# How to get your domain or IP removed from an email blacklist

URL: https://iblockspam.com/blog/remove-domain-ip-from-email-blacklist
Last updated: 2026-10-09
Published: 2026-10-09
Topic: Running email day to day
Author: iBlockSpam Team

> How to check if your mail server IP or domain is on a DNS blocklist, find the real cause, and request removal from Spamhaus, SpamCop, Barracuda and Microsoft.

## Short answer

Find the IP address that actually sends your mail, check it against the major blocklists, and read each listing's reason. Fix the cause first: a compromised account, an infected device, an open relay or a missing PTR record. Then use each list's own removal page. Most lists expire on their own once the abuse stops.

A bounce that says "blocked using" a list name means a receiving server checked your sending IP or domain against a DNS blocklist and found a match. Blocklists (often called blacklists) are not all the same, and the fix depends on which list it is and why you're on it. This guide shows how to confirm the listing, find the cause, and request removal the right way.

## How do email blocklists work?

Most blocklists are published in DNS, as described in [RFC 5782](https://www.rfc-editor.org/rfc/rfc5782.html). To check an IPv4 address, a receiving server reverses its octets and adds the list's zone name. For `192.0.2.99` on a list at `bl.example.net`, it looks up `99.2.0.192.bl.example.net`. Any A record in the answer, conventionally `127.0.0.2`, means "listed". A TXT record usually explains why.

Domain lists work the same way with a domain name in place of the reversed IP. These lists check the domains in your mail, not the server that sent it.

The receiving server decides what to do with a match. Some reject outright, some add spam points, and some ignore a list entirely. That's why one recipient bounces your mail while another accepts it.

## How do you check if you're on a blacklist?

1. **Find the IP that actually sends your mail.** Open a bounced or delivered message's headers in the [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer) and find the first `Received` line added by a server outside your network. If you use Microsoft 365 or Google Workspace, that IP belongs to the provider, not you.
2. **Read the bounce text.** Rejections usually name the list and often include a lookup link. [M3AAWG's Sender Best Common Practices](https://www.m3aawg.org/sites/default/files/doc_files/m3aawg-sender-best-common-practices-aug-27-2026.pdf) notes that the descriptive text in a bounce may show that your IP is on a blocklist and must be removed before mail will get through.
3. **Check the major lists.** Run the IP, and your domain, through the [Blacklist Checker](https://iblockspam.com/tools/blacklist-checker). Some lists, including Spamhaus, don't answer lookups made through public DNS resolvers, so check those on the list's own lookup page. Confirm any hit there before you act.
4. **Watch for false alarms.** Spamhaus [returns error codes](https://www.spamhaus.org/resource-hub/dnsbl/using-our-public-mirrors-check-your-return-codes-now/) instead of results when queries arrive through public or open resolvers: `127.255.255.254` means "Query via public/open resolver/generic rDNS", and `127.255.255.255` means too many queries. A tool that treats these as listings is wrong.

## How do the major blocklists differ?

| List | What it lists | How removal works |
|---|---|---|
| Spamhaus SBL | IPs and ranges identified as malicious | Only the ISP or host in charge of the IP can request removal |
| Spamhaus XBL | IPs showing signs of compromise, such as malware | Fix the infection, then use check.spamhaus.org; listings also expire |
| Spamhaus CSS | IPs sending low-reputation email | Fix the cause, then check.spamhaus.org; normally expires 3 days after the last detection |
| Spamhaus PBL | End-user ranges that shouldn't send mail directly | Not a penalty; exclusions possible for real mail servers |
| Spamhaus DBL | Domains with poor reputation | check.spamhaus.org; also expires once the activity stops |
| SpamCop (SCBL) | IPs that sent mail reported by SpamCop users | Time-based; delisting is automatic when reports stop |
| Barracuda (BRBL) | IPs with a poor reputation for sending email | Removal request form |
| UCEPROTECT | Level 1: single IPs; Level 2: allocations; Level 3: networks (ASNs) | Level 1 expires after 7 days without abuse |

ZEN is not a separate list. Spamhaus describes it as the [SBL, XBL and PBL combined](https://www.spamhaus.org/blocklists/) in one zone.

### Spamhaus

[Spamhaus](https://www.spamhaus.org/blocklists/) runs several lists, and each has its own rules:

- **SBL.** When Spamhaus lists an IP, it notifies the network or hosting company responsible. The [SBL page](https://www.spamhaus.org/blocklists/spamhaus-blocklist/) says removal requests "must be sent by the Internet Service Provider in charge of the listed IP address(es)". If you're an end user, ask your host or ISP.
- **XBL.** The [XBL](https://www.spamhaus.org/blocklists/exploits-blocklist/) lists addresses "exhibiting signs of compromise". Removals are handled only at check.spamhaus.org. If the problem isn't fixed, Spamhaus says the IP "will re-list the next time it makes a connection".
- **CSS.** The [CSS](https://www.spamhaus.org/blocklists/combined-spam-sources/) is produced automatically and targets low-reputation senders. Spamhaus lists poor list hygiene and misconfigured servers among the causes, and says the problem "MUST be identified and corrected" before removal. Its best practices include a defined PTR record and a sensible HELO name.
- **PBL.** The [PBL](https://www.spamhaus.org/blocklists/policy-blocklist/) marks ranges, usually dynamic or residential, that shouldn't deliver mail directly. A listing is "NOT a result of any actions undertaken by the end users". You can request an exclusion only for a static IP running an outbound mail server, with matching forward and reverse DNS, that's assigned to you. Exclusions last one year.
- **DBL.** The [DBL](https://www.spamhaus.org/blocklists/domain-blocklist/) lists domains, which receivers match against domains in message headers and bodies. A listed domain in a link can hurt mail sent from a clean IP.

Spamhaus removals are free. Its SBL page warns: "Any offer from anyone to remove any Spamhaus listing for a fee is a scam."

### SpamCop

The [SpamCop Blocking List](https://www.spamcop.net/bl.shtml) lists IPs that sent mail reported by SpamCop users. It is "time-based, resulting in quick and automatic delisting of these sites when reports stop." SpamCop itself describes the list as aggressive and advises receivers to tag and divert mail rather than block it outright. Your job is to stop whatever triggered the reports.

### Barracuda

The Barracuda Reputation Block List is generated automatically. The [removal request form](https://www.barracudacentral.org/rbl/removal-request) asks for your mail server's IP, an email address and a phone number. Barracuda says requests are "typically investigated and processed within 12 hours" if you give a valid explanation, and that multiple requests are ignored. Submit once.

### UCEPROTECT

[UCEPROTECT](https://www.uceprotect.net/en/index.php?m=7&s=0) lists at three levels. Level 1 covers single IPs and, its removal page says, means "it is very likely you caused the problem yourself". Level 1 records expire after 7 days without abuse. Levels 2 and 3 cover whole allocations and provider networks. A Level 2 or 3 listing usually reflects your neighbors' or your provider's traffic, so raise it with your host.

### Microsoft 365 and Outlook.com

Microsoft keeps its own blocked senders list. A bounce with [`550 5.7.606-649 Access denied, banned sending IP`](https://iblockspam.com/smtp-errors/550-5-7-606-649) means you can use the [delist portal](https://learn.microsoft.com/en-us/defender-office-365/external-senders-use-the-delist-portal-to-unblock-yourself) at sender.office.com. Microsoft notes that removal "might take up to 24 hours or longer". A [`5.7.511`](https://iblockspam.com/smtp-errors/550-5-7-511) bounce can't use the portal: forward the bounce to the address it gives, and Microsoft says it will reply within 48 hours. Outlook.com, the consumer service, has a separate form linked from the same page.

## What usually causes a listing?

Don't request removal until you've found the cause. Most lists relist quickly if the problem continues, and Spamhaus says CSS listings for chronic abuse can last longer.

| Cause | What you'll see | Fix |
|---|---|---|
| Compromised mailbox | Sudden spike in outbound mail, bounces you didn't send, new forwarding rules | Reset the password, revoke sessions, enforce MFA; see [what to do after clicking a phishing link](https://iblockspam.com/blog/what-to-do-after-clicking-phishing-link) |
| Infected device or app | XBL listing, connections on port 25 from a PC or IoT device | Find and clean the device; block outbound port 25 from everything except your mail server |
| Open relay | Your server accepts and forwards mail for anyone | Require authentication for relaying; allow only your own networks |
| Missing or generic PTR | CSS or PBL listing, "reverse DNS" in bounces | Ask the IP owner to set a matching PTR; see [reverse DNS for mail servers](https://iblockspam.com/blog/reverse-dns-ptr-records-for-mail-servers) |
| Sending from a dynamic or home IP | PBL listing | Send through an authenticated relay on port 587 or 465, as Spamhaus advises |
| Poor list hygiene | CSS listing, trap hits, complaints | Remove bounced and unengaged addresses; use confirmed opt-in |
| Backscatter | Your server bounces spam to forged senders | Reject at SMTP time instead; see [backscatter](https://iblockspam.com/blog/backscatter-spam-bounce-messages) |
| Shared hosting neighbors | SBL or UCEPROTECT Level 2/3 on your host's range | Ask your host, or move to a cleaner sending IP or relay |

## Step-by-step delisting checklist

1. **Confirm the listing** on the list's own site and note the reason and listing time.
2. **Stop the source.** Lock compromised accounts, clean infected devices, close any open relay, and pause bulk campaigns.
3. **Check your logs** for the period around the listing time. Look for unusual senders, volumes or destinations.
4. **Fix DNS basics.** Make sure the sending IP has a PTR record that matches its forward DNS. Check with the [PTR Lookup](https://iblockspam.com/tools/ptr-lookup). Confirm SPF, DKIM and DMARC with the [Email Health Check](https://iblockspam.com/tools/email-health-check).
5. **Request removal once per list**, using only the list's own form. Explain what happened and what you changed.
6. **Wait, then retest.** Allow for each list's processing time and for DNS caching on receiving servers.
7. **Monitor.** Recheck daily for a week. A quick relisting means the cause is still there.

## How do you stay off blocklists?

- Enforce MFA on every mailbox, and alert on new forwarding rules.
- Allow outbound port 25 only from your mail servers.
- Keep a PTR record and HELO name that match your sending hostname.
- Move bulk and marketing mail to a subdomain or a dedicated sending service, so a campaign problem doesn't hit staff mail.
- Publish SPF, DKIM and DMARC, and read your [DMARC reports](https://iblockspam.com/blog/how-to-read-dmarc-reports) for senders you don't recognize.

## Next steps

1. Run your sending IP and domain through the [Blacklist Checker](https://iblockspam.com/tools/blacklist-checker), then confirm any hit on the list's own site.
2. Work through the cause table before you submit any removal request.
3. If you send from your own server, check its reverse DNS with the [PTR Lookup](https://iblockspam.com/tools/ptr-lookup).
4. If you'd rather not run outbound mail yourself, a smart host is one option. iBlockSpam includes an [outbound relay](https://iblockspam.com/features/outbound-relay) with DKIM signing, with 500 messages per month included.

Browse more guides on [running email day to day](https://iblockspam.com/blog/topic/operations).

## Frequently asked questions

### How long does it take to get off an email blacklist?

It depends on the list. Spamhaus says CSS listings normally expire three days after the last spam detection. Barracuda says removal requests are typically processed within 12 hours. Microsoft says delisting can take up to 24 hours or longer. If the cause isn't fixed, most lists simply list you again.

### Should I pay to be removed from a blacklist?

Be very careful. Spamhaus states that any offer from anyone to remove a Spamhaus listing for a fee is a scam, and its removals are free through check.spamhaus.org. Most widely used lists expire listings automatically once the abuse stops, so fixing the cause is the step that matters.

### My IP is on the Spamhaus PBL. Does that mean I sent spam?

No. Spamhaus says a PBL listing is not the result of anything the user did. It marks address ranges, usually residential or dynamic, that shouldn't send mail directly to other servers. Send through your provider's authenticated relay instead, or, if you run a real mail server on a static IP with matching DNS, request an exclusion.

### Can I get Microsoft 365 or Google Workspace sending IPs delisted?

Not yourself. Those addresses belong to the provider, and lists such as the Spamhaus SBL only accept removal requests from the network that owns the IP. Report the bounce to your provider's support. Your own job is to check that none of your accounts is compromised and sending spam.

### Why does a blocklist check show I'm listed everywhere at once?

Often it's a lookup problem, not a listing. Spamhaus returns 127.255.255.254 to queries sent through public or open DNS resolvers, and some tools misread that as a listing. Recheck with a tool that queries properly, and read each list's own lookup page before acting.

## Sources

- [RFC 5782: DNS Blacklists and Whitelists](https://www.rfc-editor.org/rfc/rfc5782.html)
- [Spamhaus: Blocklists overview (SBL, XBL, CSS, PBL, DBL, ZEN)](https://www.spamhaus.org/blocklists/)
- [Spamhaus: Policy Blocklist (PBL)](https://www.spamhaus.org/blocklists/policy-blocklist/)
- [Spamhaus: Combined Spam Sources (CSS)](https://www.spamhaus.org/blocklists/combined-spam-sources/)
- [SpamCop Blocking List](https://www.spamcop.net/bl.shtml)
- [Barracuda Central: BRBL removal request](https://www.barracudacentral.org/rbl/removal-request)
- [Microsoft Learn: Remove yourself from the blocked senders list and address 5.7.511 Access denied errors](https://learn.microsoft.com/en-us/defender-office-365/external-senders-use-the-delist-portal-to-unblock-yourself)
- [Spamhaus: Using our public mirrors? Check your return codes now](https://www.spamhaus.org/resource-hub/dnsbl/using-our-public-mirrors-check-your-return-codes-now/)

## Free tools for this guide

- [Blacklist Checker](https://iblockspam.com/tools/blacklist-checker): Check an IPv4 or IPv6 address, or your mail servers, against public spam blocklists, with policy and delisting links.
- [Reverse DNS (PTR) Lookup](https://iblockspam.com/tools/ptr-lookup): Check PTR records, forward-confirmed reverse DNS and generic-looking host names.
- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [Email Health Check](https://iblockspam.com/tools/email-health-check): Grade your domain's MX, SPF, DKIM, DMARC and transport security in one scan.

---

Source: iBlockSpam, https://iblockspam.com/blog/remove-domain-ip-from-email-blacklist (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt