Server IP or Domain on an Email Blocklist? How to Check, Find the Cause and Get Delisted

Your bounces suddenly contain lines like “blocked using zen.spamhaus.org”, “Client host rejected”, “listed at b.barracudacentral.org” or “Service unavailable; client host blocked”. Or a blocklist checker shows a red mark next to your server’s IP. Some receivers are now refusing your mail because a reputation list says the address, or a domain in your message, is associated with spam or abuse.

This guide explains how those lists work, how to check them yourself, how to find the real cause, and how to get removed. The order matters: if you request removal before fixing the cause, you will be listed again, often for longer. If your site has clearly been compromised, run the containment steps in FG-05 alongside this guide.

What is happening

A DNS-based blocklist (DNSBL, sometimes called an RBL) publishes reputation data through ordinary DNS. When a server receives a connection, it reverses the connecting IP’s four numbers, appends the list’s zone name, and does a DNS lookup. For a connection from A.B.C.D it looks up D.C.B.A.zen.spamhaus.org.

• If the name does not exist (an NXDOMAIN answer), the IP is not listed.
• If it returns an address in 127.0.0.0/8, the IP is listed, and the exact address says which list or reason.
• A TXT lookup on the same name usually returns a short reason and a link.

Domain lists work the same way, but you look up the domain itself, for example example.com.dbl.spamhaus.org. Receivers use these to check domains in the From address, the envelope sender and, importantly, links in the message body.

The receiving server decides what to do with a hit. Some reject outright, some add spam points, some ignore certain lists. That is why being listed on one obscure list may change nothing, while being on a major list stops mail to many receivers.

Spamhaus return codes

Answer	Zone	Meaning
127.0.0.2	SBL	Spamhaus Blocklist: IPs Spamhaus has identified as spam sources or spam support services
127.0.0.3	CSS	Part of the SBL: low-reputation IPs, often snowshoe spam or compromised sending
127.0.0.4	XBL	Exploits list: IPs showing signs of malware, hijacked devices or open proxies
127.0.0.9	SBL (DROP)	Netblocks on the Do Not Route or Peer list
127.0.0.10	PBL	Policy list, maintained by the network owner: this range should not send mail directly to MX servers
127.0.0.11	PBL	Policy list, maintained by Spamhaus
127.255.255.252	Error	Typo in the zone name
127.255.255.254	Error	Query came through a public or open resolver, or a resolver with generic reverse DNS; no data returned
127.255.255.255	Error	Excessive query volume on the free mirrors

ZEN is the combined zone that includes SBL, CSS, XBL and PBL in one lookup. Spamhaus is explicit that the 127.255.255.x answers are errors, not listings; mail servers must treat them as “no answer”. The DBL, Spamhaus’s domain list, is a separate zone with answers in 127.0.1.x: for example 127.0.1.2 for spam domains, 127.0.1.4 for phishing, 127.0.1.5 for malware, and answers in the 127.0.1.1xx range for legitimate domains that are being abused (such as a hacked site hosting spam pages).

Before you start

You need the full bounce message, the ability to view headers of a message you sent, and, if you manage the server, SSH access. Checking lists uses dig on your own computer (built in on macOS and Linux; on Windows use WSL, or Resolve-DnsName in PowerShell). Server log commands run over SSH. Back up before you delete any suspicious files you find.

A warning about resolvers. Spamhaus blocks queries made through large public resolvers such as 8.8.8.8 (Google) and 1.1.1.1 (Cloudflare). If your computer or router uses one of them, you get 127.255.255.254 or no useful answer, regardless of whether the IP is listed. Use your ISP’s resolver, Spamhaus’s own lookup page, or a free Spamhaus Data Query Service (DQS) key.

Step 1: Find out exactly what is listed

Read the bounce

Most rejections name the list and the IP or domain. A typical Postfix rejection reads 554 5.7.1 Service unavailable; Client host [A.B.C.D] blocked using zen.spamhaus.org, followed by a link. That tells you the list (Spamhaus ZEN), the listed thing (your IP) and the receiver. If the bounce instead mentions a domain or a URL, the listing is for a domain in your message, not your server.

Find your real sending IP

Your website’s IP and your mail’s sending IP are often different. If your mail goes through Google Workspace, Microsoft 365 or a transactional provider, their IPs are the ones that matter, and a listing for your web server only affects mail the web server sends itself. Open a message you sent to an outside mailbox, view the original, and read the Received: headers from the bottom up. The first one added by the recipient’s server shows the IP that connected to it. That is your sending IP.

Query the lists by hand

Run this on your own computer:

dig +short D.C.B.A.zen.spamhaus.org A
dig +short D.C.B.A.zen.spamhaus.org TXT

If your sending IP is A.B.C.D, write the four numbers in reverse order: an IP of 198.51.100.7 becomes 7.100.51.198.zen.spamhaus.org. +short prints only the answer; A asks for the return code and TXT asks for the reason text. No output means not listed. 127.0.0.2 to 127.0.0.11 means listed (use the table above). 127.255.255.254 means your resolver is blocked, not that you are listed. To prove your setup works, query the permanent test entry 2.0.0.127.zen.spamhaus.org: it should return 127.0.0.2 and others.

If your resolver is blocked, point the query at a resolver that is allowed, or use DQS:

dig +short D.C.B.A.DQS_KEY.zen.dq.spamhaus.net A

DQS_KEY is the key from your free Spamhaus DQS account (available for low-volume, non-commercial use). The answers have the same meaning as above. Check a domain against the DBL the same way, without reversing anything:

dig +short example.com.dbl.spamhaus.org A
dig +short example.com.multi.surbl.org A

Replace example.com with your domain, and also with any domain you link to in the mail that bounced. An empty answer is clean. A DBL answer in 127.0.1.x is a listing. For SURBL, any 127.0.0.x answer is a listing; the last number is a bitmask that encodes which SURBL lists it is on.

For a quick sweep across dozens of lists, the free blocklist checkers at MXToolbox, MultiRBL and Spamhaus’s own IP and domain reputation checker are fine. Treat a red mark on a very small list with suspicion until you confirm a real receiver uses it.

Step 2: Understand how much the list matters

List	What it targets	How seriously receivers take it	Removal
Spamhaus SBL / CSS	Spam sources and low-reputation sending	Very widely used; expect rejections at many receivers	Through the Spamhaus checker after fixing the cause; SBL tickets are reviewed by staff
Spamhaus XBL	Infected or hijacked hosts	Very widely used	Self-service removal on the Spamhaus checker once the infection is cleaned
Spamhaus PBL	IP ranges that should not send direct to MX (for example residential or dynamic ranges)	Widely used; not an accusation of spam	Self-service if the IP really is a properly configured mail server, or the network owner removes it
Spamhaus DBL	Domains in spam, phishing and malware	Widely used for links and sender domains	Request through the Spamhaus checker after cleanup
Barracuda (BRBL)	IPs sending spam to Barracuda customers	Used by Barracuda appliances and many others	Removal request form on Barracuda Central, reviewed manually
SpamCop	IPs reported by users and spam traps	Moderate	Expires automatically once reports stop
UCEPROTECT Level 1	Single IPs that hit its traps	Few large providers rely on it	Expires automatically; it offers paid express removal, which you do not need
UCEPROTECT Level 2 and 3	Whole ranges and entire networks	Low; lists you because of your neighbors	Automatic once the range improves; not in your control
SURBL	Domains found in message bodies	Widely used in spam filters	Lookup and removal request on the SURBL site

Never pay for removal from any list. A list that charges for faster removal is not one major receivers depend on.

Step 3: Find the root cause

A listing is a symptom. Something sent mail that looked like spam from your IP or advertised your domain. These are the usual culprits, in order of how often they turn up on WordPress and small business servers.

A compromised mailbox

A stolen mailbox password lets spammers log in over SMTP and send through your server with full authentication. Look in the mail log for one account sending far more than usual. On a Postfix server, run this over SSH:

grep "sasl_username=" /var/log/mail.log | sed 's/.*sasl_username=//' | sort | uniq -c | sort -rn | head

There are no placeholders. The command finds every authenticated login, strips everything except the username, then counts and sorts them so the busiest accounts are at the top. A normal mailbox sends tens of messages a day. One account with thousands, especially if you also see logins from unfamiliar countries, is compromised. On cPanel servers with Exim, look for A=dovecot_login: or A=dovecot_plain: followed by the username in /var/log/exim_mainlog. Fix: change the password, enable multi-factor authentication where the provider supports it, and clear the queue of spam (below).

Form spam relaying

Contact forms that send a “copy to yourself” or an autoresponder to whatever address the visitor types are abused to send spam to strangers. The spammer puts the victim’s address in the email field and the advert in the message field, and your server dutifully delivers it with your name on it. Check your mail log or email log plugin for form notifications sent to addresses you do not recognize. Fix: turn off “send a copy to the submitter” options, send autoresponders only after a CAPTCHA or honeypot check, and never put user input in the subject line without limits.

Malicious PHP scripts

Hacked sites often get a mailer script dropped into an uploads or cache folder. If PHP’s mail.add_x_header setting is on, outgoing messages carry an X-PHP-Originating-Script header naming the file that sent them; check messages in the queue or in bounces. Also look for PHP files where they should never be. On the server, from the site folder:

find wp-content/uploads -type f -name "*.php"
find . -type f -name "*.php" -mtime -7 -not -path "./wp-content/cache/*"

The first command lists PHP files in the uploads folder, which should normally contain none; a handful of known plugin index files is the only common exception. The second lists PHP files changed in the last seven days (-mtime -7), excluding the cache folder. Compare results against updates you actually ran. Unknown files with random names, or core files changed when you did not update, point to a compromise; follow FG-05.

Your own sending practices

If nothing is compromised, look at what you send. Buying a list, importing old contacts, or sending a large campaign from a web server that normally sends ten messages a day will hit spam traps and complaint thresholds. Move bulk mail to a dedicated email marketing or transactional provider and only send to people who opted in.

Clearing the queue

If spam is still sitting in the outgoing queue, it will keep going out after you fix the cause. On Postfix, mailq lists the queue and postsuper -d QUEUE_ID deletes a single message by its queue ID. On Exim, exim -bp lists it and exim -Mrm EXIM_MESSAGE_ID removes one message. Review what you are deleting before bulk removal, and keep a copy of a few samples as evidence for your delisting request.

Step 4: Request delisting

Once the cause is fixed and the queue is clean, go to the list’s own lookup page, not a third party.

1. Look up the IP or domain on the list’s site and read the listing reason. Spamhaus, Barracuda and SURBL all show it.
2. Follow the removal process there. Some removals are instant self-service; others open a ticket reviewed by staff.
3. In the request, state plainly what happened and what you changed: “A mailbox password was stolen on YYYY-MM-DD; we reset it, enabled MFA, removed queued spam, and outbound volume is back to normal.” Short and specific beats apologetic and vague.
4. Wait for the stated processing time, then re-check with dig. DNS answers can be cached for a short while after removal.

A PBL listing is a special case. It does not mean you spammed; it means the IP’s network owner says that range should not send mail directly. If your server really is a mail server with matching forward and reverse DNS, use the self-service removal. If it is a dynamic or residential connection, send mail through an authenticated relay instead.

If you are relisted shortly after removal, the cause is not fixed. Go back to Step 3 before you try again.

Step 5: Domain listings and links in your content

If the DBL or SURBL lists your domain, every message that mentions it can be rejected, even messages sent by other people. The causes differ from IP listings:

• Your site was hacked and hosts spam or phishing pages, so spam elsewhere links to it. Spamhaus marks these “abused legitimate” with the 127.0.1.1xx codes. Clean the site first (FG-05), then request removal.
• Your site has an open redirect, such as a plugin that forwards any URL in a query string. Spammers link through your domain to hide their own. Remove or restrict the redirect.
• Your mail links to a domain that is listed, such as a link shortener or a tracking domain. Check every domain in your template, including the click-tracking domain your newsletter tool uses, and replace or fix the listed one.

Advanced: watching outbound volume before a listing happens

The best time to catch abuse is before any list notices. On a server you control, a simple hourly count of outbound deliveries gives you a baseline. On Postfix, run this over SSH:

grep "status=sent" /var/log/mail.log | awk '{print $1, $2, substr($3,1,2)}' | uniq -c | tail -n 24

No placeholders. It counts successful deliveries per hour (date, day and hour from the classic syslog timestamp) for the last 24 hours with traffic. If your log uses ISO timestamps such as 2026-11-07T14:03:22, replace the awk part with cut -c1-13. A brochure site that normally sends a few messages an hour and suddenly shows hundreds is being abused right now.

Pair that with outbound rate limits, which most control panels and MTAs support per domain or per account, so a compromised password cannot send thousands of messages before you notice. Keep form plugins updated, require CAPTCHA or honeypot fields, and consider sending all site mail through a transactional provider so a web server compromise cannot damage your mailbox IP reputation.

When to contact your host

On shared or managed hosting the sending IP is usually shared and the host controls the mail server, so open a ticket as soon as you see a blocklist bounce. Include:

• The full bounce, with the list name and the listed IP or domain.
• The UTC time of the bounced message and the sender and recipient addresses.
• Your dig results for the list (and which resolver you used).
• What you have checked: mailbox passwords changed, forms reviewed, suspicious files found.
• Any recent change, such as a new form, a newsletter send or a plugin install.

Ask whether the listed IP is shared, whether they can move your mail to a clean IP or relay, and whether their logs show the source of the abuse. Use the diagnostic tools for quick checks, and the Emergency Room if your server is actively sending spam.