Invaluement is a commercial anti-spam service that runs three DNS blocklists: ivmSIP and ivmSIP/24 list spam-sending IP addresses and subnets, while ivmURI lists spammy domains found in email links. Mail filters subscribe to it as an add-on alongside Spamhaus, so a listing hurts your delivery at the receivers that query it.

What is the difference between ivmSIP, ivmSIP/24, and ivmURI?

ivmSIP lists individual IP addresses that send only spam or almost only spam. ivmSIP/24 lists whole /24 subnets that show spam patterns, aimed at snowshoe spammers. ivmURI is a domain and URI list: it flags the domains found inside spam links, not the sending IP. The list that flagged you decides what you fix.

How do I get removed from invaluement or ivmSIP?

First stop the cause: reset the compromised account, clean the host, or fix the abused domain, then authenticate your mail. Confirm the listing on invaluement's own lookup, then request removal on its delist page at invaluement.com/removal/ by entering the listed IP or domain. A request will not hold while spam continues.

Is invaluement free to check or to be removed from?

Checking is free through invaluement's own lookup page, which handles up to ten IPs or domains at a time. invaluement does not publish a removal fee on its public pages; you request delisting directly on its site. Ignore any third party that offers paid invaluement removal and deal with invaluement itself.

Is invaluement the same as Spamhaus?

No. invaluement is a separate, smaller commercial list run by invaluement, not the Spamhaus Project. It positions itself as a supplement to Spamhaus that catches spam Spamhaus misses, so filters often run both. A clean result on one says nothing about the other, so check each list separately.

Does an invaluement listing block all my email?

No. Only receivers that subscribe to invaluement act on it, so the reach is narrower than a Spamhaus listing. But invaluement has many hundreds of subscribers who often use it for strict accept-or-reject decisions, so where it is deployed a listing can block your mail outright, not merely raise a spam score.

Email blocklist · invaluement (Robert K. McEwen)

What is Invaluement, and how do you get off ivmSIP, ivmSIP/24, or ivmURI?

By Samuel Chenard · CEO & Co-Founder, Palisade · Reviewed July 19, 2026

Invaluement is a commercial anti-spam service that runs three DNS blocklists: ivmSIP and ivmSIP/24 list spam-sending IP addresses and subnets, and ivmURI lists spammy domains found in email links. Mail filters subscribe to it as a Spamhaus supplement, so a listing blocks your delivery at the receivers that use it.

Invaluement at a glance
Operator	invaluement (Robert K. McEwen)
Type	IP and domain blocklist
IP lookup zone	`Subscriber-assigned hostname (no open public DNS zone)`
Query method	A-record DNSBL that resolves a hit to 127.0.0.2 (or a variation) and returns NXDOMAIN when clean. There is no open public zone: invaluement distributes the lists to subscribers only, by an assigned direct-query hostname or an rsync feed, behind a free 7-day trial and paid plans.
Who uses it	invaluement is consumed as an add-on inside other people's spam filters and mail servers. It bills itself as a supplement to Spamhaus that catches spam Spamhaus misses, so a listing costs you delivery specifically at receivers that run invaluement alongside their primary blocklist.
Reach	Moderate to high, but only at receivers that subscribe to it. The reach is narrower than Spamhaus, yet invaluement has many hundreds of subscribers and is often used for strict accept-or-reject decisions, so where it is deployed a listing can block your mail outright rather than just add spam score.
Removal cost	Free on every list (paid delisting offers are scams)

Check if you're on Invaluement

Two facts decide what you do next: which invaluement list flagged you, and whether the flagged identifier is an IP or a domain. ivmSIP and ivmSIP/24 list the IP your mail leaves from; ivmURI lists domains that appear in your message links. One catch specific to invaluement: it distributes its lists to subscribers, so there is no open public zone to dig. Check your sending IP and your domains below, then confirm an invaluement-specific listing on their own lookup.

Is your IP or domain on Invaluement?

Enter your sending IP or domain and the check runs instantly on the next page. Free, no signup.

What is Invaluement?

Invaluement is a commercial anti-spam operation that publishes three DNS blocklists (DNSBLs). It does not filter your mail itself. It sells reputation data that other people's spam filters query: when a receiver runs invaluement, its mail server checks your sending IP, or the domains inside your message, against invaluement's lists in real time and blocks you if you are listed. invaluement describes itself as an add-on that runs alongside a primary blocklist such as Spamhaus and catches the spam Spamhaus misses.

Three separate lists sit under the invaluement brand, and the one that flagged you decides what you have to fix. ivmSIP and ivmSIP/24 are IP lists: ivmSIP lists individual spam-sending addresses, and ivmSIP/24 lists whole /24 subnets where a pattern of spam shows up. ivmURI is different in kind: it lists the domains (and a few IPs) found inside the clickable links in spam, not the sending IP. So an ivmSIP hit is about where your mail comes from, while an ivmURI hit is about a domain you are putting in front of recipients.

invaluement is a subscription service, not a free public utility, which changes how you deal with a listing. It has published its lists since 2007, to many hundreds of subscribers, and is operated as invaluement by Robert K. McEwen. Access comes as an assigned direct-query hostname or an rsync feed, behind a free seven-day trial and paid plans. Because of that model there is no open zone you can query the way you can with Spamhaus, so a definitive check runs on invaluement's own lookup page.

The Invaluement lists, and what each one covers

Invaluement is not one list. Identify the exact zone that flagged you: it decides what you fix and how you get removed.

List	What it covers	Where it's queried	Getting off
ivmSIP invaluementSIP (ivmSIP) IP	IP addresses that, in invaluement's words, either only send spam or emit an extremely high percentage of spam. It says most listings are botnets, elusive snowshoe spammers, or irresponsible ESPs, with rarer short-term listings of normally legitimate senders whose systems have been compromised into sending mass spam.	`Subscriber-assigned direct-query hostname or rsync feed; a hit resolves to 127.0.0.2. No open public zone.`	Removal web form invaluement publishes no fixed removal time on its public pages. You request removal by entering the listed IP on its delist page at invaluement.com/removal/; a listing driven by a live spam source will not clear until that source stops.
ivmSIP/24 invaluementSIP/24 (ivmSIP/24) IP	IP ranges and /24 subnets where invaluement has detected a pattern of spam sending. It says it preemptively lists spammers' subnets while working to avoid nearby ranges owned by innocent bystanders, and that it was possibly the first anti-spam list to primarily target snowshoe spammers, even before Spamhaus released its CSS list.	`Subscriber-assigned direct-query hostname or rsync feed; a hit resolves to 127.0.0.2. No open public zone.`	Removal web form No fixed timeframe is published. Because ivmSIP/24 lists a whole subnet, the trigger may be a neighbor on shared space rather than you; removal is requested on invaluement's delist page once spam from the range stops.
ivmURI invaluementURI (ivmURI) URI	Domain names (and a few IPs) found inside the clickable links in the body of spam, in the same family as SURBL and URIBL. invaluement says these domains are generally not seen in legitimate email and are mostly owned by spammers, though a normally-innocent domain can be listed after criminals hijack it.	`Subscriber-assigned direct-query hostname or rsync feed; a hit resolves to 127.0.0.2. No open public zone.`	Removal web form No fixed timeframe is published. If a clean domain of yours was hijacked or its links abused in spam, fix the compromise first, then request removal on invaluement's delist page.

Why your IP or domain got listed

A listing is a reputation verdict. These are the situations Invaluement lists senders for:

Your IP only sends spam, or sends an extremely high percentage of spam, which is the core ivmSIP criterion.
Your IP sits in a /24 subnet where invaluement has detected a spam-sending pattern, even when a neighbor on shared space is the actual source (ivmSIP/24).
A domain that appears in your message links turns up in spam invaluement is tracking, which lists that domain on ivmURI regardless of your sending IP.
A normally legitimate server of yours was compromised and is currently pushing mass spam, which earns a short-term ivmSIP listing until it stops.
A clean domain you own was hijacked by spammers and used inside spam links, so ivmURI lists it even though the domain is legitimately yours.

Most common reasons senders land here, ranked

Likely cause	What's happening
A compromised mailbox, app, or host started sending spam	The most common ivmSIP trigger. A phished account, a vulnerable web form, or a hijacked device sends spam from your IP. invaluement lists the address, and its own copy notes that even a normally legitimate sender gets a short-term listing while a compromised system is emitting mass spam.
Anyone can send as your domain because it isn't enforced	If your domain has no DMARC policy at enforcement, anyone can forge it in the From: header. That mostly costs you deliverability and fuels brand-impersonation phishing; where that phishing also embeds your domain in its own links, it can feed an ivmURI listing indirectly. Enforcement shuts that spoofing seam, but the direct ivmURI fix is cleaning up wherever your domain is used in spam links. This is the spoofing seam Palisade helps you close.
SPF, DKIM, or DMARC is missing or misaligned	Unauthenticated mail reads as spam to receivers and to the detection that feeds these lists. Gaps in SPF and DKIM, or a DMARC record stuck at p=none, make a listing easy to earn and easy for abuse to hide behind.
You share IP space with a snowshoe spammer	ivmSIP/24 lists subnets, and invaluement built it specifically to catch snowshoe operations that spray low volumes across many addresses. On shared or cloud IP space, a neighbor's spam can list the /24 that your sending IP also lives in.
A domain in your links was hijacked or abused	ivmURI targets domains found in spam links. A legitimate site that gets hacked, or a link-shortener and tracking domain that spammers exploit, can be listed even when your mail server is clean. Fix the abuse before you ask for removal.

Triage flowchart for an Invaluement listing: ivmSIP flags your individual sending IP, ivmSIP/24 flags your whole /24 subnet (often a neighbor on shared space), and ivmURI flags a domain in your message links; for any of the three, confirm on invaluement's own lookup and request removal at invaluement.com/removal.

How to delist from Invaluement

Removal only holds if the spam stops first: invaluement is a curated, subscriber-fed list, so a fresh request will not survive an active spam source. Work these in order. Two things are specific to invaluement. There is no open public zone to query, so you confirm a listing on their own lookup, and the delist request itself is made on invaluement's delist page rather than through a one-click self-service portal.

Confirm the listing and which list it is
Run your sending IP through the free IP reputation check below, and your domains through the URL reputation checker if a bounce or report points at ivmURI. Note whether it is ivmSIP, ivmSIP/24, or ivmURI, then confirm the invaluement-specific listing on their own lookup, since the lists are subscriber-only.
Stop the spam at the source
Before you ask for removal, end whatever caused it: reset the compromised mailbox, patch or close the vulnerable app or open relay, clean the infected host, and stop any non-compliant sending. invaluement will not keep a removal in place while spam is still leaving your IP or your domain.
Authenticate every sender so it cannot recur
Publish correct SPF, turn on DKIM for each service that sends as you, and set DMARC. Verify with the free SPF, DKIM, and DMARC checkers. Moving DMARC to p=reject shuts down spoofing of your domain in the From: header; for an ivmURI listing, pair it with locking down the domain and its hosting so it can't be hijacked back into spam links.
Request removal on invaluement's delist page
Go to invaluement.com/removal/, enter the listed IP or domain, and follow the instructions it returns. Send any follow-up from a real business mailbox rather than a free webmail account, and include why the listing should be cleared; requests from a legitimate address are taken more seriously.
Confirm you are clear and keep monitoring
Re-check the IP and domain reputation, and re-run invaluement's own lookup, to confirm the listing is gone. Keep watching reputation and keep DMARC reports flowing so the next compromise surfaces as an alert instead of a fresh listing and a wave of bounces.

Removal is free

Checking is free on invaluement's own lookup page, which handles up to ten IPs or domains at a time. invaluement does not publish a delisting fee or a fixed removal timeframe on its public pages; you request removal directly on its delist page. Treat any third party that offers paid "invaluement removal" with suspicion: you deal with invaluement directly, and the durable fix is stopping the spam and authenticating your mail.

Open www.invaluement.com

When a Invaluement listing isn't your fault

An invaluement listing usually reflects real spam, but not always your own. ivmSIP/24 lists whole /24 subnets, so on shared or cloud IP space the spammer may be a neighbor rather than you. ivmURI can list a legitimate domain after criminals hijack it, which invaluement acknowledges directly. And because the lists are subscriber-only, a public blocklist tool that shows "not listed" may simply lack access, not prove you are clear.

How to stay off Invaluement

Authenticate everything: SPF that lists every real sender, DKIM signing on each service, and DMARC that you actually move to enforcement.
Enforce DMARC at p=reject so no one can forge your domain in the From: header, and keep the domain and its hosting locked down so it can't be hijacked into the spam links that land it on ivmURI.
Keep sending IPs clean: watch for compromise, hold complaint rates down, and avoid snowshoe-style spray from fresh subnets that ivmSIP/24 is built to catch.
Send from static, mail-purposed IPs with correct PTR and reverse DNS, not shared or end-user space a spammer might also be using.
Monitor IP and domain reputation and your DMARC reports continuously, so a compromise shows up as an alert rather than a listing.

The real fix: enforce authentication, don't just monitor

Almost every invaluement listing traces back to spam actually leaving your infrastructure, or your domain being embedded in the links of spam sent from elsewhere. A blocklist lookup only tells you that you are listed; it does nothing to stop a compromised sender, secure an abused domain, or clear the listing. Host correct SPF, DKIM, and DMARC, move every domain to p=reject to shut down spoofing of the From: header and brand impersonation, and watch the DMARC reports for senders you did not know about, so a compromise surfaces as an alert before it becomes spam leaving your IP. Enforcement closes the spoofing seam; cleaning up your senders and locking down your domains is what keeps you off ivmSIP and ivmURI.

DMARC software that does the work

Palisade's AI agent takes domains all the way to enforcement: hosted SPF, DKIM, DMARC, and MTA-STS records, DMARC reports monitored continuously, and policies advanced to p=reject automatically. Your first domain is free, and the full product is open for 15 days, no card.

Get started Book a demo

1 domain free up to 1,000 emails/month

Watching Invaluement across every client domain

One client on ivmSIP is an afternoon; a book of clients, each one compromise away from an invaluement listing, is the job. The subnet list makes it worse: one snowshoe tenant on shared space can pull neighbors down with it. Palisade hosts and manages SPF, DKIM, and DMARC for every client domain, surfaces unauthenticated senders in the DMARC reports before they turn into spam, and walks each domain to p=reject automatically. It watches every client IP and domain from one console and opens tickets in ConnectWise, HaloPSA, and Autotask, and your own MSP domain is a free NFR domain to prove it on.

Questions readers ask

Frequently asked questions

ivmURI lists domains found in spam links, not sending IPs, so your mail server can be clean while a domain is listed. It usually means the domain, or a site it points to, was hijacked or its links were abused in spam. Secure and clean the domain and its hosting, then request removal on invaluement's delist page. Enforcing DMARC at p=reject won't clear a link-based listing on its own, but it does cut the brand-impersonation phishing that can drag your domain into spam.

Sources and last verified

Every Invaluement fact on this page is drawn from the operator's own documentation, last checked 2026-07-19. Blocklist policies change; if a detail looks off, the linked source is authoritative.

invaluement is a combination of three DNSBLs used as an add-on in most spam filters; setup is under 10 minutes with no hardware or software, and a free 7-day trial is offered.“Invaluement is a combination of 3 DNSBLs that can be used as an "add on" in most email and spam filtering systems. ... The setup time for invaluement is typically less than 10 minutes, it typically integrates directly into your existing spam filter, and requires no hardware or software installation. The pricing is very affordable, and we offer a free 7-day trial.”www.invaluement.com · checked 2026-07-19
ivmSIP lists IPs that only send spam or emit an extremely high percentage of spam; most are botnets, snowshoe spammers, or irresponsible ESPs, with rarer short-term listings of compromised legitimate senders.“invaluementSIP is an anti-spam list consisting of IP addresses which either only send spam or which emit an extremely high percentage of spam. Most ivmSIP-listed IPs are from botnets, very elusive snowshoe spammers, or irresponsible ESPs. Rarer listings include short-term listings of low-volume and normally legit senders who currently have a compromised system that is facilitating the sending of massive amounts of spam.”www.invaluement.com · checked 2026-07-19
ivmSIP cannot replace Spamhaus; it focuses on spammy IPs overlooked or not yet listed by Spamhaus, with a low false-positive rate comparable to Spamhaus' Zen.“ivmSIP is not trying to be a list-every-botnet dnsbl. Therefore, it cannot replace Spamhaus. Instead, it focuses on spammy IPs either overlooked or not yet listed by Spamhaus, and has an industry-leading low FP rate which is comparable to that of Spamhaus' Zen list.”www.invaluement.com · checked 2026-07-19
ivmSIP/24 preemptively lists spammers' IP ranges and subnets, avoids innocent neighboring ranges, and was possibly the first anti-spam list to primarily target snowshoe spammers, before Spamhaus' CSS list.“invaluementSIP/24 is an anti-spam list which preemptively lists spammers' ip ranges or subnets where patterns of spam-sending from those blocks have been detected. Unlike other /24 lists, ivmSIP/24 does a great job of NOT listing those nearby IP ranges which are owned by innocent bystanders. ... ivmSIP/24 made history by being possibly the first anti-spam list to primarily target snowshoe spammers, even before Spamhaus came out with their CSS list.”www.invaluement.com · checked 2026-07-19
ivmURI is a URI/domain DNSBL (like SURBL and URIBL) that lists domain names and a few IPs found in the clickable links in spam.“invaluementURI is an anti-spam URI dnsbl, similar to surbl.org and uribl.com. Therefore, unlike an "RBL", and sometimes called a domain dnsbl, it actually lists both domain names and a few IPs, which are all found within the clickable links in the body of spams.”www.invaluement.com · checked 2026-07-19
ivmURI-listed domains are generally not seen in legitimate email except when a normally-innocent domain is hijacked; most listed domains are owned by spammers.“These domains are generally not seen in legitimate e-mails, except for rare instances when a normally-innocent domain has been hijacked by criminal spammers. However, most ivmURI-listed domains are actually owned by spammers.”www.invaluement.com · checked 2026-07-19
Combined, ivmSIP and ivmSIP/24 are pitched as an especially strong supplement to Spamhaus that blocks more Spamhaus-missed spam than other DNSBLs.“When our two IP anti-spam lists (ivmSIP & ivmSIP/24) are combined, they are an especially excellent supplement to Spamhaus since they block more spam that is missed by Spamhaus than all other DNSBLs in existence, with the only exceptions being certain other DNSBLs which have significantly more false positives!”www.invaluement.com · checked 2026-07-19
invaluement's anti-spam lists launched in 2007 and now serve many hundreds of subscribers; the service is operated by Robert K. McEwen (dba invaluement).“In 2007, the invaluement anti-spam lists were launched. Since then, the invaluement customer base has grown to many hundreds of subscribers. ... © Copyright 2022 - Robert K. McEwen, dba invaluement”www.invaluement.com · checked 2026-07-19
Direct-query access uses a hostname invaluement assigns the subscriber; a DNSBL returns NXDOMAIN when not listed or resolves a hit to typically 127.0.0.2.“you just copy a particular host name (that we will assign you), paste that into a form field in your spam filter, hit 'save' ... in response to a DNS query, that anti-spam list either returns an NXDOMAIN value (domain not found), or, if the particular domain or IP is in fact listed, then it 'resolves' that DNS query to an IP, typically 127.0.0.2, or some variation of that.”www.invaluement.com · checked 2026-07-19
Public checking is done on invaluement's own research page, which accepts up to ten IPs or domains at a time and is separate from the delist page.“This page is for (faster!) research-only lookups. For a delist request, click here. Type up to 10 domain names and/or IP addresses below (1 per line):”www.invaluement.com · checked 2026-07-19
Removal is requested on invaluement's delist page by entering a domain or IP; the page publishes no removal fee and no fixed timeframe.“This page is for requesting a delisting of your domain or IP. For (faster!) research-only lookups, click here.”www.invaluement.com · checked 2026-07-19

Related blocklists and guides

Spamhaus UCEPROTECT SpamCop Barracuda Reputation Block List blacklisting email blocklist 554 5.7.1550 5.7.1p=rejectp=noneptr

Check any IP or domain against every major blocklist