Home › Guides

UCEPROTECT Level 3 Removal: Level 1, 2 and 3 Explained

Published 2026-11-03 ／ Updated 2026-11-03 ／ By Yuki Nakazawa

UCEPROTECT Level 3 removal is not something an individual customer can usefully request (UCEPROTECT calls such requests futile): Level 3 lists every IP of a provider's ASN, and only that provider can change the situation. Level 2 works the same way one step down, listing a whole allocation (netblock) rather than a single address. Level 1 is the only level that lists your IP on its own, and it is the one you can actually fix yourself.

So the first job is to find out which level you are on. According to UCEPROTECT's front page, every listed IP expires 7 days after the last detected abuse, free of charge. For Level 2 and Level 3, the official pages instead say a listing is removed once it no longer meets the listing criteria, and manual listings of networks suspected of being set up for spamming are permanent. UCEPROTECT also offers an optional paid immediate removal (Express Delisting), but it is withheld in several situations described below. Listing and delisting decisions are made by UCEPROTECT, not by the people who use its lists.

This guide is based on UCEPROTECT's official pages as of November 2026. Policies can change, so check the current pages before you act. If you are still working out why mail is bouncing in the first place, start with our guide to email blocked by blacklists.

What UCEPROTECT is: Level 1, Level 2 and Level 3

UCEPROTECT-Network is a project that publishes DNS-based blocklists (DNSBLs) for spam filtering. According to its blacklist policy, listings are created mainly automatically, when mail reaches the project's spamtraps (Level 1 also allows manual listings by members of the UCEPROTECT organization), and the lists are rebuilt hourly. There are three levels, and they behave very differently.

On Level 1, the policy says the number of incidents needed varies. An IP with no reverse DNS, wrong reverse DNS or a generic reverse DNS name, or one in a network that regularly emits abuse, is at the highest risk of being listed after a single incident. Since 28 June 2007, backscatter (for example, bounces and sender callouts sent to forged addresses) is no longer handled by Level 1 but by a separate list at backscatterer.org.

Level 2 and Level 3 list networks, not just your IP

Level 2 escalates from Level 1. The policy page says allocations smaller than a /27 are listed after a single impact, a /26 after at least 2 impacts and a /25 after at least 3. From a /24 with 4 or more impacts, larger allocations escalate according to a formula published on the page. Level 2 de-escalates on its own: the allocation is removed once the number of Level 1 impacts drops below the limit within the last 7 days.

Level 3 works at the level of the autonomous system. The SPAMSCORE is calculated as (Level 1 impacts from the ASN / total IPs in the ASN) * 100000. Once it reaches 50, all IPs assigned to that AS number are listed. A second condition, at least 50 Level 1 impacts in the last 7 days, keeps small providers from being listed over one or two spammers. The page adds that good providers usually stay well below a SPAMSCORE of 10.

Why you can be listed without sending spam

UCEPROTECT's removal policy says that if your netblock is listed at Level 2 and you neither own the whole block nor are the provider, this is a good indicator that you are an innocent user, and that other customers or the provider caused the listing. A Level 3 listing reflects abuse across the provider's network. Shared hosting and VPS customers can be exposed when many unrelated users sit in the same ranges (this is our reading, not a statement from UCEPROTECT); see what to do when a shared hosting IP is blacklisted.

Both policy pages also describe manual, permanent listings for networks or ASNs suspected of being set up for spamming, for example where a provider rotates abusers through its space or tries to evade blocklists.

How to check which level you are on

Start by finding out exactly which level you are on. The removal policy itself says the first step is to learn whether only your IP, a complete netblock or your whole provider is blacklisted.

1. Identify the sending IP. The bounce message often quotes a UCEPROTECT URL or explanation text. If it does not, look at the Received headers of a message you sent, or ask whoever runs your mail server.
2. Look it up on the official page. Use the UCEPROTECT Query Database. The page asks users to test their IP address and providers to test their AS number. Results are shown per level.
3. Write down what you see. The level, the timestamps and any explanation are what your provider or hosting company will need.

The lookup page states that only manual queries are allowed and that automated or excessive querying gets the querying IP locked out.

From the command line, reverse the IP and append each zone (example for 192.0.2.10). By the usual DNSBL convention, an answer means listed and no answer means not listed on that level (UCEPROTECT's DNS page lists the zones but does not describe the answers).

dig +short 10.2.0.192.dnsbl-1.uceprotect.net
dig +short 10.2.0.192.dnsbl-2.uceprotect.net
dig +short 10.2.0.192.dnsbl-3.uceprotect.net

UCEPROTECT is only one of many lists. To check the same IP against other blocklists at once, use our blacklist checker.

Level 1 expiry and what you can fix yourself

UCEPROTECT's front page states that every listed IP expires 7 days after the last abuse is detected, free of charge. The Level 1 removal page says each IP expires automatically 7 days after the last spam from it hits the spamtraps, and that there is no need to request removal if you do not want to pay. Each new hit restarts the 7-day clock, so waiting only works once the cause is gone.

What to fix on Level 1

1. Stop the traffic. Check for compromised mail accounts, abused web forms or CMS installations, malware on machines behind the same IP, and forwarding rules that pass spam on. The removal page notes that a listing can result from negligent security that let a spammer abuse your system.
2. Fix reverse DNS and naming. Missing or generic reverse DNS raises the risk of a listing, so give your sending server a proper hostname with matching PTR.
3. Stay clean for 7 days. If no further abuse is detected, the listing expires by itself.

What end users can do on Level 2 and Level 3

The Level 2 removal page says that normally only your service provider can request Level 2 removal, and the Level 3 removal page says that removal requests from end customers at Level 3 are futile. The official pages suggest:

• Tell your provider or hosting company about the listing and ask them to stop the abuse inside their network.
• For Level 2, ask for a different netblock that is not known as a spam haven.

As our own suggestion (not from the official pages), also confirm that your IP is not on Level 1, so you can show that the problem is not on your side.

If you cannot pin down the cause yourself, you can also ask a specialist for help.

What UCEPROTECT asks providers to do

For providers, the removal pages recommend using the Query Database to find which of their IPs are listed on Level 1, then checking the last 7 days of mail logs on those servers for undeliverable outgoing mail at the listed times. It also asks providers to implement the four steps described under Help for ISPs before contacting UCEPROTECT:

1. Avoid techniques that generate backscatter, such as sender callouts (sender address verification), and tell customers running their own servers to avoid them too.
2. Make sure large amounts of garbage cannot be sent through your mail servers or smarthosts: set sending limits, monitor outbound logs, and automatically stop accounts that keep hitting nonexistent recipients.
3. Make sure dynamic, dial-up and home connections cannot be abused as spam zombies by blocking outbound port 25 to anything except your own relays, and directing users to submission on port 587.
4. Vet new customers, secure hosted servers and scan static-IP customers regularly for exploitable weaknesses.

According to the removal pages, a Level 2 allocation is removed once its Level 1 impacts fall below the limit, and a provider is removed from Level 3 as soon as it no longer matches the Level 3 listing criteria.

Paid Express Delisting: what the official pages say

UCEPROTECT offers an optional paid immediate removal for listees who do not want to wait 7 days. The Level 1 removal page says payment is accepted only through Stripe, removal is done manually once payment is confirmed, and the IP may be listed again if new abuse becomes known. The Level 2 and Level 3 removal pages describe the same kind of offer per allocation and per ASN, addressed to the provider that runs the network. Check the official pages for the current terms.

When Express Delisting is not offered

The front page says the immediate removal is not available at all in these cases:

• The owner of the IP or the ISP has declared that they do not want this option.
• Abuse has been seen from IPs listed in Level 1 or the backscatterer list within the last 3 hours.
• A network area listed in Level 2 has exceeded its listing limit by a factor of 10 or more.
• An AS listed in Level 3 is in the top 5 of the Level 3 charts.
• Listings in Level 2 or 3 are still increasing.

The Level 2 and Level 3 removal pages add that the offer is also withdrawn if UCEPROTECT believes the provider collaborates with spammers. Without Express Delisting, the front page's description still applies: the listing expires 7 days after the last detected abuse, free of charge.

About whitelisted.org

The Level 2 policy page and the Level 2 and Level 3 removal pages say clean individual IPs registered at ips.whitelisted.org are generally excluded from those levels. The whitelisted.org site, whose footer credits UCEPROTECT-Network, says registered IPs are excluded from neighborhood blocklists such as Levels 2 and 3 for as long as the subscription is valid, and that an IP listed on Level 1 for abuse cannot stay in the whitelist zone.

How receivers are told to use the lists

UCEPROTECT does not reject mail itself. Rejections happen when the administrator of a receiving mail server configures it to query these lists. What the official pages say about that use:

• The lists are offered free of charge for private or commercial use, and use is at the operator's own risk.
• The Level 2 policy says that by using Level 2 blocking, operators should be prepared to lose a few mails, and suggests incorporating it into a scoring system instead (for example, 4 points on a match where 5 or more points trigger a spam tag). It also suggests whitelisting sender IPs you need.
• The Level 3 policy says it can, and probably will, cause collateral damage to innocent users when used to block email. Its recommended use is scoring (for example, 2 points on a match), with outright blocking described as an option for hardliners.
• The DNS usage page notes that systems with more than 100000 requests per day are advised to use rsync instead of DNS queries.

If mail to a particular recipient is being rejected, you can contact the provider about the listing and, in parallel, give the recipient's administrator the bounce text and your sending IP so they can review it. Receivers often run their own filters as well, so delisting does not by itself mean mail will be accepted right away.

FAQ

Official pages used

The facts in this article were checked against the official pages below at the time of publication. Policies and behavior change without notice, so check the official pages before relying on anything important.

• UCEPROTECT-Network: home page (expiry and Express Delisting conditions)
• UCEPROTECT: Blacklist Policy Level 1
• UCEPROTECT: Blacklist Policy Level 2
• UCEPROTECT: Blacklist Policy Level 3
• UCEPROTECT: Removal Policy
• UCEPROTECT: Removal from Level 1
• UCEPROTECT: Removal from Level 2
• UCEPROTECT: Removal from Level 3
• UCEPROTECT: Help for ISPs
• UCEPROTECT: How to use with DNS
• UCEPROTECT: Query Database
• whitelisted.org
• UCEPROTECT: Blacklist Policy (overview)
• UCEPROTECT: How to use the lists (overview)

Related guides

All guides →