Spamhaus CSS Listing: Why Snowshoe-Style Sending Gets Listed

A Spamhaus CSS (Combined Spam Sources) listing means Spamhaus's automated systems saw low-reputation mail coming from your IP on port 25. It is aimed at snowshoe spam, where volume is spread across many IPs and domains to stay under filters, but it also catches ordinary senders whose setup looks like that, or whose server is misconfigured or compromised. Fix the cause first, then remove the IP yourself at check.spamhaus.org. If you do nothing, the listing normally expires about three days after the last detection.

This page goes deeper on CSS specifically. For every Spamhaus list in one place, see Spamhaus blocklist removal.

What a CSS bounce looks like

CSS is published inside the SBL zone and the combined ZEN zone, so the rejection usually names ZEN rather than CSS:

554 5.7.1 Service unavailable; Client host [203.0.113.7] blocked
using zen.spamhaus.org; https://check.spamhaus.org/query/ip/203.0.113.7

The list that matters is identified by the return code. CSS answers with 127.0.0.3. If your bounce doesn't include the code, look the IP up at check.spamhaus.org and it will say which dataset it's in. A lookup that shows CSS (not a numbered SBL record written by a researcher) tells you this was an automated detection, which is good news: it's the most forgiving list Spamhaus runs.

What CSS lists, and what it doesn't

Spamhaus describes CSS as an automatically produced dataset of IPs sending low-reputation email. A few details from its documentation shape how you should think about it:

• Port 25 only. CSS lists IPs based on SMTP traffic on port 25, meaning server-to-server delivery. It's about the machine that hands mail to the receiver.
• IPv4 and IPv6. IPv4 listings are single addresses. IPv6 listings are a /64 or larger, and can widen if many addresses in one network are spamming.
• Automated. No one at Spamhaus decided you're a spammer. A pattern did.
• Short-lived. Listings normally expire three days after the last detection, though chronic abuse can keep an IP listed longer.

The SBL proper, which is written by human researchers, also lists snowshoe operations, often whole ranges. If you're seeing a numbered SBL listing rather than CSS, that's a different and more serious problem; see Spamhaus SBL listing: causes and removal.

What snowshoe sending is, and why legitimate senders trip over it

Spamhaus defines snowshoe spamming as a sending technique that evolved to avoid filters. The name comes from the snowshoe itself: spread the weight over a wide area and you don't sink. A snowshoe operation spreads its volume across lots of IPs, often in different networks, and lots of throwaway domains, so no single IP or domain sends enough to get noticed. A variant Spamhaus calls hailstorm spam does the opposite with time: emitters appear out of nowhere, send at very high intensity, and stop after a few minutes.

Spammers aren't the only ones who end up with that shape. Legitimate setups that look snowshoe-like:

• Domain rotation for outreach. Sales teams buying a dozen look-alike domains (example-mail.com, getexample.com, tryexample.com) and spreading cold email across them so each one "stays under the limits." That is, structurally, snowshoeing.
• IPs spread across providers. A few IPs at one host, a few at another, a few at a third. Spamhaus's own guidance calls spreading sending across many IPs and networks "the definition of snowshoeing," and recommends a small, permanent, well-identified range of sending IPs instead.
• Unidentifiable infrastructure. Hostnames that don't match anything, domains with no website, anonymized WHOIS, and no working abuse@ or postmaster@ addresses. Spamhaus lists all of these as things that make you look like a spammer.

Then there are the causes that have nothing to do with how many domains you use. Spamhaus's documented triggers for CSS include:

• Mail people didn't ask for, or poor list hygiene
• Compromised accounts, insecure CMS installs or abused web forms sending through your server
• A HELO/EHLO name that isn't a fully qualified hostname matching forward DNS (generic names such as localhost.localdomain, WIN-XYZPDQ01 or mail are the classics)
• Missing reverse DNS, or a PTR record that points somewhere other than the HELO name
• Mail servers sitting behind a load balancer, which can make the public IP look infected with malware

How to get off the CSS

Spamhaus is blunt about the order: the cause must be identified and corrected before you remove the IP. CSS will remove an IP on request, and it will relist it immediately if the problem is still being detected. Self-removals are limited, so a removal used before the fix is a removal wasted.

1. Confirm it's CSS. Look up the IP at check.spamhaus.org. Check related domains (your HELO name, your sending domains) while you're there.
2. Check identity basics. If you run the server, line up HELO, PTR and forward DNS. For 203.0.113.7 that might be: PTR mail.example.com, HELO mail.example.com, and mail.example.com resolving back to 203.0.113.7. The header analyzer shows the HELO name in a received message.
3. Rule out compromise. Look at outbound logs for traffic you don't recognize: unusual volume, recipients you've never mailed, a web form sending far more than it should. If the listed traffic doesn't look like anything you knowingly send, assume compromise until proven otherwise.
4. Look at the shape of your sending. If you're rotating domains or spreading IPs to keep volume per identity low, consolidate. Send from your main domain or a subdomain of it, from as few IPs as your volume needs, ideally contiguous.
5. Look at the data. If the traffic is yours and it's clean technically, the problem is who you're mailing. Purchased, scraped or stale lists produce exactly the complaints and trap hits CSS reacts to. See why your ESP can't fix your spam trap problem.
6. Request removal at check.spamhaus.org. It's free; Spamhaus never charges for removal.

If you're on an ESP

CSS listings are about the IP that hands mail to the receiver. If that IP belongs to your ESP, whether shared or dedicated, the ESP owns the removal and the infrastructure fixes. Your part is your data and your sending pattern. See My ESP's shared IP is blacklisted for who owns what on a shared pool.

How to confirm it's fixed

• Re-check the IP at check.spamhaus.org. If it's relisted within hours of a removal, the cause is still active.
• Watch your bounce logs. When rejections naming zen.spamhaus.org stop across the receiving domains that were bouncing, you're clear. Receivers cache DNS answers, so allow up to a day.

Keeping it from coming back

• Keep a small, stable, well-identified set of sending IPs and domains, with a website and working abuse@ and postmaster@ for each domain.
• Keep HELO, PTR and forward DNS consistent, and recheck them when servers move.
• Authenticate everything with SPF and DKIM, and keep SPF narrow. The email checker shows what you publish.
• Rate-limit and CAPTCHA any web form that sends mail.
• Watch your sending IPs on a schedule rather than waiting for bounces. Which blocklists actually matter covers what's worth monitoring.

When to get help

If a CSS listing keeps coming back after you've fixed the obvious things, or it's escalated into an SBL record, it's worth bringing in someone who has worked Spamhaus listings before. Get in touch.

FAQ

Is a CSS listing the same as being on the SBL?

Not quite. CSS is an automated dataset published inside the SBL zone and returns 127.0.0.3. A manual SBL listing is written by a Spamhaus researcher, has its own record, and can only be removed through the network owner.

How long does a CSS listing last?

Normally about three days after the last spam detection, according to Spamhaus. Chronic problems can keep the IP listed longer.

Can I just remove myself again if it comes back?

Only a limited number of times. Spamhaus relists immediately if the problem continues, so fix the cause before you use a removal.

Does using several sending domains get me on the CSS?

Using several domains isn't a violation on its own, but spreading the same mail across many domains or networks to keep each one under the radar is what snowshoe sending looks like, and Spamhaus says it raises flags. Consolidate where you can.