Spamhaus SBL Listing: Causes and Removal

A Spamhaus SBL listing means a Spamhaus researcher reviewed activity from your IP or IP range and decided it was spam or other abuse, then wrote a listing record by hand. It's the most serious of the Spamhaus IP lists, and the one you can't remove yourself: only the network owner (the ISP, hosting company or ESP that controls the IP) can request removal, and only after the cause is fixed. Look up the listing at check.spamhaus.org, fix what it describes, then ask your provider's abuse desk to submit the removal.

For the overview of every Spamhaus list, see Spamhaus blocklist removal.

What an SBL bounce looks like

Most receivers query ZEN, Spamhaus's combined zone, so the bounce names ZEN, not the SBL:

554 5.7.1 Service unavailable; Client host [203.0.113.7] blocked
using zen.spamhaus.org; https://check.spamhaus.org/query/ip/203.0.113.7

A manual SBL listing returns 127.0.0.2. Be careful here, because the SBL zone also carries CSS, the automated list, which returns 127.0.0.3. The two are handled completely differently: CSS is self-service and expires in days, while a manual SBL listing stays until Spamhaus approves a removal. If the lookup at check.spamhaus.org shows a numbered SBL record (something like SBL123456) written by a person, it's a manual listing. If it says CSS, see Spamhaus CSS listing instead.

What gets an IP on the SBL

Spamhaus lists IPs and ranges it has identified as malicious. Its published criteria include:

• Spam sources and operations, including IPs hosting websites advertised in spam, and services that support spammers, such as spamware sellers and address scrapers.
• Snowshoe configurations, especially ranges and domains with poor or frequently changing identification.
• Bulletproof hosting, meaning providers that explicitly or tacitly refuse to disconnect customers who spam.
• Hosting malware-infected sites or other malicious content.
• Botnet command and control servers.
• Hijacked IP space.

Two things follow from that list. First, SBL listings aren't only about mail servers. The IP of a web server hosting a site that was advertised in spam can be listed, even if it never sends an email. Second, for a legitimate business, the usual path to the SBL is sending: mailing purchased or scraped data, running high-volume cold outreach across a spread of IPs and domains, or having a customer on your network who does.

Who can remove an SBL listing

Spamhaus's rule is short: only the companies that control the IP space can deal with SBL removals. When Spamhaus lists an IP, it notifies the responsible network or hosting company. The removal request has to come from that provider, sent through the contact link on the listing record.

If you're an end user, Spamhaus's FAQ says to contact your system administrator or ISP. Writing to Spamhaus directly won't get an SBL listing removed. For the shared-pool case in more detail, see My ESP's shared IP is blacklisted.

How to get removed

1. Read the listing record. Look up the IP, range or SBL record number at check.spamhaus.org. The record usually explains why the listing was made. That text is your brief.
2. Stop the traffic. Pause the sending program, campaign or customer named in the record. Continuing to send while listed adds evidence.
3. Find and fix the actual cause. For a sender this is usually the data: where the addresses came from, whether people asked for the mail, and whether old or unknown addresses were ever pruned. If you use several domains or IPs to spread volume, consolidate. If the record points at a compromised host, clean it and close the hole.
4. Write it up for your provider. Be specific: what caused it, what you removed, what you changed so it can't recur. "We've suppressed every address from the trade-show import and switched to confirmed opt-in on that form" is useful. "We're CAN-SPAM compliant" is not. We Got Blocklisted covers what works and what doesn't in a removal request.
5. Your provider submits the removal. Spamhaus decides, and the decision is Spamhaus's alone. Once a listing is removed, the change goes out quickly; Spamhaus rebuilds the SBL zone every five minutes.

Removal is free. Spamhaus says there is never a charge for removing any listing.

How to confirm it's fixed

• Re-check the IP at check.spamhaus.org. A removed manual listing disappears from the record lookup.
• Watch your bounce logs. When rejections naming zen.spamhaus.org or sbl.spamhaus.org stop across the receiving domains that were bouncing, you're clear. Receivers cache DNS results, so allow up to a day.
• Check that you didn't pick up anything else. The same behavior that earns an SBL listing often gets your domain on the DBL too.

Keeping it from coming back

• Mail only people who asked. Purchased, rented and scraped lists are the most common route to an SBL listing for a real business. See why your ESP can't fix your spam trap problem.
• Keep a stable, identifiable footprint. A small, consistent set of IPs and domains, with matching reverse DNS, real websites and working abuse@ and postmaster@ addresses.
• Authenticate everything. SPF, DKIM and DMARC won't keep you off the SBL, but sloppy identity is part of what makes a range look like snowshoe. The email checker shows where you stand.
• If you're a provider, act on abuse reports fast. Spamhaus notifies network owners when it lists their space. Answering those notices promptly is what keeps a single listing from escalating.

When to get help

An SBL listing is worth bringing to an expert if your provider is threatening suspension, the cause isn't obvious from the record, or you've already been relisted once. Get in touch.

FAQ

Can I remove myself from the SBL?

No. Spamhaus only accepts SBL removal requests from the ISP or hosting company that controls the IP. Fix the cause, then ask that provider (or your ESP) to submit it.

What's the difference between SBL and CSS?

Both are in the SBL zone, but CSS is automated, returns 127.0.0.3, and lets you self-remove. A manual SBL listing returns 127.0.0.2, is written by a researcher, and only the network owner can request its removal.

How long does an SBL listing last?

Spamhaus doesn't publish a fixed duration. A manual listing stays until Spamhaus approves a removal request from the network owner.

My ESP's IP is on the SBL. Is that my problem?

The removal is the ESP's job, since they own the IP. Whether the cause is yours depends on what the pool sent, so expect questions about your list sources and answer them honestly.