Short answer: First confirm the listing and check whether your server is actually sending spam. If it is, stop the source (a compromised account, an infected machine or a script) and clear the queue. Check your SPF, DKIM and DMARC records, then use the delisting process of each list that names you. Delisting requests made before the source is stopped are usually refused, or you are relisted within days.
What is an email blacklist?
An email blacklist (also called a DNSBL, RBL or blocklist) is a public database, run by organizations such as Spamhaus, Barracuda, SpamCop or UCEPROTECT, that flags IP addresses or domains as sources of spam, malware or abuse. Most mail servers look up the connecting IP in one or more of these lists before accepting a message. If you are listed, your mail is rejected outright or quietly filed as spam.
How to check whether you are listed
Look up your server's public sending IP (not the domain name) in a checker: use our blacklist check, or cross-check with:
- mxtoolbox.com/blacklists.aspx: widely used, checks over 100 lists at once.
- multirbl.valli.org: very thorough, good for a second opinion.
Not sure which IP you send from? Look at the first Received: header of a message you sent (the email header analyzer shows it), or ask your host. Each "listed" row is a separate list with its own removal process. Bounce messages usually name the list too; see 550 5.7.1 and 554 5.7.1.
The 6 most common causes
- A compromised mailbox. An employee's password was phished and the attacker is sending bulk spam from the account. This is by far the most common cause.
- An infected computer or botnet member. A device on your network is running malware that sends mail on its own.
- A vulnerable website or script. A hacked contact form or CMS plugin on the same server is being used to send spam.
- The "bad neighbor" effect on shared hosting. Another account on the same IP sends spam and everyone on that IP gets listed, even if you did nothing wrong.
- A sudden volume spike. A server that normally sends 50 messages a day suddenly sending 5,000 trips automated detection.
- An open relay. A server that relays mail for anyone without authentication will be found and abused by spammers.
Missing SPF, DKIM or DMARC rarely gets an IP listed by itself, but it makes spoofing of your domain easy and lowers the reputation of your genuine mail.
What to do right away
Before you ask for delisting, stop the problem. Otherwise you will be listed again within days.
- Check the mail queue. Look at the number of messages waiting on your server (Exim:
exim -bpc; Postfix:mailq). Hundreds or thousands of queued messages mean an active spam source. - Find and stop the source. Use the logs to identify the account or script; reset the password, sign out all sessions, enable MFA, and suspend the account if needed.
- Clear the queue. Delete the queued spam, or it will keep going out after you are delisted.
- Verify SPF, DKIM and DMARC. Add whatever is missing (see SPF, DKIM and DMARC explained).
- Scan for malware. Run an up-to-date scan on the server and the devices on your network.
How to get delisted
Each list has its own process. Once the source is stopped, look up your IP on the list's own site:
| List | Removal process | Typical timing |
|---|---|---|
| Spamhaus | Look up the IP at check.spamhaus.org and follow the process for the specific sub-list | Hours to a few days |
| Barracuda | Free removal request form at barracudacentral.org | Usually within a day |
| SpamCop | No request; expires automatically once reports stop | About 24 hours |
| UCEPROTECT | Level 1 expires automatically if no new spam is seen | 7 days |
| Microsoft (Outlook.com / Microsoft 365) | sender.office.com or the Outlook.com sender support form | Usually within a day |
Removal forms usually ask what you did to fix the problem. Saying that you stopped the source, reset credentials and cleaned the queue improves your chances.
How to stay off blacklists
In practice most of these incidents start with one employee clicking one phishing email and entering their password. The attacker then sends spam from the stolen account, and days later you discover your server is listed. The real root cause is usually not "a bad mail server" but a phishing email that was never stopped.
- Enable multi-factor authentication for every mailbox.
- Set per-account outbound rate limits so a compromised account cannot send thousands of messages.
- Keep websites, plugins and the mail server itself patched.
- Filter inbound mail so phishing never reaches your users.
Spambil is a gateway that scans every incoming message, including phishing, credential harvesting and malicious attachments, via your MX record and quarantines it. It doesn't do delisting for you (that's what this guide is for), but by blocking the "employee clicked, account stolen" step at the start of the chain, it prevents the same problem from coming back.
Point your MX record in about five minutes and try Spambil free for 7 days. No credit card required.
Frequently asked questions
I requested delisting. Why am I still listed?
Some lists take a few hours to update, and many mail servers cache lookups. If the source wasn't fully stopped (spam still in the queue), the request may be refused automatically. Clear the queue and try again.
Is my domain or my IP listed? What's the difference?
IP-based lists (Spamhaus SBL/XBL, Barracuda and others) target your server's IP; on shared hosting the cause may be another account. Domain-based lists (such as the Spamhaus DBL) target your domain name, usually because it appears in spam or links to abused content.
Will Spambil get my server off a blacklist?
No. Spambil is an inbound gateway; delisting is a separate process, described above. What Spambil does is block the phishing attacks that most often cause these listings in the first place.