Email blocklists explained
An email blocklist is a published list of IP addresses or domains that its operator associates with spam or abuse. Most are DNS-based (DNSBLs): a receiving mail server looks up the connecting IP address, or a domain in the message, with an ordinary DNS query, and rejects or scores the mail if it gets an answer. You usually land on one by sending to people who did not ask for your mail, hitting spam traps, or running a compromised server or account. To get off, fix the cause first, then follow that list's own removal process, which at reputable lists is free.
How a DNSBL works
RFC 5782, an informational document from the IRTF's Anti-Spam Research Group, describes the structure. A DNSBL is a DNS zone. To check an IPv4 address, you reverse its four numbers and append the list's domain. Adapted from section 2.1, with a list called bad.example.com and the address 192.0.2.25:
25.2.0.192.bad.example.com. A 127.0.0.2
25.2.0.192.bad.example.com. TXT "Dynamic address, see http://bad.example.com?192.0.2.25"An A record means the address is listed. Its value is a code, conventionally 127.0.0.2, never a real address to connect to. An optional TXT record explains the listing, and receiving servers often copy that text into the SMTP error they send back. If the address is not listed, the list returns no records at all. IPv6 addresses work the same way, written as 32 reversed hex digits (section 2.4).
Larger lists combine several sublists in one zone and use different A values to say which one matched (section 2.3). Section 6 describes how mail servers use the answers: most check one or more lists on every incoming connection and either refuse listed senders or feed the result into a spam score.
Domain blocklists
Some lists hold domain names instead of IP addresses. Section 3 of RFC 5782 calls them name-based lists, sometimes known as RHSBLs, and they are queried as domain followed by the list's zone. The Spamhaus Domain Blocklist (DBL) is one example: receivers check domains that appear in a message's headers and body, such as links and contact addresses. Spamhaus notes that subdomains of a listed domain also return a listing. A domain listing follows your links and your From: domain, whichever server or provider you send through.
The major lists
| List | What it lists | Typical cause |
|---|---|---|
| Spamhaus SBL | IPs and ranges Spamhaus judges to be malicious | Spam operations, snowshoe spam, bulletproof hosting, hijacked IP space |
| Spamhaus CSS (part of the SBL) | IPs sending low-reputation mail | Unsolicited mail, poor list hygiene, compromised accounts or CMS, bad DNS or HELO setup |
| Spamhaus XBL | Individual IPs showing signs of compromise | Infected or hijacked machines and devices |
| Spamhaus PBL | End-user IP ranges that should not send mail directly | Network policy, not misconduct |
| Spamhaus DBL | Domains | Signs of spam or malicious activity |
| SpamCop | IPs | Spam reported by its users and seen by its spam traps |
| Barracuda | IPs with a poor reputation for sending mail | A poor rating in Barracuda's reputation system |
Spamhaus also publishes ZEN, a single zone that combines the SBL, XBL and PBL. The DBL page notes that ZEN covers IP addresses only, so the DBL is queried separately.
Large mailbox providers keep their own lists as well. Microsoft's Exchange Online NDR reference lists codes for a banned sending IP, such as 5.7.606, with a self-service portal for removal requests. Microsoft's own data for your IPs is in SNDS and JMRP.
What gets you listed
Each operator publishes its own criteria, and they differ:
- Spam reports and spam traps. SpamCop's dispute FAQ says an IP is listed when its users and spam traps receive enough spam from it. Traps catch purchased lists, scraped addresses and long-dead addresses; see spam traps.
- Poor list hygiene. Spamhaus names it, along with unsolicited mail, among the triggers for a CSS listing.
- Compromise. Hacked mailboxes, website forms and content management systems send spam from a legitimate IP. Spamhaus lists such senders on the CSS, and infected devices on the XBL.
- Sloppy server setup. The CSS page asks for correct forward and reverse DNS and a real HELO name, and names generic HELO values such as
localhost.localdomainas common mistakes (reverse DNS and PTR records). - Sending from an address range not meant for mail. The PBL lists end-user ranges. Spamhaus stresses that a PBL listing is not caused by anything the user did; mail from those ranges should go through an authenticated relay.
- A new or unknown domain. The DBL page says domains Spamhaus has not seen before start with a poor reputation, one more reason to warm up a new domain slowly.
- Neighbors on a shared IP. If you send from an IP that other senders also use, their mail affects its standing. Google's email sender guidelines ask senders to make sure a shared IP is not on any blocklist, since mail from listed IPs is more likely to be marked as spam. See shared vs dedicated IPs.
How to check
Start with the bounce. A rejection often names the list and links to the listing, because receivers reuse the list's TXT record as the error text. Gmail and Microsoft use 550 5.7.1 for many policy blocks, Gmail defers low-reputation senders with 421 4.7.0, and a whole Microsoft 365 tenant can be blocked with 5.7.708.
Use the operator's lookup page. Spamhaus's IP and Domain Reputation Checker at check.spamhaus.org covers its lists, and its blocklist pages call it the only place where XBL, CSS, PBL and DBL removals are handled. SpamCop and Barracuda have their own lookup forms on the pages linked above.
Query DNS yourself. To check the IP 203.0.113.7 against Spamhaus ZEN, reverse it and look it up:
dig +short 7.113.0.203.zen.spamhaus.org A
dig +short 7.113.0.203.zen.spamhaus.org TXT
dig +short example.com.dbl.spamhaus.org ANo answer means not listed. An answer in 127.0.0.x means listed; the value tells you which sublist (the XBL page, for example, says it returns 127.0.0.4, and the PBL page 127.0.0.10 or 127.0.0.11). RFC 5782 section 5 requires every IPv4 list to list the test address 127.0.0.2, so querying 2.0.0.127.zen.spamhaus.org should return an answer and confirms the list is reachable.
One caution: Spamhaus refuses queries that arrive through many public DNS resolvers. It explains its error codes: 127.255.255.254 means the query came through a public or open resolver, 127.255.255.252 a misspelled zone name, and 127.255.255.255 too many queries. None of them says anything about your IP. Its fair use policy allows free use of the public mirrors for non-commercial use by small and medium organizations; commercial use needs a subscription.
How to get delisted
- Fix the cause. Spamhaus says the cause of a CSS listing must be found and corrected before removal, and that an XBL listing comes back if the problem continues. Stop the campaign or segment involved, secure compromised accounts and forms, and clean the list.
- Use the list's own process. Each one works differently:
| List | Removal |
|---|---|
| Spamhaus SBL | The ISP responsible for the IP sends the request to the SBL team |
| Spamhaus XBL, CSS, DBL | Through check.spamhaus.org. CSS listings normally expire three days after the last spam detection; XBL listings expire some time after the behavior stops |
| Spamhaus PBL | Self-removal at check.spamhaus.org for a single static IP assigned to you that runs a mail server with proper forward and reverse DNS; the exclusion expires after a year |
| SpamCop | Automatic after 24 hours without new reports; SpamCop asks you not to write just to say the problem is fixed |
| Barracuda | A removal request form; requests are typically handled within 12 hours, and duplicates are ignored |
| Microsoft | The self-service delist portal that Microsoft's NDR reference names for codes such as 5.7.606 |
- If you send through an email service provider, the listed IP is usually theirs. Tell them first; they handle delisting and can move you to another IP.
- Never pay for delisting. The SBL page says there is never a charge for removing any Spamhaus listing and that anyone offering removal for a fee is running a scam. RFC 6471, section 2.2.5, says lists of this kind must not charge for delisting and recommends not using those that do.
A delisting stops the rejections, not the reasons behind them. If the cause is still there, the next trap hit or complaint lists you again.
Prevention
- Mail only people who asked. Never buy, rent or scrape lists. Confirm sign-ups with double opt-in.
- Process bounces. Suppress hard bounces at once and repeated soft bounces (reduce your bounce rate).
- Retire inactive addresses before they turn into recycled spam traps.
- Verify old or imported lists before you send. Verification removes addresses that no longer exist, and flags some known traps as
validwith the reasonspamtrapand the actionremove. It cannot find every trap, because a working trap accepts mail like any mailbox. - Make leaving easy. A one-click unsubscribe turns a would-be spam report into a quiet removal.
- Secure what sends mail: strong passwords and multi-factor sign-in on mailboxes, bot checks on forms, patched servers.
- Watch your signals. Bounce rates, complaints and sender reputation dashboards usually move before a listing does.
Questions
Does a PBL listing mean I sent spam?
No. Spamhaus says the PBL lists ranges that should not send mail directly, and that a listing is not caused by the user's actions. Send through your provider's authenticated mail server, or, for your own static mail server IP, use the self-removal process.
How long does a listing last?
It depends on the list. SpamCop delists automatically after 24 hours without new reports, and Spamhaus CSS listings normally expire three days after the last detection. SBL removals go through the ISP responsible for the IP.
Should I check every blocklist that exists?
No. Many small lists are used by few receivers. Focus on the lists your bounces name and on the widely used ones above.
Try it
Clean an old or imported list with bulk email verification before you send to it, or check a single address in the free email checker.
Related
- The bounce code dictionary, for the text of a rejection.
- Glossary: list hygiene and spam trap.
- How to clean an email list.
Related guides
- Spam traps explained
- Sender reputation explained
- Shared vs dedicated sending IPs
- Reverse DNS (PTR records) for mail servers
- How to clean an email list
- All guides
Sources
- RFC Editor: RFC 5782, DNS Blacklists and Whitelists: query format, A and TXT records, combined lists, domain lists, test addresses.
- RFC Editor: RFC 6471, Overview of Best Email DNS-Based List (DNSBL) Operational Practices: no fees for delisting.
- Spamhaus: Blocklists: the lists and ZEN.
- Spamhaus: Spamhaus Blocklist (SBL): listing reasons, ISP removal, no charge.
- Spamhaus: Combined Spam Sources (CSS): triggers, expiry, fix before removal.
- Spamhaus: Exploits Blocklist (XBL): compromised IPs, expiry, return code.
- Spamhaus: Policy Blocklist (PBL): not a penalty, self-removal conditions, return codes.
- Spamhaus: Domain Blocklist (DBL): domain queries, subdomains, new domains.
- Spamhaus: Check your return codes: error codes for public resolvers.
- Spamhaus: DNSBL fair use policy: free and commercial use.
- SpamCop: Blocking List and SpamCop: Dispute resolution FAQ: listing and 24-hour expiry.
- Barracuda Central: Removal request and Barracuda Central: Lookups: reputation lookup, 12-hour handling.
- Microsoft: NDRs and SMTP errors in Exchange Online: banned-IP codes and the delist portal.
- Google: Email sender guidelines: shared IPs and blocklists.
How we wrote this: drafted by the email-validation.org team with the help of AI writing tools, from our product documentation and the sources linked in the text.