Your emails start bouncing with messages like “554 rejected – listed at zen.spamhaus.org” or “blocked using bl.spamcop.net”, or customers say your messages never arrive. Your mail server’s IP address has probably landed on a DNS blocklist (DNSBL), also called a blacklist or RBL. This guide explains why it happens, how to find and fix the cause, and how to get removed.
What is a DNS blocklist?
A DNSBL is a list of IP addresses that its operator considers a source of spam or abuse. Mail servers check the IP of every incoming connection against one or more lists, using a quick DNS query. If the IP is listed, they may reject the email, send it to spam or give it a higher spam score. Lists are run by independent organisations, each with its own criteria – some list only confirmed spam sources, others list entire ranges of residential addresses as a policy.
Step 1: Confirm the listing
- Find the IP address your email is sent from. It is in the bounce message, or in the headers of a sent message (the first “Received:” line added by your server). If you use a hosted email service such as Google Workspace or Microsoft 365, their IPs are their responsibility – the problem is more likely your domain’s SPF, DKIM or DMARC.
- Run that IP through our IP blacklist check.
- Note which lists show it as listed, and read the reason or code they return.
Step 2: Understand why you were listed
A compromised account or device
By far the most common cause. A mailbox password is guessed or phished and used to send spam through your server, or a computer on your network is infected and sends spam directly. Signs: a sudden spike in outgoing mail, a queue full of messages you did not send, or bounce-backs from addresses you never wrote to.
A vulnerable website
Contact forms, outdated CMS plugins and abandoned scripts on a web server can be abused to send mail. If your website and mail share an IP, the whole server gets listed.
Missing or generic reverse DNS
Mail servers are expected to have a PTR record with a proper name that matches a forward record, such as mail.example.com. A missing PTR or a generic one like 203-0-113-25.dynamic.isp.net looks like a home computer. Check with our reverse DNS lookup.
Policy listings of dynamic and residential IPs
Some lists, such as Spamhaus’s PBL, include address ranges that should not send email directly – home broadband, mobile and dynamic ranges – whether or not spam was seen. If you are sending from a home connection, this is expected: send through your provider’s or email service’s outgoing (SMTP) server instead.
Bad email practices
Sending to old, purchased or scraped lists hits spam traps – addresses that never signed up for anything – and generates complaints. Missing unsubscribe links and sending without consent have the same effect.
Bad neighbours
On low-cost hosting, an entire range can be listed because of other customers. You can see the range owner with our WHOIS lookup.
Step 3: Fix the root cause
Do this before asking for removal. If the spam continues, you will be relisted – often for longer.
- Check your mail queue and logs for unusual volume and identify which account or script is sending.
- Reset passwords on affected mailboxes, enable two-factor authentication where possible, and log out all sessions.
- Scan computers on the network for malware. Block outgoing port 25 at your firewall for every device except the mail server, so infected PCs cannot send directly.
- Update or remove vulnerable website plugins and forms; add CAPTCHA to forms.
- Make sure you are not an open relay – your server must only accept mail for your own domains or from authenticated users.
- Set up reverse DNS with your hosting provider and make the server’s HELO name match it.
- Publish SPF, DKIM and DMARC and verify them with our DNS lookup. See DNS records explained for examples.
- Clean your mailing lists: remove bounces and inactive subscribers, and use confirmed opt-in.
Step 4: Request removal
Every list has its own process, and the listing result or bounce message usually links to it. In general:
- Spamhaus – look up the IP on the Spamhaus website. It tells you which of its lists include the IP and why, and offers a self-service removal for many listings once the problem is fixed. PBL entries for residential ranges are policy listings; the right fix is usually to send via a proper mail server.
- SpamCop – listings expire automatically, typically within 24 hours after reports stop.
- Barracuda – has a removal request form on its website; requests are reviewed, usually within a day or so.
- UCEPROTECT – Level 1 listings expire automatically after a period without spam; Levels 2 and 3 list whole networks and providers and are outside your control. Be cautious of paid “express delisting” offers.
- Other lists – most have a lookup and removal page. Smaller lists often have little impact on delivery.
Explain briefly what happened and what you fixed. Be patient and do not submit repeated requests.
Step 5: Monitor
- Re-run our blacklist check over the following days.
- Set up DMARC reporting to see who is sending email using your domain.
- Register for feedback and reputation tools offered by large mailbox providers, such as Google Postmaster Tools and Microsoft SNDS.
- Monitor outgoing mail volume and set alerts for unusual spikes.
When it is not a blocklist
If your IP is clean but emails still go to spam, the issue is usually authentication or content: missing or failing SPF/DKIM/DMARC, a new domain with no reputation, links to low-reputation sites, or many recipients marking your messages as spam. Large providers use their own internal reputation systems, which no public list can show.
Summary
An IP gets blacklisted when a list operator sees spam or abuse from it, or as a policy for residential ranges. Find the listing with our checker, fix the underlying cause – usually a compromised account, device or website – set up reverse DNS and email authentication, then request removal list by list.