Skip to main content
Blog
Michael Gibson 5 min read

Your Site Is on a Blacklist. Now What?

A blacklist listing can quietly kill a client's email deliverability. Here's which lists matter, why sites get listed, and how to get delisted for good.

A blacklist listing means a spam-tracking service has flagged your server's IP address, and mail providers that check that list may now reject or junk anything coming from it. It's fixable, usually within a few days, once you find out why it happened.

It usually shows up sideways. A client forwards a bounce that says "554 rejected, listed on zen.spamhaus.org." Contact form emails stop arriving. Password resets land in spam. Nobody touched anything, but something changed.

The lists behind this are called DNSBLs (DNS-based blackhole lists). Each one is a public database of IP addresses that someone has seen sending spam, attacking other servers, or behaving like a machine that shouldn't send mail at all. Mail servers query them on every incoming message. If your IP is on a list they trust, your mail doesn't get through.

Not every list matters equally

Spamhaus is the one to worry about first. Most major mail providers and filtering services use it, so a Spamhaus listing hurts deliverability almost everywhere. The others range from widely used to niche.

Act the same day

  • Spamhaus ZEN: lists known spam sources, compromised hosts, and IP ranges that shouldn't be sending mail at all.
  • Barracuda (BRBL): lists IPs whose mail hits Barracuda's spam traps. It matters most if your clients email businesses that use Barracuda appliances.

Worth investigating

  • blocklist.de: lists IPs caught making brute-force and exploit attempts against other servers. It's a strong sign the server itself is compromised.
  • S5H: lists open relays and open proxies it finds by probing. It means there's a misconfiguration you need to fix.
  • SpamCop: lists IPs based on spam reports from real recipients. Listings expire on their own once the reports stop.

Lower priority, but worth clearing

  • UCEPROTECT Level 1: lists IPs whose mail hits UCEPROTECT's traps. Few large providers rely on it.
  • SpamRats and 0SPAM: list IPs showing spam or dictionary-attack behaviour.

A listing on a minor list is still a signal. The cause is often the same thing that will get you onto Spamhaus next week.

Why sites end up listed

Most listings come down to one of four causes. Only the first one means someone actually did something wrong.

  • The site is compromised. An outdated plugin or a leaked password lets an attacker install a mailer script or use the server to attack others. This is the most common cause on WordPress and other CMS sites, and blocklist.de or Spamhaus CSS listings point straight at it.
  • A bad neighbour on shared hosting. You share an IP with hundreds of other sites. One of them gets hacked and starts spamming, and every site on that IP gets listed with it.
  • Leaked SMTP credentials. Someone gets hold of the mailbox password a contact form plugin uses and sends spam through your mail server.
  • Misconfiguration. An open relay, an open proxy, or an IP in a range Spamhaus expects to be residential or dynamic. Nothing malicious happened, but the server looks like it could be abused.

How to get delisted

Fix the cause first, then request removal. If you ask to be delisted while the problem is still active, you'll be relisted within hours, and some lists make the second removal harder.

  1. Confirm the listing and the IP. Look up the IP your domain actually resolves to, not the one you think it should be. Note which lists flag it and whether they flag the web server, the mail server, or both.
  2. Check whether it's you or a neighbour. On shared hosting, ask your host whether another account on the same IP caused it. If so, it's their job to clean up, or to move you to a clean IP.
  3. Look for compromise. Scan for malware and unfamiliar PHP files in upload directories. Check outgoing mail logs for volume you don't recognise, and look for new admin users.
  4. Rotate credentials. Change SMTP, hosting panel, and CMS admin passwords, and any API keys used to send mail.
  5. Close the hole. Update the plugin or theme that let the attacker in, and fix any open relay. If the server is meant to send mail, make sure SPF, DKIM, and reverse DNS are set up.
  6. Request removal from each list. Spamhaus, Barracuda, and most others have a self-service lookup and removal form. SpamCop clears itself once reports stop.
  7. Re-check after a day or two. Most lists process requests within a few hours to a few days. If it comes back, the cause isn't fixed.

Catch it before the client does

The worst way to find out about a listing is a client asking why their leads dried up two weeks ago. A daily check on every client site turns that into a same-day fix.

DownCTL checks each site's IP against eight blacklists every day: Spamhaus ZEN, Barracuda, SpamCop, blocklist.de, UCEPROTECT, SpamRats, S5H, and 0SPAM. When a site is listed, you get an alert. The site's health panel shows:

  • which lists flagged the IP, and what each one usually means
  • a direct delisting link for each list, with the IP already filled in
  • a short checklist for what to do next
  • how long the IP has been listed, and confirmation once it's clean again

Blacklist checks come with every site in DownCTL, alongside uptime, SSL, domain, DNS monitoring, and more. Start monitoring your sites and you'll know about the next listing before your client's inbox does.

All posts