid recipients during the SMTP session, not bounce them afterward.
| Backscatterer.org at a glance | |
|---|---|
| Operator | The UCEPROTECT-Network |
| Type | IP blocklist (DNSBL) |
| IP lookup zone | ips.backscatterer.org |
| Query method | A-record DNSBL. Backscatterer asks receivers to query it only in safe mode: run the lookup when MAIL FROM is <> (a bounce) or postmaster, so it screens null-sender traffic rather than normal mail. |
| Who uses it | A far smaller set of receivers than Spamhaus, and by design only against bounce and null-sender traffic. A listing mostly affects the misdirected bounces, auto-replies, and verification probes your server sends to the receivers that query it, not your everyday outbound. |
| Reach | Low to moderate, and narrow. Used as intended (safe mode, null-sender mail only), a listing blocks your bounces and auto-replies at the receivers that check it, not your normal mail. It is still a clear signal that your server accepts mail it cannot deliver. |
| Removal cost | Free on every list (paid delisting offers are scams) |
Check if you're on Backscatterer.org
First decide which role you are in. If your mail server is the one sending backscatter, the IP that leaves your MTA is what lands on Backscatterer.org, so check that IP below (not your website's IP). If your own inbox is flooded with bounces for mail you never sent, you are the victim of someone forging your domain, and the fix is enforcing that domain, covered further down.
Is your IP or domain on Backscatterer.org?
Enter your sending IP or domain and the check runs instantly on the next page. Free, no signup.
Related free tools: Domain reputation · Full blocklist checker · DNS lookup · Email security score
What is Backscatterer.org?
Backscatter is collateral bounce mail. A message arrives at your server, your server accepts it, and only later discovers it cannot deliver it: the recipient does not exist, the mailbox is full, or a filter rejected it. Your server then does the polite-looking thing and emails a non-delivery report back to the sender address on the message. The catch is that spam and malware forge that sender address, so the report does not go back to the real spammer. It goes to whoever's address was forged, a stranger who never sent anything. Multiply that by the volume of junk aimed at your domain and you are mailing floods of unwanted reports to innocent third parties.
Backscatterer.org is the blocklist that catches servers doing this. Run by the UCEPROTECT-Network, it publishes one zone, ips.backscatterer.org, and lists any IP it sees sending misdirected bounces, misdirected autoresponders, or sender callouts. It is not a spam list in the usual sense: you can land on it while sending no spam at all, purely because your server is configured to accept mail first and reject it afterward. Because it targets that specific behaviour, Backscatterer is meant to be queried only in safe mode, against bounce and null-sender traffic, so a listing has a narrower blast radius than a Spamhaus listing.
Three sending patterns get an IP listed. Misdirected bounces are the accept-then-reject non-delivery reports above. Misdirected autoresponders are out-of-office and vacation replies fired at a forged sender or a mailing list. Sender callouts (also called sender address verification) are probes your server makes back to an alleged sender's mail system to check the address exists before you accept inbound mail; aggressive callouts hammer the forged third parties too. All three send mail to people who never wrote to you, which is the common thread Backscatterer measures.
The Backscatterer.org lists, and what each one covers
Backscatterer.org is not one list. Identify the exact zone that flagged you: it decides what you fix and how you get removed.
| List | What it covers | Where it's queried | Getting off |
|---|---|---|---|
Backscatterer Backscatterer: ips.backscatterer.org IP | IP addresses seen sending misdirected bounces, misdirected autoresponders, or sender callouts: mail aimed at a forged or unverified sender who never wrote to you. It lists the sending IP, not a domain, and is meant to be queried only in safe mode (null-sender or postmaster mail). | ips.backscatterer.org | Expires automatically Removed automatically and free of charge four weeks after the last detected event. There is no free instant self-removal: you either stop the cause and wait out the four weeks, or order the paid, conditional expressdelisting, which Backscatterer offers only for some IPs and refuses when the last event is too recent. |
Why your IP or domain got listed
A listing is a reputation verdict. These are the situations Backscatterer.org lists senders for:
Your server sent misdirected bounces: it accepted a message, then emailed a non-delivery report to the (forged) sender address.
Your server sent misdirected autoresponders: an out-of-office or vacation reply went to a forged sender or to a mailing list.
Your server made sender callouts: verification probes back to an alleged sender's system that hit forged third parties.
Any IP Backscatterer sees doing the above is listed for four weeks from the last event, whether or not it sent any actual spam.
Most common reasons senders land here, ranked
| Likely cause | What's happening |
|---|---|
| Your mail server accepts mail it cannot deliver, then bounces it | The single biggest cause. Your MTA says yes to every recipient at the door, then generates a non-delivery report when the mailbox turns out not to exist. Because the sender was forged, that report is backscatter. Validate recipients during the SMTP session instead. |
| A catch-all mailbox soaks up spam aimed at random addresses | A catch-all accepts mail for every possible address at your domain. Spammers spray thousands of invented recipients with forged senders, your server accepts and later bounces each one, and every bounce is backscatter aimed at the forged victims. |
| Out-of-office and vacation autoresponders reply to spoofed mail | Auto-replies that fire on any incoming message will answer spam whose sender is forged, so the vacation notice lands on a stranger. Suppress autoresponders on null-sender mail and on messages that fail authentication. |
| Sender address verification callouts probe innocent third parties | Some servers connect back to a sender's domain to test whether the address exists before accepting mail. When the sender is forged, those probes pester the real owner of the address, and Backscatterer treats aggressive callouts as abuse. |
| Your domain is not enforced, so anyone can forge it | This bites two ways. Spammers forge your domain as the sender, so other misconfigured servers bounce their spam to you and your inbox fills with reports you never earned. Separately, unauthenticated inbound that you accept then bounce is what makes you a source. DMARC at p=reject plus rejecting unauthenticated mail in-session close both gaps. This is the seam Palisade closes. |
How to delist from Backscatterer.org
Removal is simple to describe and mildly annoying to live with. Backscatterer has no free instant delist button. A listing expires on its own four weeks after the last event it sees, so the only durable move is to stop your server generating backscatter and let the clock run out. Fix the cause first: if the behaviour continues, the four-week clock keeps resetting.
Confirm the listing and the IP
Run the IP your mail actually leaves from through the free IP reputation check below, and confirm it is on ips.backscatterer.org rather than a stale cache. If your website IP and your sending IP differ, check the sending one.
Reject invalid recipients during the SMTP session
Reconfigure your MTA to verify the recipient exists and answer with a 550 5.1.1 at the RCPT stage, so the sending server keeps the message and you generate no bounce. Accepting then bouncing is the behaviour Backscatterer lists; rejecting in-session ends it.
Silence misdirected autoresponders and callouts
Turn off out-of-office and vacation replies for null-sender mail and for messages that fail authentication, and disable or tightly scope any sender-callout verification. Neither should ever fire at a forged third party.
Authenticate and enforce your own domain
Publish correct SPF and DKIM, then move DMARC to p=reject. Enforcement stops spammers forging your domain (which cuts the bounce flood you receive) and lets you reject unauthenticated inbound before it can turn into backscatter you send. Verify with the free SPF, DKIM, and DMARC checkers.
Let the four-week clock expire, and do not pay
Once the cause is fixed, the listing clears itself four weeks after the last event, free. Backscatterer sells a paid expressdelisting for some IPs, but you never need it: waiting costs nothing, and paying will not hold if backscatter resumes.
Monitor the IP and the reports
Keep watching the sending IP against Backscatterer and keep DMARC reports flowing, so a new misconfiguration or a compromised autoresponder shows up as an alert instead of a fresh four-week listing.
Removal is free
Backscatterer removal is free if you are patient. Listings drop off on their own four weeks after the last event, once you have stopped the cause. Backscatterer, like the rest of the UCEPROTECT-Network, also sells a paid expressdelisting for faster removal, offered only for some IPs and refused when the last event is too recent. That paid model is controversial in the mail-operations community. The practical takeaway is simpler: fix the misconfiguration and wait, because the free path always exists and paying does nothing that a stopped cause plus four weeks will not.
Open www.backscatterer.orgWhen a Backscatterer.org listing isn't your fault
A Backscatterer listing is narrow by design, so read it carefully. Backscatterer itself points out that many large, legitimate providers still backscatter, which is exactly why it asks receivers to query it only in safe mode against null-sender mail. On shared sending infrastructure the listed IP may be another tenant's misconfigured autoresponder, not yours. And if your complaint is a flood of bounces for mail you never sent, you are the forged victim, not the lister: the offending IP is someone else's, and your fix is enforcing your domain so the forgery stops.
How to stay off Backscatterer.org
Reject invalid recipients at the RCPT stage so your server never accepts mail it cannot deliver; never accept-then-bounce.
Suppress out-of-office and vacation autoresponders on null-sender mail and on messages that fail authentication.
Disable sender-callout verification, or scope it so it cannot probe forged third parties.
Publish SPF and DKIM and move DMARC to p=reject, so no one can forge your domain into other servers' bounce traffic.
Monitor the sending IP and your DMARC reports continuously, so a misconfiguration surfaces as an alert, not a four-week listing.
The real fix: enforce authentication, don't just monitor
Backscatter is a symptom of two fixable gaps: a mail server that accepts messages it cannot deliver, and a domain anyone can forge. Checking Backscatterer tells you an IP is listed; it does nothing about either gap. Enforcement does. Reject invalid recipients in-session so you stop generating bounces, and host and enforce SPF, DKIM, and DMARC at p=reject so forged mail carrying your domain is dropped by receivers before it can bounce anywhere. Do both and a Backscatterer listing has nothing left to catch.
DMARC software that does the work
Palisade's AI agent takes domains all the way to enforcement: hosted SPF, DKIM, DMARC, and MTA-STS records, DMARC reports monitored continuously, and policies advanced to p=reject automatically. Your first domain is free, and the full product is open for 15 days, no card.
1 domain free up to 1,000 emails/month
Watching Backscatterer.org across every client domain
One client server quietly accepting-then-bouncing can land a client IP on Backscatterer, and a book of them is a steady trickle of these tickets. Checking every tenant IP against Backscatterer by hand does not scale, and the real fix (in-session rejection plus enforced authentication) is the same conversation across every client. Palisade hosts and manages SPF, DKIM, and DMARC for each client domain, walks every domain to p=reject automatically, and surfaces unauthenticated senders in the DMARC reports before they become abuse. It watches every domain from one console and opens tickets in ConnectWise, HaloPSA, and Autotask, and your own MSP domain is a free NFR domain to prove it on.
Questions readers ask
Frequently asked questions
Sources and last verified
Every Backscatterer.org fact on this page is drawn from the operator's own documentation, last checked 2026-07-19. Blocklist policies change; if a detail looks off, the linked source is authoritative.
- Backscatterer lists IPs for sending misdirected bounces, misdirected autoresponders, or sender callouts, and you clear it by stopping that behaviour.“All you have to do to be removed is stopping your system to send misdirected bounces, misdirected autoresponders and sender callouts.”www.backscatterer.org · checked 2026-07-19
- The list is published as a DNSBL at ips.backscatterer.org by the UCEPROTECT-Network.“You can simply use this list via DNS at ips.backscatterer.org”www.backscatterer.org · checked 2026-07-19
- Backscatterer asks receivers to query it only in safe mode, when MAIL FROM is <> or postmaster.“SAFE MODE means you will do DNSBL-Querys if MAIL FROM: is <> or postmaster only.”www.backscatterer.org · checked 2026-07-19
- Used in safe mode the list protects against backscatter without losing legitimate mail.“Used in safe mode ips.backscatterer.org will protect you against misdirected bounces and misdirected autoresponders and sender callouts while you can not lose any real mail.”www.backscatterer.org · checked 2026-07-19
- Listings are removed automatically and free of charge four weeks after the last abusive action.“4 weeks after we have seen the last abusive action.”www.backscatterer.org · checked 2026-07-19
- The only faster removal is a paid, conditional expressdelisting, not a free instant delist; it is refused when the last event is too recent.“feel free to order a manual expedited expressdelisting, if this option is offered for your IP.”www.backscatterer.org · checked 2026-07-19
- Backscatterer makes no manual exceptions; asking to be delisted outside the process is pointless.“We don't make exceptions to our list, so it is futile and a waste of your time to contact us and ask for delisting.”www.backscatterer.org · checked 2026-07-19
Related blocklists and guides
550 5.1.1550 5.7.1554 5.7.1p=rejectp=none-all vs ~all