Deliverability, Troubleshooting, Blocklists
Spamhaus Delisting: What to Do for SBL, CSS, XBL, PBL and DBL
Spamhaus runs several lists and each one means something different. Find which one you are on first, because the fix, and whether you can ask for removal yourself, depends on it.
7 min read
In this article
First find out which Spamhaus list you are on, because the cause and the removal route differ. SBL and CSS are about spam sources, XBL is about hijacked machines, PBL is about address ranges that should not send mail directly, and DBL lists domains. Fix the cause, then use the removal option the Spamhaus lookup page shows for your exact listing.
The five lists
| List | What it covers | Typical cause | What to do |
|---|---|---|---|
| SBL | IP addresses sending or supporting spam | A spam source, or a provider range with bad customers | Fix the source. Removal normally needs a request through Spamhaus |
| CSS | Part of the SBL: IPs whose sending looks like snowshoe spam, many addresses used to spread volume | Many mailboxes or domains sending similar mail from one range | Stop the pattern, then follow the lookup page's removal option |
| XBL | IPs with exploited or hijacked machines | Malware, an open proxy, a compromised server | Clean the machine first, then request removal |
| PBL | IP ranges that should not send mail directly to other servers | A home or dynamic IP sending straight to receivers | Send through your provider's mail server. Owners of a static IP can ask to be removed |
| DBL | Domain names seen in spam or malicious content | Your domain, or a link domain in your mail, was used in spam | Find the offending domain, fix the cause, then request removal |
Step 1: confirm the listing is real
Spamhaus refuses queries that come through large public DNS resolvers, and answers with a code in the 127.255.255.x range. A checker that treats any 127.x answer as a listing will show a false positive. Use the Spamhaus lookup page directly, or a checker that separates refused queries from listings, as Warmerly's blacklist checker does.
Step 2: find the cause before you ask for removal
- Which IP or domain is listed: your own sending IP, a shared IP of your mail provider, or a link domain inside your messages?
- What changed in the days before: a new batch of mailboxes, a bought list, a template change, a new tracking domain?
- If the IP belongs to a provider, tell the provider. You cannot fix a shared range alone.
Step 3: stop whatever caused it
A removal granted while the behaviour continues is usually followed by a new listing. Pause the affected sending, clean the list, remove the pattern that looked like snowshoe spam, and make sure unsubscribe and bounce handling work.
Step 4: request removal through the lookup page
Search the IP or domain at Spamhaus's lookup page. It shows the list, the reason and the removal options available for that listing. Some listings can be removed by you, some need a request that a Spamhaus team reads, and some expire by themselves once the activity stops. Follow what the page offers. Write the request plainly: what happened, what you changed, and what stops it recurring.
How to avoid it next time
- Do not send from many mailboxes on one IP range with near-identical messages.
- Verify lists, and stop sending to anyone who bounces or complains.
- Check blocklists regularly rather than after the damage. Warmerly monitors blocklists for connected domains and sending IPs and alerts you.
Frequently asked questions
How do I know which Spamhaus list I am on?
Look up the IP or domain on Spamhaus's own lookup page. It names the list and the reason, and shows the removal options for it.
What is the Spamhaus CSS list?
The Composite Snowshoe list is part of the SBL. It covers IP addresses whose sending pattern looks like snowshoe spam, where volume is spread across many addresses.
Why was I listed again after removal?
Removal does not fix the cause. If the sending pattern, list quality or compromised machine is still there, the listing returns.
Does a Spamhaus listing mean my SPF or DKIM is broken?
No. Authentication and blocklists are separate. You can pass every authentication check and still be listed.
