Blacklist removal playbook, list by list
What to do when your mail server IP or domain appears on a DNS blocklist: find the cause, fix it, request removal from each list and prevent relisting.
How DNS blocklists work
A DNS blocklist (DNSBL, described in RFC 5782) publishes the IP addresses its operator considers sources of spam or abuse. A receiving mail server checks a connecting IP by reversing its octets and looking up an A record under the list's zone. An answer in 127.0.0.0/8 means listed, and no answer means not listed; the specific code often tells you why.
; is 192.0.2.25 listed on the zone dnsbl.example.net?
dig +short 25.2.0.192.dnsbl.example.net A
127.0.0.2
; many lists explain the listing in a TXT record at the same name
dig +short 25.2.0.192.dnsbl.example.net TXTReceivers choose which lists to use and how much weight to give them. A listing on a list that major providers rely on can cause rejections everywhere, while a listing on a small list may affect only a handful of servers. Domain-based lists work the same way for domains found in message links or sender addresses.
Step 1: confirm what is listed and why
Start with facts. Check the IP address of every server that sends your mail with the Blacklist Check, and check your domain as well if you suspect a domain listing. Note the list, the return code and the date.
Make sure you are checking the right address. The sending IP is in the bounce message or in the first Received header added by the receiver, not necessarily the IP of your website. Hosted mailbox providers send from their own shared pools, and a listing of one of their IPs is their problem to handle, not yours.
| Result | Meaning | Action |
|---|---|---|
| Listed | The list returned a listing code for the IP | Continue with this playbook |
| Query refused | The list refused the lookup (for example code 127.255.255.254) | Not a listing; the query came through a resolver the list blocks |
| Not listed | No record for the IP | Nothing to do for this list |
Test addresses
127.0.0.2 is the conventional test entry that DNSBLs report as listed. Use it to confirm that a checker works, not as evidence about your own servers.Does the listing actually affect your mail?
The fastest evidence is in bounce messages. Receivers that reject mail because of a blocklist usually say so in the SMTP response, often naming the list. A reply like the one below tells you which list matters and that the rejection happened at connection time, before the content was even looked at.
554 5.7.1 Service unavailable; Client host [192.0.2.25] blocked using zen.spamhaus.orgIf bounces do not mention a list and delivery looks normal, a listing on a small list may have no visible effect. It is still worth fixing the cause, because the same abuse tends to reach the larger lists next. If mail is going to spam rather than bouncing, look at provider reputation data and authentication as well; blocklists are only one input.
Cloud and shared hosting addresses
Many cloud providers block outbound port 25 on new accounts, and their address ranges are often listed on policy lists because they are not meant to send mail directly. Mail from applications in the cloud should go through an email sending service or your mailbox provider's authenticated SMTP. On shared hosting, the IP is used by many customers, so a listing may be caused by someone else; move your mail to a dedicated sending service rather than fighting listings you cannot control.
Step 2: find the cause
Almost every listing of a legitimate server comes from one of a few causes. Work through them in order of likelihood. Removal requests that say "we fixed it" without a real fix usually lead to relisting within days, and some lists make the next removal harder.
| Cause | Signs | Where to look |
|---|---|---|
| Compromised mailbox or SMTP credentials | Sudden spikes of outbound mail from one account, many recipients abroad | Authentication logs, per-user send counts |
| Infected machine on the network | Direct port 25 connections from office PCs, bad HELO names | Firewall logs for outbound port 25 |
| Vulnerable web form or CMS plugin | Mail sent by the web server user, form spam | Web server logs, mail logs filtered by local sender |
| Open relay or misconfigured server | Mail from outside relayed to outside | Relay settings, a relay test from an external host |
| Poor list quality | Bounces from invalid addresses, spam trap hits | Campaign bounce reports, list sources |
| Dynamic or residential IP sending directly | Policy listing for the IP range | ISP documentation; use a smarthost |
# size of the queue and who is in it
postqueue -p | tail -1
postqueue -p | grep -Eo '<[^>]+>' | sort | uniq -c | sort -rn | head
# Exim equivalents
exim -bpc
exim -bp | exiqsumm | head
# which authenticated users sent the most mail today (Postfix)
grep 'sasl_username' /var/log/mail.log | grep -o 'sasl_username=[^,]*' | sort | uniq -c | sort -rn | headIf an account is compromised, the queue usually shows it immediately: thousands of messages to unrelated recipients from one sender. Stop the abuse before anything else, because every hour of spam adds reports and spam-trap hits.
Step 3: stop the abuse and secure the system
- Suspend the compromised account or disable the vulnerable form or script.
- Remove queued spam so it is not delivered after the fix.
- Reset passwords, revoke application passwords and API keys, and enable multi-factor authentication for the account.
- Patch or remove the vulnerable software; clean infected machines.
- Block outbound port 25 for everything except your mail servers.
- Add rate limits per authenticated user, so a future compromise is contained.
For list-quality problems the fix is in the list, not the server. Remove addresses that bounced, stop sending to purchased or scraped lists, and require confirmed opt-in for new sign-ups. Spam traps are addresses that never subscribed, so they only appear in lists built the wrong way.
Keep evidence
Step 4: request removal, list by list
Always use the operator's own website, reached by typing its address, never a removal link in an email. Be wary of services that charge to "delist" you from a list: legitimate major lists do not require payment for removal. The lists below are the ones the XGM Blacklist Check queries.
Spamhaus ZEN (zen.spamhaus.org)
ZEN combines several Spamhaus lists: the SBL for spam sources and operations, the XBL for exploited and infected hosts, and the PBL for address ranges that should not send mail directly to the internet. The return code identifies the list, and the Spamhaus website explains a listing when you enter the IP address. Many large receivers use Spamhaus data, so this listing usually matters most.
- PBL: not a sign of abuse. It lists ranges such as consumer connections. If you run a legitimate mail server on a static IP, you can request removal on the Spamhaus site, or send through your provider's smarthost instead.
- XBL: an infected or exploited host used your IP. Fix the host first; removal is self-service once the problem is gone, and the listing returns if the activity continues.
- SBL: a manual listing for spam or abuse. Read the listing record and follow its instructions; often the network owner or ISP needs to be involved.
Spamhaus blocks queries that come through large public DNS resolvers and answers them with codes such as 127.255.255.254 instead of a real result. That is why a checker using a public resolver may show a refusal. Mail servers checking Spamhaus should use their own resolver and follow Spamhaus's usage terms.
SpamCop (bl.spamcop.net)
SpamCop lists IPs based on recent spam reports from its users. Listings are temporary and expire automatically once reports stop, so the main task is to stop the spam. The SpamCop website shows why an IP is listed when you look it up.
Barracuda Reputation Block List (b.barracudacentral.org)
Barracuda's list is used by Barracuda appliances and some other receivers. It offers a removal request form on its website where you enter the IP, a contact address and an explanation. Requests are reviewed, so describe the cause and the fix concisely.
PSBL (psbl.surriel.com)
The Passive Spam Block List lists IPs that sent mail to its spam traps. It has a self-service removal page on its website. If the spam continues, the IP is listed again automatically.
Unsubscore UBL (ubl.unsubscore.com)
This list is operated by LashBack and focuses on senders who misuse unsubscribe requests. Look up the IP on the operator's website for the reason and the removal process. For bulk senders, reviewing unsubscribe handling is usually the fix.
Other lists
The same approach works for any list: find the operator's website, read the listing policy, fix the cause and use the official removal process. If a list's website no longer works or shows no removal process, check whether receivers you care about still use it before spending time on it.
What to write in a removal request
Operators read many requests, and short factual ones get handled fastest. State the IP, what caused the listing, what you changed and how you will prevent a repeat. Do not argue that the list is wrong unless you have evidence, and do not send several requests for the same IP.
IP address: 192.0.2.25 (mail.example.com)
Cause: a mailbox password was phished on 2026-09-12 and used to send spam
through authenticated SMTP between 14:10 and 16:40 UTC.
Fixed: account suspended at 16:42, queued spam deleted, password reset,
MFA enforced for all users, per-user sending limit of 500 messages/hour.
Contact: postmaster@example.comStep 5: monitor and prevent
Recheck the lists daily for the first week and weekly after that. A new listing shortly after removal means the cause was not fully fixed, so go back to step 2 rather than filing another request. Watch bounce rates and deferrals at large receivers as well, because some providers keep their own reputation data that recovers more slowly than public lists.
- Enforce multi-factor authentication and alert on unusual sending volume per account.
- Allow outbound port 25 only from mail servers.
- Keep web applications and plugins patched; add CAPTCHA or rate limits to forms that send mail.
- Set up forward-confirmed reverse DNS for sending IPs, so they do not look like dynamic addresses.
- Publish SPF, DKIM and DMARC and read DMARC aggregate reports; a new unknown source shows up there early.
- Schedule a monthly check of your sending IPs with the Blacklist Check.
Separate streams help limit damage: when newsletters, transactional mail and staff mail use different IPs or providers, a listing caused by one stream does not stop the others. The deliverability checklist covers the rest of the setup.
FAQ
How long does blocklist removal take?
It depends on the list. Some listings expire automatically once abuse stops, self-service removals are often processed within hours, and manual reviews take longer. Fixing the cause first is what makes removal stick.
Should I pay a service to get delisted?
No. Major lists do not charge for removal, and paying a third party cannot remove the underlying cause. Use the operator's own website.
My website IP is listed; does that affect email?
Only if mail is sent from that IP. Check the IP in the Received headers of your outgoing mail. Shared hosting IPs can be listed because of other customers, in which case move mail to a dedicated sending service.
What does query refused mean in the checker?
The list refused to answer, typically because the query came from a public DNS resolver it does not serve. It is not a listing, but it means that list could not be checked from there.
Why was I listed again right after removal?
The source of spam is still active: another compromised account, a second infected machine or the same list problem. Go back to the logs before requesting removal again.
Can a domain be blocklisted as well as an IP?
Yes. Domain blocklists list domains that appear in spam, for example in links. Removal works the same way: find why the domain appeared in spam, fix it and follow the list's process.