Trend Micro ERS (Email Reputation Services) Delisting

If your mail is rejected with "blocked using Trend Micro RBL+" or deferred by a Trend Micro gateway, your sending IP is in Trend Micro's Email Reputation Services (ERS) database. Look the IP up in Trend Micro's ERS lookup tool to see which list it's on, fix what caused it, then click Remove and submit a request. Trend Micro wants that request from an authoritative address such as abuse@ or postmaster@ at the domain that owns the IP. Short-term QIL listings clear on their own within 5 minutes to 12 hours; RBL+ listings go through an investigation and a probation period.

For the general blocklist playbook, see We Got Blocklisted. This page is the Trend Micro part.

Who uses Trend Micro ERS

ERS is the IP reputation service built into Trend Micro's mail security products, including Trend Micro Email Security, InterScan Messaging Security and Worry-Free Business Security. It isn't a public DNSBL that random mail servers query. It matters when you're mailing companies that filter their mail through Trend Micro, so a listing usually shows up as bounces from a specific set of business domains rather than from Gmail or Outlook.com.

What the bounce looks like

Trend Micro's own help shows the RBL+ rejection in this form, with the listed IP in square brackets:

550 Service unavailable; Client host [203.0.113.7] blocked using Trend Micro RBL+.

The bounce often includes a lookup link with your IP as a parameter. The IP in the brackets is the one to look up, and it should be your public sending IP. If it's a private address, or you looked up a different IP than the one in the bounce, you're checking the wrong thing.

Trend Micro products behave differently depending on which database the IP is in:

The QIL deferral is the one people misread. Your server gets a temporary failure, queues the mail and retries, so the symptom is delayed mail to Trend Micro customers rather than outright bounces. Trend Micro says QIL listings last from 5 minutes to 12 hours, depending on how often the IP has been added.

A note on gateway blocks: a Trend Micro customer can also block you in their own settings (their sender filtering block list). Trend Micro's support docs show its InterScan appliance answering "544 Transaction failed" both for ERS listings and for these local blocks, so the error alone doesn't tell you which it is. If the ERS lookup shows your IP as clean but one company keeps rejecting you, the block is local to that company and only their admin can lift it.

Why IPs get listed

Trend Micro's descriptions of its lists point to the usual causes:

• Being a spam source. Trend Micro describes RBL+ as known sources of spam and the QIL as IPs caught sending spam. For a legitimate sender, that usually traces back to mailing people who didn't ask, or old, unpruned data.
• A compromised account or form sending through your server.
• Dynamic or residential IP space. The DUL covers dynamically assigned addresses and ranges whose policy says they shouldn't host public mail servers.
• Open relays and proxies. A mail server or proxy that relays mail for anyone ends up on the RSS or OPS lists.

How to get delisted

1. Find the right IP. Take it from the bounce, not from your server's local network settings.
2. Look it up in the ERS portal's IP reputation lookup. It takes IP addresses only, not hostnames or domains, and shows which database the IP is in.
3. Fix the cause. Stop the spam source, close any open relay or proxy, clean compromised accounts, and deal with the list data behind the complaints. If the IP is dynamic, route outbound mail through your ISP's or provider's relay instead of trying to delist it.
4. Submit the removal request. On the lookup result, click Remove, complete the form and send it. Trend Micro asks for the request to come from an authoritative account, such as abuse@ or postmaster@ at the domain that owns the IP block, so it can confirm it's dealing with the real owner. If you aren't the administrator or the provider, send the request to whoever is. Trend Micro recommends writing in English for a faster resolution.
5. Expect an investigation, not an instant delist. For RBL+, Trend Micro monitors the IP, talks to the IP block owner about what caused the listing and what was done, and then decides on removal, probation, or keeping the listing. During probation the IP is off the list, but it can be relisted without a new nomination if spam resumes. If nothing new happens by the end of probation, the removal sticks.

For a QIL listing, you can request removal from the lookup result too. After removal, the sending server has to retry the deferred mail.

How to confirm it's fixed

• Re-run the ERS lookup. The IP should no longer appear in any database.
• Watch bounces and deferrals from the domains that were affected. Trend Micro gateways are concentrated in business mail, so group your bounce log by receiving domain and check the corporate domains that were failing.
• For a QIL deferral, check your queue: mail that was retrying should drain once the listing clears.

Keeping it from coming back

• Mail only people who asked, and stop mailing addresses that have gone quiet. The why emails go to spam guide covers the data side.
• Watch for compromised accounts and abused web forms; they're the usual cause of sudden listings at otherwise clean senders.
• Don't run mail from dynamic IP space, and make sure nothing on your network relays for strangers.
• Treat probation as probation. A second listing during the probation window goes straight back on.

For how Trend Micro fits among the lists worth watching, see which blocklists actually matter and the email blocklists overview.

When to get help

If an RBL+ listing persists after you've requested removal, or the ERS lookup is clean and Trend Micro-protected domains still reject you, it helps to have someone who has worked these before. Get in touch.

FAQ

What's the difference between Trend Micro RBL+ and QIL?

RBL+ is the standard reputation database of known spam sources, dynamic IPs, open relays and open proxies, and it produces rejections. The QIL is a real-time list of IPs caught spamming, and it produces temporary 450 deferrals that last from 5 minutes to 12 hours.

Can I delist an IP I don't own?

Not effectively. Trend Micro wants requests from an authoritative address at the domain that owns the IP block. If you're on an ESP's IP or a hosted server, ask the provider to submit it.

Does Trend Micro charge for delisting?

Trend Micro's documentation describes no fee for the ERS removal request. Be wary of any third party offering paid Trend Micro removal.

Why are only some of my business recipients bouncing?

ERS is used by companies that run Trend Micro mail security, so a listing affects those recipients and not consumer mailbox providers. That pattern in your bounce log is a good sign you're looking at ERS rather than a wider problem.