Spamhaus Blacklist Removal for SBL, XBL, PBL and DBL
· 7 min read
Checks run by DNS only. Nothing is sent from or to your domain.
Spamhaus blacklist removal depends on which Spamhaus list you are on. XBL and CSS listings can usually be removed through the Spamhaus lookup page once the cause is fixed, PBL entries can be removed for a legitimate mail server, SBL listings go through your network provider, and DBL covers domains.
Spamhaus is the blacklist that matters most to most senders. Its data feeds a very large share of corporate mail filters, hosting providers and mailbox providers, so a single Spamhaus listing can turn a normal sending day into a wall of rejections. The good news is that the process is well documented and free. The bad news is that it is easy to waste days on the wrong form. This guide explains each list, what its return code looks like, and the fastest legitimate route off it.
How Spamhaus lists are organised
Most receivers query a single combined zone called ZEN (zen.spamhaus.org). ZEN merges several separate lists, and the address returned for your IP tells you which one listed you. Domain checks use a different zone, the DBL. Knowing the component list is the whole game, because each one has a different owner, a different cause and a different removal path.
| Return code | List | What it means |
|---|---|---|
127.0.0.2 | SBL | Manually listed by Spamhaus researchers as a spam source or spam support service |
127.0.0.3 | SBL CSS | Automated listing of low reputation or snowshoe sending |
127.0.0.4 to 127.0.0.7 | XBL | Compromised or exploited machine, typically malware or a hijacked account |
127.0.0.9 | DROP | Hijacked or criminal netblock, never used legitimately |
127.0.0.10, 127.0.0.11 | PBL | Policy list, an IP range that should not send mail directly to the internet |
127.0.1.2 and up | DBL | Domain listed for spam, phishing, malware or abused content |
You can run the lookup yourself with any DNS tool. For the IP 198.51.100.23, query 23.100.51.198.zen.spamhaus.org. No answer means not listed. For a domain, query example.com.dbl.spamhaus.org. Or skip the manual step and use our Spamhaus lookup, which reports the component list and its meaning in plain language.
Before you start, rule out a false positive
Spamhaus returns a few special codes that look like listings but are not. They show up when the query itself is a problem, and they confuse a lot of people.
127.255.255.254means the query came through a public or open DNS resolver. Spamhaus does not answer queries from large public resolvers, so a mail server configured to use one gets this code for every IP. The fix is on the receiving server, which should use its own resolver or a Spamhaus data subscription.127.255.255.255means the querying server exceeded the free usage limits.127.255.255.252means the zone name in the query was typed incorrectly.
If a receiver tells you "listed on Spamhaus" but the official lookup shows you clean, ask them for the return code. Very often they are hitting one of these errors and treating it as a listing. That is their configuration to fix, and showing them the code is usually enough.
XBL removal, for compromised machines
The Exploits Block List covers IPs that sent mail in a way that indicates malware, a hijacked device, a compromised mailbox or a misbehaving script. It is fully automated. The listing details on the Spamhaus lookup page often include the time of the detection and a hint about the behaviour, for example a bot that connected with a strange HELO name.
The fix comes first. Look for infected workstations behind the NAT that shares your mail IP, for a web application sending through PHP mail functions, for a mailbox whose password leaked, or for an IoT device on the same network. Block outbound port 25 from everything except your real mail servers; this single firewall rule prevents most XBL listings for offices. Once you have found and fixed the source, request removal from the lookup page. Removal is fast, usually within minutes to an hour, but you can only do it a limited number of times. If the infection is still active, the IP comes back and the next removal becomes harder.
CSS removal, for low reputation and snowshoe sending
The CSS list is part of the SBL but is automated. It targets sending patterns that look like snowshoe spam: volume spread across many IPs and domains to stay below thresholds, poor list hygiene, content and infrastructure patterns associated with unsolicited bulk mail. Legitimate senders land on it most often after a campaign to an old or purchased list, or when a cold email setup ramps too many fresh domains too quickly.
Removal is also through the lookup page, after you explain what changed. The explanation matters here more than anywhere else. "We removed 38,000 contacts with no engagement in 12 months and paused the campaign" is a credible answer. If the sending pattern continues, CSS relists automatically, and repeat listings can escalate into a manual SBL record.
SBL removal, for manual listings
An SBL record is written by a Spamhaus researcher and has its own listing ID and a page explaining the evidence. SBL listings often cover a range, not a single IP, and they are addressed to whoever is responsible for that range. In practice that means your hosting provider, your ISP or your ESP, not you directly.
If you are on a shared range or an ESP pool, open a ticket with the provider, include the SBL ID and ask what they are doing about it. If you control the range yourself, read the listing page carefully, deal with the specific customer or service it names, then reply through the contact process the listing page provides. Be factual and brief. Spamhaus does not remove SBL records in exchange for promises, only for evidence that the abuse stopped.
PBL removal, for policy listings
The Policy Block List is not an accusation. ISPs and Spamhaus add ranges that are meant for end users, such as home broadband or mobile, and that should send mail through the ISP's smarthost rather than directly to receivers. If your server sits on such an IP, receivers using ZEN will reject direct mail from it.
You have two clean options. The better one in most cases is to relay outbound mail through a proper mail server or provider, so the PBL never comes into play. The other, if you genuinely run a mail server on a static IP with correct reverse DNS, is to request removal of that single IP through the PBL section of the lookup. The removal is meant for real servers; a home connection that later changes hands will be listed again by the ISP.
DBL removal, for domains
The Domain Block List contains domains seen in spam, phishing or malware, and it matters even when every IP you use is clean, because receivers check the domains in your links and headers. The return code tells you the category. 127.0.1.2 is a spam domain, 127.0.1.4 phishing, 127.0.1.5 malware, 127.0.1.6 botnet command and control, and codes from 127.0.1.102 upwards mark legitimate domains that were abused, for example a hacked website hosting a redirect.
Spamhaus also publishes the Zero Reputation Domain list, which temporarily lists newly registered domains for their first 24 hours. If a brand new domain sends right after registration and gets rejected, that is usually ZRD, and it clears on its own. Do not start cold outreach from a domain registered this morning.
For a real DBL listing, check the domain for compromised pages, open redirects, URL shortener abuse and links you do not recognise, and check whether a link in your template points to a domain that is itself listed. Then request removal through the lookup. A domain blacklist check across all domain lists helps you see whether other lists flagged the same domain.
What not to do
- Do not request removal before fixing the cause. Each failed removal counts against you.
- Do not pay anyone for Spamhaus removal. Spamhaus does not sell delisting.
- Do not rotate to a new IP or a new domain to escape a listing. Spamhaus links infrastructure, and this pattern is exactly what CSS is built to detect.
- Do not argue about whether your mail is "really" spam. Provide facts about what you changed.
Staying off Spamhaus
Spamhaus listings rarely come out of nowhere. They are usually the visible end of a slow problem: a list that has not been cleaned, a script that sends from the web server, a domain that got popular with the wrong crowd, a sending pattern that looks like spam from the outside. The senders who stay clean watch engagement and bounces on every send, keep reverse DNS, SPF, DKIM and DMARC correct, and hear about a listing within minutes rather than days.
That last part is the one you can automate. With IP blacklist monitoring every domain and IP you send from is checked against Spamhaus and 100+ other lists on a schedule as short as five minutes, and an alert goes to email, Slack or your webhook with the component list, the return code and the removal steps. For a wider picture, including DMARC alignment and mailbox reputation, see email deliverability monitoring, and if you are working through a broader incident, the general guide on how to get off an email blacklist covers the other major lists.