Blocklist lookup
Before a mail server accepts a message, it often asks a few public lists whether the sender is known for spam. This lookup asks twelve of them about your servers and your domain name.
A blocklist is a DNS zone
You already use DNS to turn a name into an address. Blocklist operators borrow the same system and use it as a yes-or-no service, which is why these lists are also called DNSBLs. To ask Spamhaus about the address 203.0.113.7, a mail server reverses the four numbers, adds the name of the list and looks up the result:
7.113.0.203.zen.spamhaus.org
“No such name” means the address isn’t listed. An answer such as 127.0.0.4 means it is, and the last number carries the reason. The whole exchange takes a few milliseconds, so receiving servers do it for every incoming connection, before they read a word of the message.
Which addresses and which lists
Give it an IPv4 address and it tests that one. Give it a domain and it collects up to eight addresses from three places:
- the servers named in your MX records;
- the server behind the website, because contact forms and online stores usually send from it;
- single addresses written as
ip4:in your SPF record.
Each address is tested on nine lists: Spamhaus ZEN, Barracuda, SpamCop, PSBL, Mailspike, UCEPROTECT level 1, DroneBL, blocklist.de and s5h.net. The domain name itself is tested on three lists that track names found in the links of spam: Spamhaus DBL, SURBL and URIBL.
For every address, the lookup also reads the reverse name (the PTR record) and checks that the name points back to the same address. Large mailbox providers refuse or distrust mail from servers that fail this test.
Reading a listing
| Spamhaus answer | List | Meaning |
|---|---|---|
127.0.0.2, 127.0.0.9 | SBL | The address was identified as a source of spam. |
127.0.0.3 | CSS | Spam was seen from it recently. Often a compromised account or form. |
127.0.0.4 to .7 | XBL | A machine at this address is infected or used as an open proxy. |
127.0.0.10, .11 | PBL | The address belongs to a range that shouldn’t deliver mail directly, such as home connections. |
A PBL entry by itself only gets a warning. It’s the network owner saying what kind of address this is, and it only matters if that machine really delivers your mail. On the DBL, a code of 100 or more means a legitimate domain that someone is abusing, for example through a hacked page.
“No answer” doesn’t mean you’re listed. Some operators refuse queries that arrive through shared resolvers, or answer with an error code in 127.255.255.x. To get around that, the lookup queries the name servers of Spamhaus, SURBL and URIBL directly. The other lists are reported as unreachable when they stay silent.
Getting off a list
Stop the cause before you ask for anything, or the address will be back on the list within hours. It’s usually a mailbox whose password was stolen, a website form or plugin that relays spam, an infected computer behind the same public address, or a mailing sent to an old or purchased list.
Then follow the removal link shown next to each listing. Spamhaus, Barracuda and SpamCop remove addresses free of charge, and SpamCop and PSBL entries expire by themselves once the spam stops. UCEPROTECT sells an express removal. You can ignore it, since its entries also expire after seven days.
If the listed address belongs to a shared server at your hosting company, you can’t clean it yourself. Report it to the host, or send through a dedicated mail service that has its own addresses.
A clean result only covers public lists. Gmail, Outlook.com and Yahoo keep private reputation data that no outside tool can read, and IPv6 addresses aren’t tested here. Sending services named by an include: in your SPF aren’t followed either.
Questions people ask
How do I know if my email is blocked by a blocklist?
The bounce message tells you. Look for a line such as 550 5.7.1 Service unavailable; client host [203.0.113.7] blocked using zen.spamhaus.org. It names the list and the address. If the notice is hard to read, paste the whole thing into the bounce message decoder.
How long does it take to be removed from a spam blocklist?
From a few minutes to a day for lists with a removal form, once you’ve fixed the cause. Automatic lists drop an address 24 hours to 7 days after the last spam they saw.
Should I pay to be delisted?
No. The lists that large mail servers rely on never charge. A paid “express” option only shortens a waiting period that would end by itself.
My home IP address is on the Spamhaus PBL. Is that a problem?
Not for normal use. Your mail app hands messages to your provider’s server, and that’s the server receivers see. It only matters if you run a mail server on that connection.
Why is my website’s IP address checked for email?
Order confirmations, password resets and contact form messages usually leave from the web server itself. If that address is listed, those messages bounce even though your ordinary mailboxes work fine.