If your server's IP address is listed on Spamhaus or another DNS-based blocklist, mail sent from it will be rejected or filtered by most receiving servers. Getting delisted is straightforward in principle, but only lasts if the underlying cause has been dealt with.
1. Confirm the listing and find out why
Check the address with a blocklist lookup tool such as MXToolbox Blacklist Check, or directly at check.spamhaus.org.
A listing comes with a reason, and it matters which one:
- Spam sent from the address — the usual case, and the one this article is about.
- Compromised host or malware — the server itself is infected or being used as a relay.
- Policy listings — some lists cover whole ranges of addresses regardless of behaviour. These are not about anything you did and are handled differently; open a ticket if you see one.
Note down the exact listing and reference link before doing anything else — you will need them, and our support team will need them too.
2. Find and fix the cause
Delisting without fixing the cause achieves nothing: the address is relisted within days, and repeat listings are harder to clear.
The usual culprits, in rough order of likelihood:
- A compromised website. An outdated CMS or plugin is exploited and a mailer script is uploaded. Check the mail queue: a queue full of messages you did not send, addressed to people you do not know, points straight at this.
- A compromised mailbox. A weak or leaked password lets someone authenticate and send through your server legitimately. Check the mail logs for logins from unexpected addresses.
- An open relay or misconfiguration. A mail server that accepts mail from anyone will be found and used within hours.
- Your own mailing. A newsletter to a purchased or stale list produces spam complaints and gets you listed just as effectively as a compromise.
Practical steps:
- scan the server for malware — see How to scan your server for viruses;
- update the CMS, its plugins and themes;
- change the passwords of all mailboxes on the server;
- inspect the mail queue and clear out the messages that should not be there;
- check that your mail server is not acting as an open relay.
3. Send us a report
Open a ticket with our Technical Support department describing:
- which blocklist the address is on and the reference from the lookup;
- what you found as the cause;
- what you have done about it.
Our specialists then submit the delisting request. The report is not a formality: Spamhaus and similar operators expect the cause to have been addressed, and a request without substance behind it either fails or produces a shorter-lived result.
How long it takes
Removal usually takes from a few hours to a couple of days, after which mail delivery recovers gradually as receiving servers refresh their own caches. Repeat listings for the same address take longer to clear.
Reducing the chance of a repeat
- Configure SPF, DKIM and DMARC, and a matching PTR record — see How to configure a PTR (reverse DNS) record for your server. These do not prevent a compromise, but they make your legitimate mail identifiable and forgery of your domain harder.
- Keep the CMS and its extensions updated. Nearly every compromise we see follows an unpatched component.
- Use strong, unique mailbox passwords.
- Watch the mail queue occasionally. A queue that is growing without reason is the earliest warning you will get — well before the listing appears.
If you cannot identify the cause yourself, say so in the ticket. We can see what is leaving the server and help you find it.
