How to get delisted from Spamhaus

The lookup returns an address in 127.0.0.x, and the last octet is the answer. Every remedy below depends on it, so do this before anything else:

# reverse the octets of your IP, then query the zen zone
dig +short 7.113.0.203.zen.spamhaus.org
→ 127.0.0.4

Skipping this step is why so many delisting attempts fail. A PBL listing and an SBL listing look identical in a checker that reports only "listed on Spamhaus", and they have nothing in common beyond the name.

The most misread listing of the five. PBL is a directory of IP ranges that the network operator has declared should not be sending mail directly — residential broadband, dynamic ranges, cloud instances not designated as mail servers.

Being on it means nobody registered your IP as a mail server. It does not mean you sent spam, and no reputation damage attaches to it. Two remedies:

• Do not send directly. Relay through your provider’s SMTP or an ESP. This is the right answer for almost everyone, because a residential or default cloud IP has no sending history and will struggle regardless.
• Ask the network operator to reclassify the range if you genuinely run a mail server there. Self-removal exists for some ranges; where it does not, only the operator can change it.

XBL says the host looks compromised — an open proxy, an exploited service, or malware sending on its own. Requesting removal without finding the cause gets you relisted almost immediately, because the thing sending is still sending.

What to check, in order:

1. Mail queue depth. Thousands of unexplained messages is the signature of a compromised account.
2. Whether your SMTP service is accepting relay from outside your network.
3. Application accounts with weak or reused credentials — a compromised contact form or CMS is a common vector.
4. Outbound connections on port 25 from processes that have no business making them.

XBL removals are self-service and take effect quickly. They are also automatic once the detection stops, so if you have genuinely fixed it, waiting works too.

Everything above concerns IPs. DBL lists domains, and it is the more damaging listing precisely because there is nowhere to move — changing ESP or IP takes the listing with you.

Three ways a domain gets listed, and the third surprises people:

• It sent spam, or was the visible sender of it.
• It appeared as a link inside spam sent by somebody else — an affiliate, a partner, or an attacker.
• A page on your site was compromised and is serving something malicious.

The second and third mean a domain can be listed without you sending a single message. Check whether your site is clean before assuming your mail is the cause, and see how domain listings differ from IP listings.

1. Confirm the sub-list from the return code. Everything else depends on it.
2. Fix the cause. Non-negotiable. Relisting is fast, and repeated requests weigh against you.
3. Use the Spamhaus removal centre for that specific list. It is free — Spamhaus does not charge, and anyone offering paid Spamhaus delisting is not connected to Spamhaus.
4. Describe the fix concretely. "Disabled the compromised account and rotated credentials" is a case. "Please remove, we are legitimate" is not.
5. Then wait, and monitor. Removal is usually hours. Relisting within days means the cause is still live.