How to Remove Your IP Address From the Spamhaus Block List

Did an email bounce back with a line like “blocked using zen.spamhaus.org”? Is a security scan or a blacklist check telling you your IP address is flagged for spam? Or do you already know you’re listed, and you’re trying to work out how to remove your IP address from Spamhaus?

Maybe that bounce is the first time you’ve seen the name, and now you’re asking “What is Spamhaus, and why is it blocking my email?” You can’t tell whose IP address is blocked, whether you did something wrong, or who you’re supposed to ask. You don’t even know whether getting unblocked costs money.

Take a breath. This is fixable, and Spamhaus never charges for a removal. Here’s what we’ll do: find which list you’re on and whose IP address it is, fix what caused it, then take that list’s route off it.

What is Spamhaus?

Spamhaus is a not-for-profit project, founded in London in 1998 by Steve Linford, that publishes lists of IP addresses (the numbers that identify servers and connections on the internet) and domains. Email servers query those lists, and when one of them rejects your email because of a listing, it sends back a bounce that names the cause.

Spamhaus writes “blocklist” as one word, and you’ll also see “block list” and “blacklist”. Here are the lists this article covers, each with its return code: the answer that list gives a mail server asking about an IP address or domain.

List	What Spamhaus says it lists	Return code
Spamhaus Blocklist (SBL)	IP addresses “identified as malicious”, such as ones sending spam	127.0.0.2
Combined Spam Sources (CSS)	IP addresses sending low-reputation email	127.0.0.3
Exploits Blocklist (XBL)	IP addresses where a device looks “insecure, compromised, or infected”	127.0.0.4
Policy Blocklist (PBL)	IP addresses that shouldn’t send email directly	127.0.0.10 or 127.0.0.11
Domain Blocklist (DBL)	Domains. No IP addresses are on it	127.0.1.x
ZEN	The SBL, CSS, XBL and PBL together	See those four

How did I end up on the Spamhaus IP block list?

It depends on which block list, because each one means something different. Some point to spam email or a compromised machine, and the PBL covers whole ranges that shouldn’t send email directly, whatever they’ve done. Here are common causes.

Sending spam

The first Spamhaus block list in the table, the SBL, covers IP addresses sending spam, which Spamhaus defines as “unsolicited bulk email”. The CSS list covers low-reputation email, with triggers that include “unsolicited emails” and “poor email marketing list hygiene”. Bought lists are one way in: Spamhaus warns that “purchased lists contain spamtraps or generate abuse complaints and bounces”, and that hitting spam traps “may lead to listings”.

Compromised servers, sites and devices

Spamhaus adds an IP address to the XBL when it has “compelling evidence” that a device using it “is insecure, compromised, or infected”. That can mean malware, unauthorized access, or a “Free VPN” type app using the device as a proxy. A hacked website counts too: Spamhaus names “compromised accounts or content management systems (CMS)” as a trigger for CSS listings.

How to remove your IP address from Spamhaus

To remove your IP address from Spamhaus, start with a check at Spamhaus’s IP and Domain Reputation Checker, the lookup Spamhaus calls “the only path to resolution”. XBL, CSS, PBL and DBL removals are handled there and nowhere else. For the SBL, only the network or hosting company responsible for the IP address can ask.

Removal is free, and no third party can “influence or expedite removals”. In Spamhaus’s words:

There is never any charge or fee associated with removing any Spamhaus listing. Any offer from anyone to remove any Spamhaus listing for a fee is a scam.

Here’s the route, whichever list you’re on:

1. Find the IP address the receiving server rejected. It’s usually in the bounced email. If a scan or a blacklist check sent you here, use the IP address in its alert.
2. Look that IP address up in the Reputation Checker, and check your domain there too.
3. If nothing is listed, skip down to the section on bounces that name Spamhaus anyway.
4. If your IP address is flagged, read which block list it’s on and what Spamhaus says about the listing.
5. Ask your web host, your email provider or your internet service provider (ISP), whichever runs that server or connection, whether the IP address is assigned to you or to them.
6. Fix the cause (the spam, the hacked site, the infected device) before you request delisting.
7. Follow the route for your list, below.

What changes from list to list is who’s allowed to ask.

Spamhaus Blocklist (SBL): your ISP or host has to ask

You can’t request an SBL removal yourself. That’s Spamhaus’s rule for every end user on this list, and you still have a part: fix what the listing describes, tell your ISP, hosting company or email service provider how the problem was solved, and ask them to take it to Spamhaus.

Spamhaus’s SBL page says “only these companies can deal with SBL removals”, meaning the network or hosting companies responsible for the IP address. Every SBL removal is “the sole decision of The Spamhaus Project”.

Exploits Blocklist (XBL): secure the device, then request delisting

An XBL listing means something using your IP address looks insecure, compromised or infected. Find it and fix it (for a website, start with Spamhaus’s help for hacked sites), then request delisting through the Reputation Checker. XBL listings also expire on their own, after a period of time, “once the malicious behavior is no longer detected”.

Combined Spam Sources (CSS): stop the spam first

A CSS listing normally expires three days after the last spam Spamhaus detects. Delisting starts at the checker, and Spamhaus’s rule is blunt: “Whatever caused the problem MUST be identified and corrected before removing an IP from CSS.” Check your domain’s reputation there too.

Policy Blocklist (PBL): a policy, not an accusation

The PBL is the odd one out. Spamhaus says the IP addresses on it “are not necessarily ‘bad’”: they’re ranges that shouldn’t send email directly, often ones an ISP assigns to broadband customers.

If you send from an email program on one of those connections, the listing only stops your email when the program “is not authenticating correctly”. Turn on SMTP Authentication and use port 587 or 465 in place of 25.

A PBL removal is for one setup: you run your own outbound mail server on a static IP address that’s assigned to you and has forward and reverse DNS. If that’s you, Spamhaus’s instruction is to look the IP address up in the checker and “click ‘show details’ then follow the steps for removal”, from an email address on your mail server’s own domain, because Spamhaus throws out requests from free email accounts. If it isn’t, don’t request a removal: the SMTP Authentication fix above is yours.

Domain Blocklist (DBL): your domain is listed, not your IP address

The DBL “ONLY lists domains”. Look your domain up in the checker and follow the instructions it returns.

If your website was hacked, the listing may be the DBL’s “abused-legit” part, for legitimate domains “being abused for malicious purposes”. Clean up first: remove infected files, update the CMS “and all plugins and extensions”, secure the server and change all passwords. Spamhaus’s help for hacked sites has a WordPress section.

Spamhaus ZEN delisting: find the list underneath

ZEN contains the SBL, CSS, XBL and PBL. If a bounced email names zen.spamhaus.org and the checker shows your IP address as listed, the listing is on one of those four, so see which one and follow that list’s route above.

When the listed IP address is your web host’s server

Unless you’ve set up something else, your WordPress site sends its email from your web host’s server. So the IP address in the bounce may be your host’s, and the removal may not be yours to request. Send your host the bounce and ask:

• Is this IP address yours, and does my site’s email leave from it?
• Which Spamhaus block list is it on, and what does the listing say?
• If it’s the SBL, will you take the removal to Spamhaus?

The same goes for an alert from a security plugin. Wordfence’s paid scan, for one, checks whether your site’s IP address is generating spam. If an alert like that names a Spamhaus block list, take it to Spamhaus’s checker too.

When a bounce names Spamhaus but your IP address isn’t listed

The receiving mail server writes the bounce email, so the wording varies. Here’s part of what one server wrote, with an example IP address swapped in:

554 5.7.1 Service unavailable; Client host [192.0.2.10] blocked using zen.spamhaus.org

The 554 and 5.7.1 codes mean a permanent refusal. If the checker shows nothing for that IP address, Spamhaus’s pages give these explanations:

• The listing was removed recently and the receiving network hasn’t caught up. Allow 24 hours.
• The receiving server is misconfigured. A bounce that says “open resolver” goes with return code 127.255.255.254, an error that “must not be taken to imply” you’re listed. Spamhaus says it’s resolved by changing how that mail server queries Spamhaus’s lists, so the fix is on the receiving end.
• Something else blocked the email. Many networks keep private blocking lists. Before you do anything else, ask your host or email administrator to check the mail server logs.

Why a Spamhaus listing comes back after delisting

Spamhaus re-lists when it still detects the problem. Its pages say so for each block list you can request removal from yourself. Spamhaus’s XBL page says an IP address is re-listed “because the detected problem has not been corrected”.

Repeat requests run out, too: CSS self-removals are limited, a PBL removal is reversed at once if spam is detected, and people who overuse the DBL removal form may be blocked.

So protect your IP reputation at the source. Keep your site and its plugins updated, and send email only to people who asked for it. Mailbox providers watch your spam complaints, and Spamhaus notes they give complaint volume “great weight”, so keep your spam complaint rate low too.

Find the list, fix the cause, then request delisting the right way

You came here with a bounce or an alert that named Spamhaus. Now you can check which Spamhaus block list it is, whose IP address is listed, and who can ask Spamhaus to remove your IP address. Our advice: fix the cause before you request delisting, and never pay anyone to remove an IP from Spamhaus.

SendWP can’t remove, request or speed up a Spamhaus removal, and it won’t clean up a hacked site or fix a listed domain. For those, follow the steps above.

What we do is send the email your WordPress site sends: form notifications, order receipts, password resets. You install the SendWP plugin and connect in a few clicks, and you get help authenticating your domain and 30 days of email logs. It’s a paid service (see what SendWP costs), built for people who’d rather run their site than become email admins, and it’s the one we’d suggest.