Home › Guides

Spamhaus Removal: How to Get Your IP or Domain Delisted

Published 2026-11-03 ／ Updated 2026-11-03 ／ By Yuki Nakazawa

Spamhaus removal works in three steps: find out exactly which Spamhaus list you are on, fix whatever caused the listing, then follow the delisting path for that specific list. Skipping the middle step means the IP is listed again if the cause remains.

The path depends on the list. PBL entries are policy listings, not accusations, and can sometimes be self-excluded. XBL and CSS are automated listings for infected or misbehaving hosts; they are listed again if the problem is detected again. SBL listings are handled through the ISP or network owner that controls the IP. DBL covers domains rather than IPs. In every case the final decision is Spamhaus's, and Spamhaus states that removal is never charged for.

This guide is based on Spamhaus's official pages as of November 2026. Spamhaus updates its policies and tools, so confirm the details on its site before you file anything. If you are still working out why mail is bouncing in the first place, start with our guide to email blocked by blacklists.

What Spamhaus is and what ZEN return codes mean

Spamhaus is a long-running anti-spam organisation that publishes reputation data as DNS blocklists (DNSBLs). When your server connects to deliver a message, the receiving server can look up your IP address, and sometimes the domains in your message, against these lists and decide whether to accept, filter or reject the mail.

The name you will see most often in bounce messages is ZEN (zen.spamhaus.org). ZEN is not a separate list of its own: it combines Spamhaus's free IP-based lists, namely the SBL, CSS, XBL and PBL, into a single zone so that mail servers only need one query. If you are listed in ZEN, you are actually listed in one of those four. Because ZEN only covers IP addresses, domains are checked separately against the DBL.

What the ZEN return codes mean

A listed IP returns an address in the 127.0.0.x range. The last number tells you which underlying list matched, which in turn tells you who can fix it.

The DBL (dbl.spamhaus.org) uses its own range. Answers from 127.0.1.2 to 127.0.1.99 mean the domain itself has poor reputation. Answers from 127.0.1.102 to 127.0.1.199 mean an otherwise legitimate domain that is being abused, typically a hacked website.

Codes that do not mean you are listed

Spamhaus is explicit that the following answers are errors and must not be read as a listing:

How to check whether you are listed

The authoritative place to look yourself up is Spamhaus's own IP and Domain Reputation Checker (check.spamhaus.org). Spamhaus's list pages point there for listing details and remediation steps, and it is the only place where PBL, XBL, CSS and DBL removals are handled.

1. Identify the sending IP. The bounce message often quotes a Spamhaus URL or return code, so read it carefully first. If it does not, look at the Received headers of a message you sent, or ask whoever runs your mail server which IP it sends from. Your web server and your mail server may not share an address.
2. Look up the IP. The result names the list you are on, gives a reason where Spamhaus discloses one, and shows the next step for that list.
3. Look up your domains too. Check the domain you send from and any domains that appear in links in your messages. Spamhaus notes that domain and IP reputations are related.
4. Write down what you see. The list name, the time and the explanation text are exactly what your hosting provider or ISP will ask for.

Spamhaus is not the only blocklist receivers use. To see whether the same IP or domain appears on other lists as well, run it through our blacklist checker. Clearing Spamhaus will not help much if another list is the one actually blocking you.

If you prefer the command line, reverse the octets of the IP and append the zone. For 192.0.2.10 that looks like this:

dig +short 10.2.0.192.zen.spamhaus.org

No answer means not listed, a 127.0.0.x answer maps to the table above, and a 127.255.255.x answer is an error. Read the next section before trusting that result, because the resolver you query through matters.

Why different tools show different results

It is common to see one checker report a Spamhaus listing while another says you are clean. Most of the time the difference comes down to which DNS resolver performed the lookup.

• Public resolvers often get a misleading "not listed". Free use of the Spamhaus DNSBLs comes with conditions, one of which is that queries are not made from a public resolver or from an IP with generic reverse DNS. According to Spamhaus's DNSBL usage FAQ, if you use a free open resolver such as Google Public DNS (8.8.8.8), in most cases you will get a "not listed" (NXDOMAIN) reply. A tool that relies on such a resolver can therefore tell you that a listed IP is clean.
• Some resolvers get an explicit error instead. Spamhaus returns 127.255.255.254 to queries that arrive through resolvers it cannot attribute to a specific user. Cloudflare's public DNS (1.1.1.1) is one example: Spamhaus announced in January 2022 that it would start rolling out this error code across Cloudflare's IP space from February 2022. That answer tells you nothing about your reputation.
• The path and setup matter too. The FAQ also notes that routes to public resolvers vary, so results can differ depending on the path; that some resolvers rewrite non-existent answers (NXDOMAIN hijacking); and that your mail server and your shell may not be using the same resolver.

When tools disagree, treat Spamhaus's own checker as the reference. And if you run a mail server that filters incoming mail with Spamhaus, the same issue cuts the other way: Spamhaus recommends running your own DNS resolver for these queries and warns that the 127.255.255.x error codes must never be used to reject mail. Free use is limited to low-volume, non-commercial use; higher volumes need Spamhaus's subscription services.

Spamhaus delisting, list by list

Each list has its own rules and its own owner. One rule applies to all of them: if the cause is still there, removal will not last.

PBL: the Policy Blocklist

The PBL lists end-user IP ranges that should not be sending mail directly to other mail servers, such as typical home and mobile broadband. Being on it is not a sign of wrongdoing. Mail from these ranges is expected to go through an authenticated submission server, such as your ISP's smarthost or your mailbox provider, which then delivers it. Only Spamhaus and authorised ISP accounts can change PBL records.

1. Ask whether you really need to send directly from this IP. If the mail comes from a desktop client, a printer or an app on an ordinary connection, the correct fix is to send through your provider's authenticated mail server, not to remove the IP.
2. If you run a real mail server, confirm the IP qualifies: it must be static, it must actually run an outbound mail server, its forward and reverse DNS must match, and it must be yours. Dynamic addresses and machines that are not mail servers do not qualify.
3. Request exclusion through the reputation checker, where the network's policy allows end users to do so. The request must come from an address at a non-free email domain; requests from free mailbox providers such as Gmail or Yahoo are invalidated.

Single-IP exclusions by end users expire after one year. If spam is detected from an excluded IP, the exclusion is reversed immediately. People who remove large numbers of IPs may lose the ability to remove, and bulk changes are meant to be handled by the ISP.

XBL: the Exploits Blocklist

The XBL lists IPv4 and IPv6 addresses showing signs of compromise. Listings are automatic, made when Spamhaus has compelling evidence that a device on the IP is insecure, compromised or infected. Examples Spamhaus gives include malware on a device, taking part in brute-force attacks, attempts to relay mail with stolen credentials, frequent connections to sinkholes in a pattern consistent with malware, and "free VPN" style apps that use the customer's device as a proxy.

1. Find the affected device. On a shared connection, check every computer, phone and server, plus the router and firewall. Look for unfamiliar apps and browser extensions, especially free VPNs.
2. Clean it, then update the operating system, software and security tools.
3. Close outbound port 25 on the router or firewall and allow SMTP only from your known mail servers.
4. Request removal through the reputation checker.

If the cause is not fixed, the IP will re-list the next time it connects to Spamhaus; blocking the sinkhole connection alone does not cure the infection. Listings also expire on their own once the behaviour stops. If the checker shows the IP as clear but some networks still block it, Spamhaus asks you to allow about 24 hours for them to catch up before opening a new ticket.

CSS: Combined Spam Sources

CSS is an automatically produced dataset of IPs sending low-reputation email, returned in ZEN as 127.0.0.3. Typical causes are unsolicited mail, poor list hygiene, snowshoe sending, a compromised or insecure installation, and server misconfiguration. Mismatched or missing forward and reverse DNS and HELO values are a classic trigger; Spamhaus recommends that the hostname and HELO match and that the PTR record points to the same hostname. Misconfigured hosting control panels can also behave like spambots.

Spamhaus is blunt here: whatever caused the problem must be identified and corrected before the IP is removed. Listings usually expire about three days after the last detection. The IP is listed again if the problem is still being detected, and self-removals are limited.

SBL: the Spamhaus Blocklist

The SBL lists IPs that Spamhaus has identified as malicious: spam sources, hosts for spam-advertised sites or other resources used by spam or malware operations, and security threats such as botnet controllers, phishing sites and ransomware hosts. SBL removal requests must be sent by the ISP in charge of the listed IP. If you are an end user, contact your ISP or email provider rather than Spamhaus. The ISP resolves the abuse, confirms it is permanently fixed and then contacts the SBL removal team through the listing page. All SBL removals are the sole decision of The Spamhaus Project.

DBL: the Domain Blocklist

The DBL lists domain names with poor reputation. Spamhaus does not publish its exact criteria, but its FAQ discusses snowshoe patterns across many domains and IPs, abuse-tolerant hosting, new domains whose reputation is still unknown, and legitimate sites that have been compromised, often through outdated CMS software or stolen credentials. SPF, DKIM and DMARC help, but domains are listed both with and without them.

1. If the site was hacked, take it offline if you can, remove infected files, update the CMS, plugins and extensions, secure the server, change every password and turn on two-factor authentication where possible.
2. Once the cause is gone, request removal through the reputation checker.

Submitting the form is no promise that the listing will be lifted. Listings also expire without intervention once the domain stops matching the criteria. Approved removals are usually processed quickly, though some systems can take up to 24 hours; Spamhaus asks you to get in touch if a listing persists beyond that.

Common causes to fix before you request removal

Before you file anything, work through the usual suspects. Most listings trace back to one of these:

• A hijacked mailbox. A leaked or guessed password lets spammers authenticate to your mail server and send through it. Reset the password, review sending logs and enable two-factor authentication.
• A compromised website or form. Outdated CMS installs and plugins get taken over, and contact forms with auto-replies can be abused to send mail to arbitrary addresses.
• Malware or proxy apps. An infected laptop or a "free VPN" app on your network can put the whole connection on the XBL.
• Purchased or stale lists. Mailing people who never asked to hear from you is a fast route to a listing. Spamhaus recommends double opt-in for bulk mail.
• A shared IP neighbour. On shared hosting, another customer on the same IP may be the real cause. Only the provider can deal with that, so contact them.
• Server configuration. Hostname, HELO and reverse DNS should match, and outbound port 25 should be limited to your mail server.

If email authentication is not set up yet, see how to set up SPF, DKIM and DMARC. It will not stop a listing on its own, but DMARC reports help you spot spoofing and it improves deliverability generally.

Things to avoid

• Do not file over and over. Repeated requests while the problem persists simply lead to re-listing, and PBL and CSS limit how often you can self-remove.
• Removal is never automatic or promised. SBL removals are solely Spamhaus's decision, and the DBL page says plainly that submitting the form is no promise of delisting.
• There is no fee. Spamhaus states that there is never any charge or fee associated with removing any Spamhaus listing. Be wary of anyone asking for payment in Spamhaus's name.
• On shared hosting, go through the provider. If you do not control the IP, you cannot fix the cause and usually cannot request SBL removal either.
• Allow for the receiver's own filters. Large mailbox providers use their own reputation systems alongside public lists, so delivery may not recover the moment you are delisted. If Gmail is still rejecting you, see why email is not reaching Gmail.

FAQ

Official pages used

The facts in this article were checked against the official pages below at the time of publication. Policies and behavior change without notice, so check the official pages before relying on anything important.

• Spamhaus: ZEN Blocklist
• Spamhaus FAQ: DNSBL Usage (return codes and public resolvers)
• Spamhaus: Policy Blocklist (PBL)
• Spamhaus: Exploits Blocklist (XBL)
• Spamhaus: Combined Spam Sources (CSS)
• Spamhaus: Spamhaus Blocklist (SBL)
• Spamhaus: Domain Blocklist (DBL)
• Spamhaus: Using our public mirrors? Check your return codes now
• Spamhaus: If you query the legacy DNSBLs via Cloudflare's DNS
• Spamhaus Technology Docs: Datasets

Related guides

All guides →