Email blocklist · The Spamhaus Project
Spamhaus blacklist removal: why your IP or domain is listed, and how to get off
By Samuel Chenard · CEO & Co-Founder, Palisade · Reviewed July 19, 2026
Spamhaus lists sending IPs and domains with a bad reputation, and a large share of mail servers query it, so a listing blocks delivery widely. Check your IP against the zen.spamhaus.org zone (or your domain against dbl.spamhaus.org), stop whatever caused it, then remove the listing at check.spamhaus.org. Removal is always free.
| Spamhaus at a glance | |
|---|---|
| Operator | The Spamhaus Project |
| Type | IP and domain blocklist |
| IP lookup zone | zen.spamhaus.org |
| Query method | A-record DNSBL. Free public DNS for low-volume, non-commercial use; high-volume or commercial use needs the Data Query Service (DQS) or a data feed. |
| Who uses it | Spamhaus data filters a very large share of the world's mailboxes: ISPs, enterprise mail servers, and commercial spam filters all query it, so one listing can hurt delivery almost everywhere at once. |
| Reach | High. A ZEN or SBL listing can block mail across a large part of the internet, not just at one provider. |
| Removal cost | Free on every list (paid delisting offers are scams) |
Check if you're on Spamhaus
Two facts decide everything that follows: which Spamhaus zone lists you, and whether the flagged identifier is your sending IP or your domain. Check the IP your mail actually leaves from (not your website's IP) against Spamhaus below. If a bounce named the DBL, check your domain instead.
Is your IP or domain on Spamhaus?
Enter your sending IP or domain and the check runs instantly on the next page. Free, no signup.
Related free tools: Domain reputation (for the DBL) · Full blocklist checker · DNS lookup · Email security score
What is Spamhaus?
Spamhaus is a non-profit threat-intelligence operation whose blocklists are among the most widely consulted in email. It does not filter your mail itself. It publishes lists of IP addresses and domains with a poor reputation, and the mail servers that receive your messages query those lists in real time to decide whether to accept, defer, or reject you. Because so many receivers use Spamhaus, one listing can hurt delivery almost everywhere at once.
Spamhaus runs several separate lists, which is the part that trips people up. Four of them list IP addresses (the SBL, its automated CSS subset, the XBL, and the PBL), and they are bundled into the single ZEN zone so a receiver can check all four in one fast query. One list, the DBL, lists domains instead. The zone that flagged you decides what you actually have to fix and how you get removed, so identify the exact list first rather than treating Spamhaus as one thing.
The Spamhaus lists, and what each one covers
Spamhaus is not one list. Identify the exact zone that flagged you: it decides what you fix and how you get removed.
| List | What it covers | Where it's queried | Getting off |
|---|---|---|---|
SBL Spamhaus Blocklist IP | IP addresses seen in malicious activity: sending spam, snowshoe spamming, hosting malicious content, or hijacking IP space. Listings are researched and added by hand by the Spamhaus team. | sbl.spamhaus.org | ISP requests removal Not self-service. The ISP or owner in charge of the IP requests removal once the abuse is stopped; Spamhaus publishes no fixed processing time. |
CSS Combined Spam Sources IP | An automatically built subset of the SBL for IPs sending low-reputation email over SMTP (port 25), such as snowshoe operations and some compromised hosts. | Returned inside sbl.spamhaus.org and zen.spamhaus.orgcode 127.0.0.3 | Self-service removal Entries normally expire about three days after the last spam is detected (chronic abuse lasts longer). You can remove an IP at check.spamhaus.org, but it re-lists immediately if the problem continues. |
XBL Exploits Blocklist IP | IPv4 and IPv6 addresses showing signs of compromise: legitimate machines hijacked by third-party exploits, malware, or botnets. | Returned inside zen.spamhaus.orgcode 127.0.0.4 | Self-service removal Listings expire automatically once the malicious behaviour is no longer detected; Spamhaus publishes no fixed period. You can self-remove at check.spamhaus.org after cleaning the host. |
PBL Policy Blocklist IP | End-user IP ranges that should never send email directly to the internet, such as ISP broadband and dynamic space. A PBL entry is a policy statement, not an accusation of spam. | pbl.spamhaus.org | Self-service removal Self-service at check.spamhaus.org for a static mail-server IP; allow about 15 minutes for DNS propagation. The form rejects requests from free-email addresses (Gmail, Hotmail, Yahoo). |
DBL Domain Blocklist Domain | Domain names showing signs of spam or malicious activity, including domains owned by bad actors and hijacked domains. It lists domains only and does not support IP addresses. | dbl.spamhaus.org | Expires automatically Highly automated: most listings expire on their own once the domain's activity stops. An approved removal is processed in a few minutes, though local systems can lag up to 24 hours. |
Why your IP or domain got listed
A listing is a reputation verdict. These are the situations Spamhaus lists senders for:
Spam or unwanted email left your IP, whether you sent it or a compromised account, script, or device did.
Your server relays mail for others (an open relay or a hijacked web app), so spam appears to originate from you.
Your domain turned up in spam or malicious messages, which can list it on the DBL even when your IPs are clean.
Your IP sits in a range an ISP has flagged as end-user or dynamic space, so direct-to-MX sending is refused by PBL policy.
A machine on your IP is infected or part of a botnet, which the XBL detects from its traffic.
Most common reasons senders land here, ranked
| Likely cause | What's happening |
|---|---|
| A compromised mailbox, app, or server started sending spam | The most common trigger. A phished account, a vulnerable web form, or a hijacked device sends spam from your IP or as your domain. Spamhaus sees the traffic and lists you, often on the CSS or XBL. |
| Anyone can send as your domain because it isn't enforced | If your domain has no DMARC policy at enforcement, spammers can spoof it. Their spam carries your domain, which can land it on the DBL and drag your real mail down with it. This is the seam Palisade closes. |
| SPF, DKIM, or DMARC is missing or misaligned | Unauthenticated mail looks like spam to receivers and to Spamhaus's automated detection. Gaps in SPF and DKIM, or a DMARC record stuck at p=none, make a listing easy to earn and easy for abuse to hide behind. |
| A shared or recycled IP arrived with baggage | On shared sending infrastructure, another tenant's spam can list the IP you also use. A freshly allocated IP can inherit an older SBL or CSS listing from its previous owner. |
| Your IP is in end-user space (PBL) or a host on it is infected (XBL) | A PBL listing means the range was never meant to send mail directly; send through a proper smarthost or get the static IP excluded. An XBL listing means clean the infected machine before anything else. |
How to delist from Spamhaus
Removal only sticks if you fix the cause first: Spamhaus re-lists an IP the moment the abuse resumes, and the CSS says so outright. Work the steps in order. One warning up front, straight from Spamhaus: removal is always free, and anyone charging a fee to delist you is running a scam.
Confirm the listing and which zone it is
Run your sending IP through the free IP reputation check below (and your domain through the domain reputation checker if a bounce named the DBL). Note the exact list: SBL, CSS, XBL, PBL, or DBL. The removal path differs for each.
Stop the abuse at the source
Before you ask for removal, end whatever caused it: reset the compromised mailbox, patch or close the open relay or vulnerable form, clean the infected host, and stop any non-compliant sending. Spamhaus re-lists immediately if the behaviour continues.
Authenticate every sender so it cannot recur
Publish correct SPF, turn on DKIM for each service that sends as you, and set DMARC. Verify with the free SPF, DKIM, and DMARC checkers. Moving DMARC to
p=rejectis what stops spoofed mail from re-listing your domain.Use the right removal path for the zone
For CSS, XBL, and PBL, self-remove at check.spamhaus.org (PBL needs a static mail-server IP and a non-free-email address). For the SBL, the ISP that owns the IP requests removal from the SBL Removals Team. The DBL mostly clears on its own.
Remove the listing and allow for propagation
Complete the removal at check.spamhaus.org. A PBL removal takes about 15 minutes to propagate; CSS entries expire roughly three days after the last detection; DBL removals process in minutes. Re-run the checker to confirm you are clear.
Monitor so the next listing is caught early
Keep watching the IP and the domain, and keep DMARC reports flowing, so a new compromise shows up as an alert instead of a fresh Spamhaus listing and a wave of bounces.
Removal is free
Spamhaus removal is free on every list. In its own words: "There is never any charge or fee associated with removing any Spamhaus listing. Any offer from anyone to remove any Spamhaus listing for a fee is a scam." If a bounce or a paid reputation service asks you to pay to get off Spamhaus, walk away and use check.spamhaus.org directly.
Open check.spamhaus.orgWhen a Spamhaus listing isn't your fault
A Spamhaus listing is rarely random, but it is not always your own mail. On shared sending infrastructure the listed IP may belong to another tenant, and a PBL entry is a statement about the IP range, not proof you sent spam. Spamhaus also stopped answering DNSBL queries from large public resolvers: if a lookup routed through Google, Cloudflare, or Quad9 returns a 127.255.255.254 result, that is a blocked-query sentinel, not a real listing. Confirm on check.spamhaus.org from a normal network before you act.
How to stay off Spamhaus
Authenticate everything: SPF that lists every real sender, DKIM signing on each service, and DMARC that you actually move to enforcement.
Enforce DMARC at
p=rejectso receivers reject mail that forges your domain in the From header, which cuts the spoofed volume that gets your domain listed on the DBL.Set correct PTR/reverse DNS with a matching HELO, and send from static IPs meant for mail, not end-user space.
Watch your DMARC reports and your IP and domain reputation continuously, so a compromise surfaces as an alert, not a bounce.
Keep list hygiene and complaint rates low, and retire or warm sending IPs deliberately.
The real fix: enforce authentication, don't just monitor
Nearly every Spamhaus listing traces back to the same gap: mail that leaves your domain without being authenticated, or a domain anyone can spoof because it is not enforced. Checking a blocklist tells you that you are listed; it does nothing to stop the spoofing and unauthenticated sending that put you there. Enforcement does. Publish and host correct SPF, DKIM, and DMARC, watch the reports for senders you missed, and move every domain to p=reject so receivers drop forged mail instead of listing yours.
DMARC software that does the work
Palisade's AI agent takes domains all the way to enforcement: hosted SPF, DKIM, DMARC, and MTA-STS records, DMARC reports monitored continuously, and policies advanced to p=reject automatically. Your first domain is free, and the full product is open for 15 days, no card.
1 domain free up to 1,000 emails/month
Watching Spamhaus across every client domain
One listed client IP is an afternoon; a book of clients each one compromise away from a Spamhaus listing is the job. Checking every tenant's IPs and domains against Spamhaus by hand does not scale, and a single spoofed client domain on the DBL can pull a whole portfolio's delivery down. Palisade hosts and manages SPF, DKIM, and DMARC for every client domain, surfaces unauthenticated senders in the DMARC reports before they turn into abuse, and walks each domain to p=reject automatically. It watches every domain from one console and opens tickets in ConnectWise, HaloPSA, and Autotask, and your own MSP domain is a free NFR domain to prove it on.
Questions readers ask
Frequently asked questions
Sources and last verified
Every Spamhaus fact on this page is drawn from the operator's own documentation, last checked 2026-07-19. Blocklist policies change; if a detail looks off, the linked source is authoritative.
- ZEN combines the SBL, CSS, XBL, and PBL, and is IP-only.“It contains the SBL, CSS, XBL, and PBL blocklists.”www.spamhaus.org · checked 2026-07-19
- ZEN gives no protection against malicious domains, so domains are checked on the DBL.“Due to its IP nature, ZEN does not provide any protection against malicious or suspicious domains.”www.spamhaus.org · checked 2026-07-19
- The SBL lists malicious IPs at sbl.spamhaus.org and is maintained by hand.“IP addresses that have been identified as malicious ... sending spam, snowshoe spamming, hosting malicious content, behaving like a bulletproof hosting company or hijacking IP space.”www.spamhaus.org · checked 2026-07-19
- SBL removal is not self-service: the ISP in charge of the IP requests it.“Removal requests must be sent by the Internet Service Provider in charge of the listed IP address(es).”www.spamhaus.org · checked 2026-07-19
- CSS is an automated SBL subset for port-25 senders, returned with code 127.0.0.3.“The CSS dataset is dedicated to SMTP traffic, only listing port-25 based detections. ... included in the Spamhaus Blocklist zone, as a subset of SBL.”www.spamhaus.org · checked 2026-07-19
- CSS entries expire ~3 days after the last detection and re-list if abuse continues; removals only at check.spamhaus.org.“CSS listings expire quickly: normally, three days after last spam detection. In some cases of chronic abuse, the listings can last longer.”www.spamhaus.org · checked 2026-07-19
- The XBL lists compromised/hijacked IPs; listings auto-expire; removals at check.spamhaus.org (return code 127.0.0.4).“The Exploits Blocklist contains individual IPv4 and IPv6 addresses exhibiting signs of compromise i.e. IPs that are legitimate but have been hijacked to use by third-party exploits.”www.spamhaus.org · checked 2026-07-19
- The PBL lists end-user IP ranges at pbl.spamhaus.org; self-remove with ~15 min propagation; static IPs only; no free-email addresses.“Please allow approximately 15 minutes for DNS propagation.”www.spamhaus.org · checked 2026-07-19
- The DBL is a domain-only list at dbl.spamhaus.org; most listings expire automatically.“The DBL is a domain-only blocklist and does not include or support IP addresses.”www.spamhaus.org · checked 2026-07-19
- Spamhaus removal is always free; paid delisting offers are scams.“There is never any charge or fee associated with removing any Spamhaus listing. Any offer from anyone to remove any Spamhaus listing for a fee is a scam.”www.spamhaus.org · checked 2026-07-19
- The Blocklist Removal Center became the IP and Domain Reputation Checker at check.spamhaus.org (March 4, 2021).“Good-bye, Blocklist Removal Center. Hello, IP and Domain Reputation Checker.”www.spamhaus.org · checked 2026-07-19
- Public DNS use is free for low-volume, non-commercial users; commercial/high-volume use needs DQS or a data feed.“Use of the Spamhaus DNSBLs via DNS queries to our public DNSBL servers is free of charge for low-volume non-commercial use.”www.spamhaus.org · checked 2026-07-19
- Queries from open public resolvers are blocked and return 127.255.255.254.“If any of the tests return 127.255.255.254 then your queries ... are being blocked ... because the DNS resolver being used is an open public resolver.”www.spamhaus.org · checked 2026-07-19
Related blocklists and guides
554 5.7.1550 5.7.1421 4.7.0p=rejectptrp=none