Short answer: First use check.spamhaus.org to see which sub-list your IP or domain is on. XBL and CSS listings can be removed yourself on that site once the source is cleaned up; for the PBL you confirm that you run a legitimate mail server; the SBL is a manually researched listing that usually needs your IP provider's involvement.
Spamhaus sub-lists
The zen.spamhaus.org zone that mail servers query combines several lists. Which one you're on decides the way out:
| List | What it lists | How to get removed |
|---|---|---|
| SBL | Spam sources and spam-support services identified manually by Spamhaus researchers. | Fix the issue described in the listing; removal usually goes through the owner of the IP block (your host or ISP). |
| CSS | Automatically detected low-reputation sending (misconfigured servers, mail hitting spam traps). | Fix the problem, then request removal at check.spamhaus.org. |
| XBL | Devices infected with malware, part of a botnet, or otherwise compromised. | Clean up the infection, then remove the listing yourself on the site. |
| PBL | IP ranges that should not send mail directly (residential and dynamic IPs). A policy list, not a penalty. | If you genuinely run a mail server on a static IP with proper reverse DNS, request removal. |
| DBL | Domains (not IPs) found in spam. | Fix the abuse involving the domain, then submit a request. |
Step-by-step removal
- Confirm: our blacklist check includes Spamhaus ZEN, but Spamhaus limits anonymous queries from large cloud networks and public resolvers, so get the definitive answer from check.spamhaus.org.
- Read the listing: the result page shows the sub-list and often the reason (for example "botnet infection detected").
- Stop the source: reset passwords of compromised mailboxes, inspect the server's mail queue, and scan devices on the network for malware. Skip this and the listing comes back quickly.
- Request removal: for XBL, CSS and PBL, open a request at check.spamhaus.org. For an SBL listing, follow the instructions in the record; usually you need to work with your hosting provider.
- Re-check: after removal, it can take a few hours for the change to clear mail servers' DNS caches.
Things to watch out for
- Spamhaus never charges for removal. Any site asking for payment to delist you from Spamhaus is not Spamhaus.
- If the same IP is listed repeatedly in a short time, self-service removal may be restricted; don't request removal until you're sure the source is found.
- If the PBL affects you and you're sending from an office connection without a static IP, the right fix is usually not PBL removal but sending through your provider's SMTP server (a smarthost).
The most common reason for being listed is spam sent through a stolen mailbox password, and those accounts are usually taken over through a phishing email. How to spot a phishing email.
Protect your inbox from spam, malware and phishing: point your MX record to Spambil and try it free for 7 days. No credit card required.
Frequently asked questions
How long does Spamhaus removal take?
XBL, CSS and PBL removal requests are usually processed quickly; mail servers' caches then update within a few hours. SBL listings are reviewed manually and can take longer.
The checker says I'm clean, but mail is rejected citing Spamhaus. Why?
Spamhaus may block queries from public DNS resolvers and large cloud networks, so third-party tools can show a false "clean" result. Use check.spamhaus.org for a definitive answer.
My domain is on the Spamhaus DBL. What should I do?
Fix whatever abuse involves the domain (a hacked website, links used in spam), then request removal for the domain at check.spamhaus.org.