Which Email Blocklists Actually Matter?

Very few of them. Spamhaus matters more than every other public blocklist combined. After that, a short list matters because it's built into filtering products that real organizations use: Barracuda, SpamCop, Cloudmark (Proofpoint), Trend Micro and Invaluement. Most of the rest of the lists in a typical "blacklist checker" report can't hurt you. The test is simple: if mail is bouncing with a list's name in the error, that list matters to you right now. If it isn't, it's trivia.

This page is a field guide to the lists. For what to do once you know you're on one that matters, see We Got Blocklisted.

Why most listings don't matter

A blocklist (people still search for "blacklist," same thing) only affects you if receivers query it. A list has power in proportion to how much mail is filtered through it, and that's the whole ranking.

Checker tools don't rank that way. They query every list they know about and show every hit in red. That's how a sender with perfectly normal delivery ends up looking at "listed on 6 of 112 blacklists" and losing an afternoon. Some of those lists are hobby projects. Some list whole networks on purpose. Some are dead and still answering queries.

So start with your bounces, not a checker. The receiving server tells you which list it used, and segmenting bounces by receiving domain tells you how widespread the problem is.

Tier 1: Spamhaus

Spamhaus is the one that matters most. Spamhaus says its data protects about 4.5 billion user mailboxes. A Spamhaus listing tends to show up as bounces across many unrelated receiving domains at once.

Spamhaus runs several lists, and they differ a lot:

• SBL: manual listings by Spamhaus researchers for spam operations and other abuse. Serious, and removal goes through your network provider.
• CSS: automated listings for IPs sending low-reputation mail. The one legitimate senders hit most, often from compromised accounts or misconfigured servers.
• XBL: compromised machines and botnet activity.
• PBL: IP ranges that shouldn't send mail directly, like consumer broadband. A policy list, not an accusation.
• DBL: domains, including the domains in your links.

Receivers usually query ZEN, which combines the SBL, CSS, XBL and PBL in one lookup. The details and removal paths for each are on the Spamhaus removal page.

Tier 2: lists inside real filtering products

These matter when you're mailing businesses, schools and organizations that use the products behind them. They're less likely to explain a problem at consumer mailbox providers.

A few notes from their own documentation:

• SpamCop describes its list as aggressive and recommends receivers use it to tag or divert mail rather than reject it, so a listing often means filtering rather than hard bounces. But it does mean real people or traps flagged your mail in the last day or two.
• Trend Micro's lists have different owners for removal. Its knowledge base says RBL+ removals go through the ISP responsible for the IP, which contacts Trend Micro's investigators, while QIL listings last from five minutes to 12 hours and have their own removal form.
• Barracuda has a second kind of block that isn't a listing at all: a recipient's own gateway policy. The Barracuda page covers how to tell the difference.

Domain and URL lists

Not every list cares about your IP. Domain lists check the links and domains in your message, which means a perfectly clean sending setup can still be blocked by one bad link.

• Spamhaus DBL is the big one.
• SURBL and URIBL both list domains that appear in spam message bodies, and both are still operating.

The domains to watch include your ESP's click-tracking domain, link shorteners, image hosts and partner domains in your footer, not just your own.

The lists that don't count

Mailbox providers' internal lists (they count, but you can't look them up)

Gmail, Microsoft, Yahoo and Apple each run their own reputation systems and blocks. These aren't public blocklists: no checker shows them, and no delisting form applies to all of them. A Gmail 550 5.7.1 "likely unsolicited mail" rejection, a Microsoft S3150 block or a Yahoo TSS04 deferral comes from the provider's own systems. Those have their own pages: Gmail 550 5.7.1, Outlook S3150 and Yahoo TSS04.

This is the most common mix-up in blocklist panic. A sender gets delisted from something, delivery at Gmail doesn't improve, and they assume the delisting failed. Different systems.

UCEPROTECT

UCEPROTECT has three levels. Level 1 lists individual IPs that hit its spam traps. Levels 2 and 3 list whole network allocations and entire providers (ASNs), so you can be listed there without having sent anything wrong yourself.

Level 1 listings expire automatically seven days after the last trap hit. UCEPROTECT also offers immediate removal for a per-IP fee. Legitimate, widely used blocklists don't charge for removal. If your mail is delivering fine, a UCEPROTECT listing is safe to ignore, and you shouldn't pay to remove it. A Level 1 listing is still worth a look as a hint that something on that IP is hitting traps.

SORBS (closed)

SORBS shut down on June 5, 2024. Its owner, Proofpoint, said the list no longer contains reputation data. If a checker or a stale article tells you you're "on SORBS," there's nothing to do. If one of your recipients still has SORBS configured on their mail server, that's their configuration to clean up.

Everything else

The long tail of small, regional and single-operator lists is mostly irrelevant to delivery. If one of them appears in an actual bounce, follow its removal process. If it only appears in a checker report, move on.

How to monitor without drowning

• Watch bounces first. Set up alerts on bounce rates by receiving domain, and read the text of blocklist rejections. That's the signal.
• Check the few that matter on a schedule. Your sending IPs against Spamhaus, Barracuda and SpamCop, and every domain in your templates against the Spamhaus DBL. Weekly is reasonable for most senders.
• Fix the cause, not the listing. Most listings come from traps, complaints or compromise. See why spam traps are a data problem, and keep authentication healthy with the email checker.

When to get help

If you're seeing bounces from more than one list that matters, or listings that keep coming back after you've fixed what you thought was the cause, it's usually a data or infrastructure problem worth an outside look. Get in touch.

FAQ

A blacklist checker says I'm on several lists. Should I worry?

Only if your bounces agree. If no receiving server is rejecting your mail with that list's name in the error, the listing isn't affecting you.

Which blocklist is the most important?

Spamhaus, by a wide margin. Start there, then check Barracuda and SpamCop if you mail businesses or other organizations.

Should I pay to get off a blocklist?

No. Spamhaus, Barracuda and SpamCop all delist for free. A list that charges for faster removal isn't one serious mail systems rely on.

Is SORBS still a thing?

No. SORBS shut down in June 2024. Any SORBS "listing" you see now is leftover noise.