Spamhaus Blocklist Removal (ZEN, SBL, XBL, CSS, DBL, PBL)
How to get off a Spamhaus blocklist: identify whether you're on the SBL, CSS, XBL, PBL or DBL, fix the cause, then use the removal path that list requires.
On this page
To get off a Spamhaus blocklist, first find out which Spamhaus list you're on, because each one has a different removal path. Look up the IP or domain at check.spamhaus.org, fix whatever caused the listing, and then follow that list's process: XBL and CSS listings are self-service (and expire on their own), DBL removals are requested through the same checker, SBL removals must come from the network owner's abuse desk, and PBL is a policy list you usually shouldn't try to leave.
Removal is always free. Spamhaus says so plainly, and any site offering paid Spamhaus delisting is a scam.
For the general playbook (reading bounces, what to say in a removal request), see We Got Blocklisted. This page is the Spamhaus-specific detail.
What a Spamhaus bounce looks like
Most receivers query ZEN, Spamhaus's combined IP zone, so the bounce usually names zen.spamhaus.org rather than the specific list:
554 5.7.1 Service unavailable; Client host [203.0.113.7] blocked
using zen.spamhaus.org; https://check.spamhaus.org/query/ip/203.0.113.7
ZEN is a bundle. It combines the SBL, CSS, XBL and PBL into one lookup, and each list answers with its own return code. If the bounce includes the code, or you query the zone yourself, the code tells you which list you're on:
| Return code | List | What it means |
|---|---|---|
| 127.0.0.2 | SBL | Spamhaus researchers listed the IP or range for spam or other abuse |
| 127.0.0.3 | CSS | Automated listing of an IP sending low-reputation mail |
| 127.0.0.4 | XBL | The IP shows signs of compromise (malware, botnet, exploited host) |
| 127.0.0.9 | DROP | Hijacked or criminal network space (always alongside SBL) |
| 127.0.0.10 | PBL | ISP says this range shouldn't send mail directly |
| 127.0.0.11 | PBL | Spamhaus says this range shouldn't send mail directly |
Domain listings come from a separate zone, dbl.spamhaus.org, with codes in the 127.0.1.x range. A DBL hit can be triggered by any domain in the message, not just your From domain: the HELO name, the MAIL FROM domain, link domains and contact addresses in the body are all checked.
If you don't have the code, the checker at check.spamhaus.org will tell you which list(s) the IP or domain is on.
If a single recipient is rejecting you "for Spamhaus" but check.spamhaus.org says you're clean, the problem may be on their end. Spamhaus blocks queries made through public DNS resolvers and returns error codes such as 127.255.255.254 instead of real data. Spamhaus warns that a server treating those error codes as "listed" can reject legitimate mail. That's the recipient admin's fix, not yours, but it helps to know it exists.
Removal by list
CSS (127.0.0.3): the one most legitimate senders hit
CSS is automated and lists IPs sending low-reputation mail on port 25. It catches snowshoe spammers, but it also catches ordinary businesses with a misconfigured or compromised server. Spamhaus's own list of common causes:
- Poor list hygiene or mail people didn't ask for
- Compromised accounts, CMS installs or web forms being abused to send
- A HELO that isn't a fully qualified hostname matching forward DNS (generic values like
localhost.localdomainormailare classic) - Missing reverse DNS, or a PTR record that doesn't match the HELO
- Mail servers behind a load balancer, which can make the public IP look infected
How to get off it:
- Find the cause. If you run your own mail server, check the HELO and PTR first (the header analyzer shows the HELO in a received message) (example: IP 203.0.113.7, PTR
mail.example.com, HELOmail.example.com, andmail.example.comresolves back to 203.0.113.7). Then look for compromised accounts and abused forms. - Fix it, and confirm the bad traffic has actually stopped.
- Request removal at check.spamhaus.org. Spamhaus describes CSS removal as fast and no-questions-asked, "within limits." Self-removals are limited, so don't burn one before the problem is fixed: if the behavior continues, the IP is relisted immediately.
If you do nothing, CSS listings usually expire about three days after the last detection. Chronic problems keep them listed longer.
XBL (127.0.0.4): a compromised machine
XBL lists IPs that show signs of compromise: malware, botnet infection, exploited hosts. For an office network, it often means one infected laptop behind a shared NAT address. For a server, it can mean a compromised application.
- Find and clean the infected device or service. Read the lookup result at check.spamhaus.org closely for any detail about what was detected.
- Close the hole: outbound port 25 should be blocked for everything except your real mail server.
- Request removal at check.spamhaus.org, the only place XBL removals are handled.
XBL listings also expire on their own once Spamhaus stops seeing the activity. Allow up to 24 hours for removals to propagate before chasing it further.
SBL (127.0.0.2): a human listed you
SBL listings are made manually by Spamhaus researchers, and they're the serious ones. They cover spam operations, snowshoe ranges, bulletproof hosting and hosting of malicious content.
You can't request SBL removal yourself. Spamhaus works SBL removals only with the network owner, meaning the ISP or hosting company that controls the IP space:
- Find and permanently fix the cause. With an SBL listing, that usually means a sending program or a customer on your network doing something specific and deliberate, like mailing purchased or scraped data.
- Explain the fix to your ISP or hosting provider's abuse desk.
- The abuse desk sends the removal request to Spamhaus.
If you're on an ESP's shared or dedicated IPs, your ESP plays the role of the network owner. Open a ticket with them and expect them to ask hard questions about your data.
Don't sit on an SBL listing. Spamhaus says ignored listings, or spam that returns after a claimed fix, can be escalated to a network's wider ranges or its entire ASN, which is why your provider's abuse team will take it seriously.
DBL: your domain, not your IP
The DBL lists domains used in spam, phishing and malware, including legitimate domains that have been hijacked or abused. Because it's attached to the name, changing IPs or ESPs does nothing.
- Look up every domain that appears in your messages, not just your sending domain: link domains, image hosts, your ESP's click-tracking domain, and any partner domains in the footer. Listings apply to subdomains too.
- If your own website was compromised (the "abused-legit" case), take the affected site offline, remove the malicious files, update the CMS and plugins, and change passwords.
- If the listed domain belongs to your ESP or a link shortener, it's their removal to request. Remove the link in the meantime.
- Request removal at check.spamhaus.org. Approved removals can take up to 24 hours to clear everywhere.
DBL listings also expire once the activity stops, but a removal request is not a guarantee: a human may decide the domain stays listed.
PBL (127.0.0.10 or .11): probably not your problem
The PBL isn't an accusation of spamming. It lists IP ranges, mostly consumer broadband, that shouldn't send mail directly to the internet. If you send through an ESP, Google Workspace or Microsoft 365, the PBL doesn't affect you.
It matters only if you run your own mail server on that IP space. Spamhaus allows an end user to exclude an IP at check.spamhaus.org only if all of these are true: the IP is static, it's an outbound mail server, it has matching forward and reverse DNS, and it's assigned to you. Single-IP exclusions expire after a year. If your IP is dynamic, the right fix is to send through your ISP's or provider's authenticated mail server on port 587 or 465 instead.
How to confirm you're off
- Re-check the IP or domain at check.spamhaus.org. Removals usually show quickly, but receivers cache DNS answers, so allow up to 24 hours.
- Watch your bounce logs, not the checker. When rejections citing
zen.spamhaus.orgordbl.spamhaus.orgstop across the receiving domains that were bouncing, you're clear.
Keeping it from coming back
- Watch your own infrastructure. For CSS and XBL, the repeat offenders are compromised accounts and abused web forms. Rate-limit and add CAPTCHA to forms that send mail.
- Keep DNS tidy. HELO, PTR and forward DNS should agree, and should keep agreeing when someone moves the server.
- Fix the data. Spamhaus listings that involve traps or complaints come from mailing people who didn't ask. See why spam traps are a data problem.
- Monitor. A weekly check of your sending IPs and every domain in your templates catches DBL problems early. See which blocklists actually matter for what else to watch.
When to get help
If you have an SBL listing, a DBL listing on your own domain you can't explain, or a CSS listing that keeps coming back after you've used your self-removals, it's worth bringing in someone who has worked Spamhaus listings before. Get in touch.
FAQ
How long does a Spamhaus listing last?
It depends on the list. CSS listings usually expire about three days after the last detection, XBL and DBL listings expire once the activity stops, and SBL listings stay until Spamhaus approves a removal request from the network owner.
Can I remove myself from the SBL?
No. Spamhaus only works SBL removals with the ISP or hosting company that controls the IP. Fix the cause, then ask your provider's abuse desk (or your ESP) to submit the request.
Does a PBL listing mean I'm a spammer?
No. The PBL says an IP range shouldn't send mail directly, usually because it's consumer broadband. It's a policy statement, not a finding of abuse.
Why am I on the DBL when my sending domain is clean?
The DBL checks every domain in the message. A listed link domain, ESP click-tracking domain, URL shortener or partner domain in your footer can cause the rejection.
Sources
Still stuck?
Some deliverability problems take an experienced eye to untangle. Tell me what you're seeing and I'll tell you what I'd check first. The first 30-minute call is free.