How to get off an email blocklist (DNSBL)
By James Bayliss · Updated · Reviewed
In this guide
How a DNS blocklist works
A DNSBL publishes listed IPs as DNS records. To check 203.0.113.25 against a list at bl.example.org, a mail server reverses the IP's octets and looks up 25.113.0.203.bl.example.org:
- NXDOMAIN (no such name): not listed.
- An A record in
127.0.0.0/8: listed. The specific address is a return code that says why. - A TXT record at the same name often carries a human-readable reason and a link.
The receiving server makes that lookup while you are still connected, which is why a listing can cause an immediate rejection such as 554 5.7.1 Service unavailable; client host blocked using ....
Which listings matter
Lists vary enormously in how many receivers use them. A rough priority order:
- Spamhaus (SBL, XBL, CSS; queried together as ZEN): used very widely. A listing here causes real delivery failures.
- Barracuda (BRBL), SpamCop: used by many gateways and smaller providers.
- Mailspike, PSBL, UCEPROTECT Level 1, and others: used by some receivers.
- UCEPROTECT Level 2 and 3: list whole network ranges and ASNs because of neighbours' behaviour. Few major receivers block on them; treat them as an indicator, not an emergency.
Our Email Blacklist Check queries 20 lists, shows return codes, and checks the IP's reverse DNS in the same run.
Spamhaus PBL is different
The Policy Block List (return codes 127.0.0.10 and 127.0.0.11) is not an accusation of spam. It lists address ranges, usually residential and mobile, that their owners say should not send mail directly to the internet.
- If the IP belongs to an office internet connection or a home router, the fix is to send through your mail provider's authenticated relay (smtp.office365.com, smtp.gmail.com, or your ESP), not to request removal.
- If the IP really is a mail server on a static business IP, you can remove it from the PBL through Spamhaus's lookup page. Make sure its reverse DNS looks like a mail server first.
Find and stop the cause
Requesting removal without fixing the cause gets you relisted, and some lists make each repeat listing harder to clear. Common causes:
| Cause | How to spot it | Fix |
|---|---|---|
| Compromised mailbox | Sudden outbound volume from one user; sent items full of unknown messages; mail flow logs | Reset the password, revoke sessions, enforce MFA, check for forwarding rules |
| Infected device (XBL listing) | Return code for exploited hosts; outbound port 25 connections from workstations | Block outbound port 25 from all hosts except mail servers; clean the device |
| Open relay or open proxy | Relay test from outside; unexpected senders in server logs | Require authentication for relaying; restrict to known networks |
| Website contact form abused | Spikes of form submissions; outbound mail from the web server | Add a CAPTCHA and rate limiting; send through an authenticated service |
| Poor list practices | Spam traps hit; high bounce and complaint rates | Use confirmed opt-in; remove inactive and bounced addresses |
Delisting
| List | How removal works |
|---|---|
| Spamhaus (SBL/XBL/CSS/PBL) | Check the IP at Spamhaus's lookup page, which explains the listing and offers removal where self-service applies |
| SpamCop | Listings expire automatically, typically about 24 hours after reports stop |
| Barracuda | Submit a removal request through Barracuda Central; usually processed within a day or so |
| UCEPROTECT | Level 1 expires automatically after a quiet period; express removal is a paid option, and Levels 2 and 3 depend on your provider's whole range |
| Others | Follow the link our checker shows for each list, or the TXT reason |
Never pay a third party who promises to "remove you from all blacklists". Legitimate removal is either free self-service or handled directly by the list operator.
Prevent the next listing
- Enforce MFA on every mailbox, and alert on new external forwarding rules.
- Block outbound TCP 25 for everything except your mail servers.
- Set up a forward-confirmed PTR for every sending IP; see reverse DNS.
- Publish SPF, DKIM and DMARC, so spoofed mail is less likely to be blamed on you.
- Re-check your sending IPs regularly, and after any security incident.
From the field: It is too easy to just request removal from a blocklist first to get mail flowing to try to resolve the problem after, but that typcally leads to relisting if you do not resolve it quickly enough. Fix the problem first, the request the remval for a more permanent solution.
Sources
Check it now
Email Blacklist Check Is this mail server's IP blocklisted, and is its reverse DNS set up the way receivers expect?
Related guides
- Reverse DNS (PTR) for mail servers: setup and FCrDNS
Why receivers require a PTR record on sending IPs, what forward-confirmed reverse DNS means, who can set the record, and how to fix 4.7.23 and 5.7.25 bounces.
- Why is my email going to spam? A diagnostic checklist for admins
A step-by-step checklist for why legitimate mail lands in junk: authentication, alignment, IP and domain reputation, reverse DNS, content and list hygiene.
- Gmail, Yahoo and Microsoft sender requirements, explained
What Gmail, Yahoo and Outlook.com require from senders in 2026: authentication and alignment, reverse DNS, one-click unsubscribe and spam-rate limits.