Why Is My IP Blacklisted and How to Get Delisted
If your emails bounce with a message like the one below, the IP address your mail is sent from is on a DNS blacklist (DNSBL). Receiving servers check that list before accepting a message, and they refuse mail from listed addresses.
550 5.7.1 Service unavailable; Client host [203.0.113.5] blocked using zen.spamhaus.org
The good news: most listings can be removed for free once the cause is fixed. The bad news: if you request removal without fixing the cause, the address usually comes straight back. This guide covers what these lists are, why IPs get listed, how to check, and how to get delisted from the lists that matter.
What a DNS blacklist is
A DNSBL is a list of IP addresses (or domains) seen sending spam, infected with malware or otherwise misbehaving, published through DNS so that any mail server can query it in milliseconds. The server reverses the octets of the sender's IP, appends the list's zone and makes a DNS query: an answer in the 127.0.0.x range means "listed", no answer means "not listed". Each list is run by an independent organisation with its own criteria and its own removal rules.
Not all lists carry the same weight. Gmail, Outlook and Yahoo rely mainly on their own sender reputation systems, while public DNSBLs are widely used by corporate mail servers, hosting providers and spam filters such as SpamAssassin and Rspamd. A listing on a major list can therefore block a large share of business mail; a listing on an obscure one may change nothing.
Major and minor lists
| List | What it catches | Weight |
|---|---|---|
| Spamhaus SBL | Spam operations and networks that support them; listings are created manually by Spamhaus staff | High |
| Spamhaus XBL | Infected machines, bots, open proxies | High |
| Spamhaus CSS | IPs with low-reputation sending, such as snowshoe spam or mail to spam traps | High |
| Spamhaus PBL | Ranges that should not send mail directly, usually dynamic or residential — not an accusation of spam | High |
| Spamhaus ZEN | One combined query covering SBL, CSS, XBL and PBL | — |
| Barracuda BRBL | IPs sending spam seen by Barracuda's network | Medium to high |
| SpamCop | User spam reports and spam traps | Medium |
| UCEPROTECT Level 1 | Individual IPs that hit its spam traps (levels 2 and 3 list whole provider networks) | Low to medium |
| PSBL, Mailspike, DroneBL and others | Spam traps, missing reverse DNS, residential addresses | Usually low |
There is also a domain-based side: Spamhaus DBL, SURBL and URIBL list domains that appear in spam and phishing links. If your domain is listed, messages that merely mention it can be filtered, whatever IP they come from.
Why is my IP blacklisted?
Almost always, something on or near that IP sent mail it should not have. The common causes:
- A compromised computer in the office network sending spam through the shared internet connection. This typically lands the IP on Spamhaus XBL.
- A hacked mailbox. A guessed or leaked password lets spammers send through your own authenticated mail server — legitimate-looking, but at volume.
- An open relay or misconfigured server that accepts and forwards mail for anyone.
- A website form or hacked CMS. Contact forms without protection get abused to send messages to arbitrary recipients; a compromised plugin can turn the site into a mailer.
- Sending to bad lists. Purchased or old address lists contain spam traps; hitting them is a classic route to CSS or SBL.
- A neighbour on shared hosting. Hundreds of sites can share one IP, and one of them may be the spammer.
- A dynamic or residential IP. Sending directly from a home connection puts you in the PBL by design.
- Missing or generic reverse DNS. Some lists and filters penalise IPs whose PTR record is missing or looks like a dynamic address.
How to check whether your IP is blacklisted
- Find the right IP. Mail is often not sent from the address in your MX record. If you use Google Workspace, Microsoft 365 or a newsletter service, their IPs send your mail. Open "Show original" on a delivered message and look for the earliest
Received: fromline outside your own network. The MX lookup shows your receiving servers. - Read the bounce. The rejection message usually names the list, as in the example above.
- Run the IP blacklist checker. It queries the working lists for an IPv4 or IPv6 address, and for a domain it checks the site IPs, the mail server IPs from MX and the domain lists DBL, SURBL and URIBL. Each listing comes with the reason code and a delisting link.
- Confirm Spamhaus at the source. Spamhaus refuses queries that come through large public DNS resolvers: through Cloudflare's resolver it returns an error code, through Google's resolver a "not found". Online checkers that use those resolvers may show "listed" or "clean" when the truth is "no answer". The authoritative check is the lookup page at check.spamhaus.org.
How to get delisted
The order matters: fix first, then request removal. Change passwords and enable two-factor authentication on mailboxes, clean infected machines, close open relays, protect or disable abused forms, update the CMS and plugins. Only then go to the list.
- Spamhaus. Look up the IP at check.spamhaus.org and follow the instructions shown for that specific listing. XBL and CSS listings generally offer self-service removal once the problem is fixed. For PBL, if you run a properly configured mail server on a static IP, you can request that your IP be excluded; otherwise send through your provider's mail relay. SBL listings are handled by Spamhaus staff and usually involve the hosting provider or network owner, so contact them.
- Barracuda. Submit the removal request form on barracudacentral.org with the IP, a contact email and a short explanation of what you fixed.
- SpamCop. There is no removal form to chase: a listing usually expires on its own after a period without new reports.
- UCEPROTECT. Level 1 listings expire automatically after a period without new spam. The list offers paid express delisting — you do not have to pay. Levels 2 and 3 cover the whole provider network; talk to your provider.
- Minor lists. Use the self-service removal on the list's website or wait for expiry, and only bother if your mail actually bounces because of them.
On shared hosting, the cause may not be yours at all. Ask the host to move you to a clean IP or, better, send mail through a dedicated email service with its own reputation.
How to stay off blacklists
- Authenticate your mail. Publish SPF, sign with DKIM and set a DMARC policy so that nobody can send in your name convincingly. Check them with the SPF checker and the DMARC checker; how the three fit together is explained in SPF, DKIM and DMARC explained.
- Set up reverse DNS. The PTR record of the sending IP should point to the server's hostname, and that hostname should resolve back to the IP. See checking DNS records.
- Limit outgoing mail. Per-account sending limits on your mail server turn a hacked mailbox into a minor incident instead of a blacklisting.
- Protect forms and the site. Add a CAPTCHA or honeypot, never let a form send to an address the visitor enters, keep the CMS updated, and scan the site regularly with the website security scanner. Signs of compromise are covered in malicious code on a website.
- Mind your lists. No purchased databases, use confirmed opt-in, remove bounces and unsubscribes promptly.
- Monitor. Check your sending IPs and domain on a schedule, and watch bounce messages — a new listing is easiest to fix in its first hours.
Does a blacklisted IP hurt SEO?
Not directly: Google does not use mail blacklists to rank websites, and many unrelated sites share the IPs of large hosts. Domain lists are a different story — a domain on Spamhaus DBL or SURBL gets its links stripped or flagged in email and messengers, and security tools may block it, which hurts traffic and trust. If your domain itself is listed, treat it as a sign that the site or its mail was abused, and clean that up first.