How to check Spamhaus blocklists (and remove your IP if you’re on one)

Spamhaus says it protects over 3 billion mailboxes. While this is great for most email users, your sender reputation and deliverability will be at risk if your IP or domain is added to one of these lists. 

But it's not all bad news: Checking if you're on one of the lists is simple, and there are steps you can take to remove yourself. Plus, avoiding the lists in the first place is easy when you follow some email-sending best practices.   

In this article, we’ll introduce the main Spamhaus blocklists, show you how to tell if you’re on one, and list the steps you can take to get your IP or domain off the list.

What is a Spamhaus blocklist?

Spamhaus blocklists are databases of IP addresses identified as sources of spam or other cyber threats. The blocklists are compiled by The Spamhaus Project, a non-profit organization that tracks bad actors online. The organization uses both automated and manual techniques to identify dangerous or low-quality IP addresses and domains and add them to the lists.

How does Spamhaus blocklisting work?

Spamhaus blocklists are used by organizations including internet service providers (ISPs), email inbox providers, and even governments to identify and block domains and IPs that produce spam and other cyber threats. 

In the case of inbox providers, these businesses check incoming emails in real time against listings in the database. If the domain or IP is on the list, the business can block the incoming content, tag it as spam, or perform further checks to determine the best course of action.

The impact of this on email marketers is clear: Ending up on one of the Spamhaus lists will significantly increase the chances of your emails bouncing or going to the spam folder as well as damage your hard-earned sender reputation.

Types of Spamhaus blocklists

There are multiple Spamhaus blocklists and each one contains a different type of IP or domain. Spamhaus Zen, the penultimate item, is a single database that combines all the IPs from the SBL, CSS, XBL, and PBL lists. 

Here’s a rundown of the main lists and the types of IPs or domains they contain.

SBL

The Spamhaus blocklist (SBL) contains IP addresses that the organization recommends people do not accept email from. IP addresses are listed when they are used by or appear to be made available for use by spammers, cybercriminals, or other internet-based threats. 

CSS

The Spamhaus Composite Block List (CSS) is part of the SBL. It’s an automatically produced list of IP addresses that send low-quality email types not covered by the PBL and XBL lists (more on these below). 

IPs that end up on this list typically include compromised hosts and snowshoe spammers. The latter is a technique where spam is sent via several domains and IP addresses, thus making it more difficult for inbox providers to identify. 

XBL

The Spamhaus Exploits Block List (XBL) is a database of IP addresses that are associated with devices such as routers or connected devices that have been compromised by third-party attacks. 

This is important because when a connected device is infected, it may result in the IP being used as a spambot or as a source of malware or other forms of attacks. 

PBL

The Spamhaus Policy Block List (PBL) contains IP addresses that should not be sending email directly to the internet. These IP addresses typically belong to ISPs or organizations with dynamic or residential IP address ranges not intended for outgoing email server use. 

Spamhaus Zen

Spamhaus Zen is a blocklist made up of all the IPs on the blocklists listed above. Having all the lists combined into a single source makes it easy for organizations that use the service to identify and block emails from low-quality sources. 

DBL

The Spamhaus Domain Block List (DBL) is a list of domain names that have a poor domain reputation based on factors like their use in spam or cybercrime. 

The list is compiled automatically and published in the Domain Name System Block List (DNSBL) format, although Spamhaus researchers will add or remove domains from the list manually when necessary. 

How do I check if I am on the Spamhaus blocklist?

Domains and IPs can be added to a Spamhaus database without any prior notice or warning. The first sign that your IP or domain has been added is often a reduction in email deliverability. 

If you notice more of your emails are bouncing than normal, it’s worth checking if you’ve been added to the list. 

Here are 3 ways you can confirm whether this is the case. 

1. Manually check at Spamhaus

Spamhaus has a handy lookup tool you can use to check if your IP is on a blocklist. Search for your IP or domain and the tool will tell you whether or not you are being blocked. If you’re not on the list, you’ll receive a confirmation like in the image below.

If you are on a list, the tool will provide information about which list you are included on and further instructions for how to remove your domain.

2. Use deliverability tools that check blocklists

Running a deliverability test with MailerCheck’s Inbox insights will tell you if your domain or IP is on the Spamhaus blocklist.

There are 2 major benefits of using a deliverability tool over manually checking the list: 

1. MailerCheck doesn’t only check Spamhaus blocklists: It also looks at 39 of the most impactful blocklists. When using the tool, you’ll save a ton of time when compared to manually checking all the lists. 

2. MailerCheck will look at your email for other issues that could be impacting deliverability, such as whether your content has spam trigger words or technical issues such as broken links or HTML validation. 

Using a deliverability tool gives you a comprehensive overview of any factors that may be impacting email deliverability, so you can take steps to improve the impact of your email marketing.  

3. Set up a blocklist monitor for real-time notifications

Blocklist monitoring is an email deliverability tool feature that alerts you as soon as your IP or domain is added to a blocklist. 

This lets you take proactive steps to remove your account. You’ll minimize the negative impact of being added to a blocklist and increase the chances of your subscribers seeing your messages. 

A blocklist monitoring tool like MailerCheck will also provide links to delisting pages and provide instructions on how to get the process started. See an example report in the image below.

Common reasons to get blocklisted

Your domain will be added to a Spamhaus blocklist if it is a source of spam or cyber threats, or if it is associated with other IPs and domains that are sources of this type of content.

Spam email sending

Spamhaus defines spam as “unsolicited bulk email.” It doesn’t assess the content of the email. If your domain or IP address is a source of unsolicited bulk email, it may be added to the list. 

Spamhaus has multiple ways of identifying spam senders including through the use of spam traps—email addresses set up to catch spam senders. Keep these addresses off your list by using good email collection habits and through regular contact list cleaning.

Spam hosting

Your IP or domain can be added to the list if it or related domains host spam websites or resources used by spammers such as spamware, scrapers or bulletproof hosts (hosting platforms that accept spammers, whether intentionally or unintentionally).

Security threats

If your domain hosts botnets, malware, phishing sites, ransomware, or is the source of hacking attempts, you’ll be added to the list. 

Like with the above two points, you may be considered a threat if you are associated with bad sites or if you have been hacked.  

Poor domain history

If you’ve recently bought a domain, it may be on a Spamhaus blocklist if it was used for spam by its previous owner. 

How to remove your IP or domain from a Spamhaus blocklist

There are clear steps you can take to delist your domain from the Spamhaus blocklists if you end up on one.

You’ll have to identify why your account was added, fix any issues and then request removal. 

1. Discover why you’re listed

Head to the Spamhaus lookup tool and search for your domain. Review the reasons why your domain was listed. 

2. Take steps to solve the issues

Now for the hard part. To get removed from the list, you’ll need to solve the problem that led you to be listed in the first place. 

If you don’t recognize the issues, ensure that your email IP is secure and not being used by spammers. You may also need to identify and remove malware from your network. 

If your email marketing provider uses a shared IP for multiple clients, consider moving to a provider that is more selective about the types of businesses it allows to use its services or request a dedicated IP. 

3. Request domain removal 

The exact steps you take to get removed will depend on the specific blocklist you end up on.

If you end up on the SBL, the ISP that manages your IP must contact the relevant Spamhaus SBL address requesting removal. As an end user, you’ll have to contact your ISP, email service provider (ESP), or system administrator for help. 

But if you’re on the DBL or PBL list, you can use the tool’s blocklist removal center link. In some cases, Spamhaus will automatically notice a domain is no longer being used for spam and remove the listing automatically. 

4. Wait

Spamhaus will review the removal request and approve it if they are satisfied that your domain is no longer a spam risk. They typically respond to removal requests within 24 hours.

How to stay away from blocklists

Assuming you’re not actively involved in sending spam, it should be fairly simple to avoid landing on one of these lists. 

Just follow these 4 steps:

1. Don’t send mass unsolicited email 

You might not consider the messages you send to be spam. But they may be interpreted as such if you’re messaging large numbers of people who haven’t given you permission to contact them. 

When sending emails, avoid buying lists, collect permission on your signup forms, and use MailerCheck’s Inbox Insights to analyze your email content for signs of spam.

2. Keep your system secure 

Your IP, domain and even the devices that connect to your network can be hacked and used by spammers or cybercriminals. Keep your system secure to ensure this doesn’t happen. 

You can also use DMARC monitoring tools to track the use of your domain to quickly spot unauthorized activity and shut it down.

3. Keep your email list clean

Spamhaus uses spam traps, email addresses set up with the purpose of catching spammers, to identify spam senders. 

Use an email cleaning service to identify known spam traps and remove them from your list. Also, use techniques like double opt-in to only let legitimate addresses onto your list in the first place. 

4. Authenticate your email systems 

Set up DKIM, DMARC, and SPF authentication if you haven’t already. This keeps your emails safe by ensuring your email isn’t modified in transition (DKIM), preventing spoofing and phishing attacks (DMARC), and confirming you as the owner of the emails (SPF). 

5. Use reputable email and hosting providers 

You can be added to an email blocklist if your IP or domain is associated with spammers or cybercriminals. Choose providers with strong standards for the types of businesses they allow to use their services. 

Spamhaus isn’t trying to stop legitimate senders

Spamhaus is an organization that tries to identify and stop spammers and other bad actors. It’s not trying to catch out regular email senders. 

With this in mind, avoiding the Spamhaus blocklist should be relatively simple as long as you follow the above email-sending best practices. 

And, if you do end up on the list, you can always use the tips in this article to remove your domain or account. 

Has your IP or domain ever been added to a Spamhaus blocklist? And how were you able to remove the listing? Let us know in the comments!