Spamhaus DBL: Why Your Domain Is Listed

A Spamhaus DBL (Domain Blocklist) listing means a domain in your mail, not your IP, has been tied to spam, phishing, malware or other bad reputation. The listed domain is often not your From domain: receivers check the HELO name, the envelope sender, and every link and address in the message, so a click-tracking domain, URL shortener or partner link can be the culprit. Find the listed domain at check.spamhaus.org, fix whatever got it listed, and request removal there. Removal is free, and most listings also expire on their own once the activity stops.

For the other Spamhaus lists, see Spamhaus blocklist removal.

What a DBL bounce looks like

There's no single DBL bounce; the wording depends on the receiving server. A Postfix server rejecting on the envelope sender's domain, using its default reply template, produces something like this:

554 5.7.1 Service unavailable; Sender address [mail.example.com]
blocked using dbl.spamhaus.org

The giveaway is dbl.spamhaus.org rather than zen.spamhaus.org. Many DBL hits don't produce a clear bounce at all, because the check happens on links in the body after the message is accepted, and the result is a spam folder or a quarantine rather than a rejection.

The return code tells you why

The DBL answers with codes in the 127.0.1.x range, and each one carries meaning:

The 127.0.1.1xx codes are the "abused-legit" family: Spamhaus thinks the domain is a real site that has been compromised or misused. In those cases Spamhaus lists the specific hostname rather than the whole domain, so the rest of your site isn't caught.

Answers such as 127.255.255.254 are not listings. They're errors, usually because the receiver is querying through a public DNS resolver, which Spamhaus blocks.

Which domains get checked

Spamhaus describes three points where a receiver can check domains against the DBL:

1. At connection: the hostname from the connecting IP's reverse DNS.
2. During the SMTP conversation: the HELO name and the MAIL FROM (envelope sender) domain.
3. After the message is accepted: every domain in the headers and body, including link domains and contact addresses.

A listing on a domain also covers its subdomains. If example.com is listed, links.example.com is caught too.

That's why a DBL problem can appear when your sending domain is spotless. Common culprits:

• Your ESP's shared click-tracking domain, listed because of another customer's mail.
• A URL shortener that someone else abused.
• A partner, affiliate or sponsor domain in your footer or content.
• Your own website, compromised and hosting phishing pages or malware.
• A brand-new domain. Spamhaus says unknown domains carry a much higher risk of spam, so unknown reputations start as "poor" by default. A domain registered last week and used in a large send looks a lot like a throwaway. See why email from a new domain goes to spam.

How to get off the DBL

1. Inventory every domain in the message. Pull the raw source of a bounced or spam-foldered message and list every domain: From, Return-Path, HELO (in the Received headers), every link after redirects, image hosts, tracking pixels and footer links. The header analyzer helps with the headers.
2. Look each one up at check.spamhaus.org. Note the return code for any hit.
3. Work out whose domain it is.
   • Your ESP's tracking or image domain: their removal to request. Open a ticket. If you can, set up a branded tracking domain on your own domain so other customers' behavior stops being attached to your mail.
   • A shortener or third-party link: remove the link from your templates now. Waiting on someone else's removal isn't a plan.
   • Your own domain, abused-legit code: treat it as a security incident. Take the affected pages offline, remove malicious files, update the CMS and plugins, secure the server, and change passwords.
   • Your own domain, plain spam code: the domain's own mail or links are the problem. Look at who you're mailing and how. Purchased lists, aggressive cold outreach and domain rotation all point here.
4. Request removal at check.spamhaus.org, which Spamhaus says is the only place DBL removals are handled. The form doesn't guarantee removal, and Spamhaus may block people who submit excessive requests, so submit once, after the fix.

Approved removals take effect almost immediately at Spamhaus, but some receivers can take up to 24 hours to drop the domain from their local copies. If it's still listed after 24 hours, Spamhaus asks you to contact them.

How to confirm it's fixed

• Re-check every domain at check.spamhaus.org, not just the one you fixed. It's common to find a second listed domain once the first is gone.
• Watch bounces naming dbl.spamhaus.org, and watch placement at providers that were sending you to spam. Body-link DBL hits often show up as junk placement rather than rejections, so a seed test or a look at engagement by domain is a better check than the bounce log alone.

Keeping it from coming back

• Use domains you control. Branded tracking and image domains on your own domain mean your reputation depends on your mail, not your ESP's other customers.
• Keep the domain list short. Spamhaus's sender guidance is to use your main business domain or a subdomain of it, with a real website, real WHOIS details, and working abuse@ and postmaster@ addresses.
• Don't link to strangers. Every domain in your template is a dependency on someone else's reputation. Audit footers and sponsor links.
• Patch your site. Most abused-legit listings start with an outdated CMS or plugin.
• Check on a schedule. Look up every domain in your templates monthly, and whenever you add a new one. Which blocklists actually matter covers what else to monitor.

When to get help

If your own domain is listed with a spam code and you can't see why, or listings keep coming back after removal, it's worth having someone who has worked DBL cases look at your sending and your data. Get in touch.

FAQ

Why is my domain on the DBL when I haven't sent any spam?

The DBL checks every domain in the message, so a listed tracking domain, shortener or partner link can trigger it. Your own domain can also be listed if your website was compromised, or if it's new enough that it has no reputation yet.

How long does a DBL listing last?

Spamhaus says most DBL listings expire automatically once the domain stops showing the activity that caused them. They can relist automatically if that activity comes back.

Will changing my ESP fix a DBL listing?

No. The listing is on the domain name. If the listed domain is yours, it follows you to any ESP; if it's your ESP's, removing their link or using your own branded tracking domain is the fix.

Does Spamhaus charge to remove a domain?

No. Spamhaus says there is never any charge for removing any listing. Anyone offering paid Spamhaus delisting is not Spamhaus.