An email blacklist, sometimes called a blocklist, is a real-time database of IP addresses or domain names flagged as sources of spam, phishing, or abusive content. There are dozens of blacklists on the web and they all have their own criteria for what constitutes abuse, different criteria for what gets listed, and different methods and requirements for getting delisted. In our opinion, any blacklisting is a signal that deserves the attention of the listed service, but not all blacklistings cause the same level of impact. In the world of email deliverability, no blacklist is more impactful to overall email performance than Spamhaus.
The first Spamhaus blocklist went live in 2001. Over the decades Spamhaus became one of the most utilized and trusted email blacklists on the internet. They accomplished this by being a reliable and judicious arbiter of what constitutes abusive, or otherwise dangerous behavior. The work Spamhaus does extends beyond the world of email, but for the purposes of this article, we are going to focus on their work and their impact on email.
What Is the Spamhaus Blacklist
Spamhaus (often searched as "Spamhouse") publishes lists of IP addresses and domains that have been observed sending unwanted or malicious email. Spamhaus doesn't block any email itself, which surprises people. The decision to filter or block your messages lies completely on the receiving mail servers.
Mailbox providers use hundreds or thousands of different signals to determine if a message should be blocked, placed in the spam folder, or placed in the inbox. Whether or not a domain or IP address is on a blacklist is just one of these signals. In the world of email blacklists, Spamhaus is by far the most utilized by mailbox providers.
The reason a Spamhaus listing hurts so much is who relies on that data. Yahoo and Microsoft use it for sure, and so do the big ISP mailbox providers like Comcast, Optimum Online, AT&T and SBC Global. If you look at email deliverability data before and after a sender is listed by Spamhaus, you'll see a massive impact to overall deliverability. However, the impact is not the same across mailbox providers. Yahoo might just send your email to the spam folder. Microsoft domains and North American telecom providers might block your email outright. Deliverability to Gmail mailboxes might not budge. And there's everything in between.
Despite the mixed outcomes, one thing is clear, Spamhaus is the most impactful blacklist out there and finding yourself listed is catastrophic for your ability to reach your audience over email.
How Much Email a Spamhaus Listing Blocks
It really depends, but it's reasonable to expect a Spamhaus SBL listing to block roughly 30% to 40% of all your mail. That assumes a normal mix of mailbox providers, with the usual majority at Gmail, a smaller share at Yahoo, then Microsoft and the rest. On top of the blocked portion, another big chunk goes to spam, because not every receiver blocks on an SBL listing. Some just use it as a filtering signal.
Put together, the blocked mail and the mail sent to spam are why a Spamhaus listing can leave 60% to 70% of your mail dead in the water overnight.
Spamhaus Blocklists: SBL, DBL, CSS, PBL and the ZEN Multi List
Spamhaus doesn't run one blacklist. They run several, and each one catches a different pattern. Knowing which one you're on tells you what to fix.
The SBL (Spamhaus Block List) is the big one, and it lists IP addresses. This is the listing that does the most damage, and it's usually what people mean when they say "we're on Spamhaus."
The DBL (Domain Block List) lists domains instead of IPs, using the same general criteria. In our experience a DBL listing is somewhat less impactful than an SBL listing. The DBL exists because if a sender spreads their mail across a bunch of ESPs, Spamhaus can't keep blocking every IP address they touch, so eventually they block the domain.
The PBL (Policy Blocklist) is the odd one out among Spamhaus lists. It doesn't judge behavior at all. It doesn't ask whether an IP sent spam, only whether that IP should be sending mail directly to other servers in the first place. The technical details of this list are outside the scope of this article, but the PBL list serves as an advisory list of IP addresses that should not be connecting to remote mail servers. The PBL does occasionally list IP addresses for high concentrations of abuse, but some service providers will actually list themselves because they have IP space that simply should never be sending email.
The XBL (Exploits Block List) lists IP addresses of compromised machines: computers infected with malware, open proxies, or devices that are part of a botnet. Legitimate companies usually end up here because an infected computer or hacked server on their network is sending mail without anyone knowing. Cleaning the machine will fix this.
The CSS (the snowshoe list) catches senders who spread their traffic thin to stay under the radar. Snowshoeing is an old spam pattern: you send across 50 or 100 IP addresses, so no single one carries enough volume to get noticed. We've seen senders land on the CSS without sending hardcore spam, just for running a couple thousand messages across 50 to 100 IPs. It's important to note that snowshoeing can also apply to domains. Sending the same, spammy traffic across a large number of domains can also cause a CSS listing.
ZEN is the Spamhaus multi list, the combined feed. If a receiver only wants one type of listing, they subscribe to that list and run it against incoming mail. If they want everything, they subscribe to ZEN, which contains all the other lists in one.
Why You're Listed: How Spamhaus Decides to Blacklist an IP or Domain
Spamhaus operates a massive network of spam traps. A spam trap is essentially a mailbox with no real recipient on the other end. There are three primary types of spam traps: pristine, typo, and recycled.
Pristine traps are email addresses that have never been used by an actual person to sign up for and receive email. They were created from the start to receive email from senders who are purchasing or scraping email addresses from the web.
Typo traps are domains that closely resemble actual domain names. Something like a one-letter misspelling of a major webmail domain might be set up to identify unsolicited or malicious sending practices. The idea being if a sender is consistently sending email to typoed domain names, they are likely engaged in unscrupulous address collection behavior.
Recycled traps are email addresses at domains that were once valid. Think of your favorite organizations from the 90s or 2000s that no longer exist. Spam trap operators will purchase these retired domains and repurpose them as a spam trap.
Spamhaus and other blacklist operators monitor the email received by these spam trap addresses. If your domain or sending IP shows up enough times in their data, you risk being listed.
There is no hard number on how many traps you have to hit to be listed. It's not as simple as "if you hit 50 spam traps, you're on the list." Three things go into the decision: volume, duration, and content.
Duration is how long you've been hitting them. Blasting a lot of mail at their network in one day and never again looks different from hitting it a little at a time over six months.
Content matters as much as volume. If you send a thousand messages to one of their trap domains and every one says "Luke, verify your address," "Alex, verify your address," "Dave, verify your address," you won't get listed for that, because it's clearly address verification. But hit them a relatively small number of times with something like "Hey Alex, would you be interested in a job opportunity at Megafirm? We connect talented professionals with..." and they'll read that very differently from a confirmation email or an invoice.
Spam traps also have a shelf life. Old ones are constantly being retired. New ones are constantly entering the scene. Bad actors reverse engineer small portions of them and they become less useful for identifying abuse. It's an incredibly dynamic landscape and anyone offering to remove all the spam traps from your list or protect you from blacklisting for a fee is selling snake oil. The solution to blacklisting is always improving sender behavior and practices. There's no Easy Button.
How to Check if You're on the Spamhaus Blacklist
Spamhaus lists are queried over DNS. You take the IP address you want to check, write it backwards, and append the Spamhaus zone. Spamhaus keeps 127.0.0.2 permanently listed for testing, so it's a safe address to try. This is what a DNS query for that address against the ZEN list looks like in your terminal:
If the address is listed, the lookup returns one or more A records, and the value of that A record tells you the listing status and which kind of listing it is:
One thing that trips people up: if you run these lookups through a public DNS resolver like Google's 8.8.8.8 or Cloudflare's 1.1.1.1, Spamhaus refuses the query and returns 127.255.255.254. That's an error, not a listing. Mail servers that query Spamhaus this way get the same error, so run lookups through your ISP's resolver or your own.
This is also how receivers use Spamhaus in production. A mail server gets an incoming message, runs a DNS query against the relevant zone, and if it comes back listed, that listing is taken into account for filtering and blocking decisions. Plenty of servers don't block outright. They add points to a spam score instead, so a SpamAssassin score above one threshold plus a hit on a blacklist sends the message to spam, and a much higher score plus a listing gets it blocked.
Spamhaus Delisting: How to Get Removed
Spamhaus will always advocate strongly for fully confirmed opt-in, but they understand that isn't feasible in a lot of cases, so it's a recommendation rather than a demand. What they do expect is permission-based email, and they'll want to see that you've corrected the practices that got you listed before they remove you. The steps below apply to SBL, CSS and DBL listings. If you're on the PBL, the fix is sending through a proper mail server, or removing a static mail server IP through Spamhaus's self-service form. If you're on the XBL, find and clean the compromised machine first, then request removal. These are the steps.
1. Confirm the listing and which list you're on. Run the DNS lookup above against your sending IPs and domains or check your IPs and domains on the Spamhaus website. An SBL or DBL listing points to your list and sending practices. A CSS listing points to how your traffic is spread across IPs or domains. A PBL listing points to the server itself and whether or not it is supposed to be used to send email to remote mail servers.
2. Stop list purchasing, scraping and renting, and any cold unsolicited outreach. These are the big no-nos, and Spamhaus will expect them to be fixed before delisting.
3. Review how you collect addresses. Spam trap hits come from somewhere. Typo traps mean nothing is validating addresses at signup, pristine traps mean addresses are entering your list that no real person gave you, and recycled traps mean you're still mailing addresses that went dead a long time ago. Every address should come from someone who signed up to receive your email, with confirmed opt-in wherever it's feasible.
4. Put a sunsetting policy in place. Permission is temporary. If someone signed up in 2010 and it's 2026 and you still claim you have permission, Spamhaus is going to laugh at you. Keep your list to engaged people, and treat a year of non-engagement as a sign the person doesn't want your mail anymore.
5. If you were listed for snowshoeing, consolidate. If your mail is spread across many IPs or many domains, bring it back onto a small, clearly related set.
6. Submit the delisting request and be open and honest. Spamhaus will ask how you collect addresses, whether you have a sunsetting policy, whether you use confirmed opt-in, and whether you do any cold, unsolicited outreach. Answer plainly and explain what you changed. The best way to deal with Spamhaus is to be as open and honest as you can about what you're doing. They're not there to make your life hell; they're there to preserve email as a viable way to communicate. If your IP is listed on the SBL, Spamhaus only accepts removal requests from your Internet Service Provider or hosting provider, so work with them to submit it.
How Long Does Spamhaus Delisting Take, and Is It Free?
Delisting from Spamhaus is free. Spamhaus doesn't charge to remove a listing, so anyone selling "priority removal" isn't Spamhaus, and that money buys you nothing. What you can pay for is help finding and fixing what got you listed.
There's no fixed timeline. How long it takes depends mostly on how quickly you fix the cause. Once the problem is corrected and your request explains clearly what changed, removal can be fast. If the same pattern keeps showing up in their data, or you request removal without changing anything, expect the listing to stay or come back.
Spamhaus vs SURBL: Which Blacklist Matters More
In terms of overall impact to your deliverability, SURBL isn't even close to Spamhaus. This doesn't mean a SURBL listing is less capable of identifying unwanted or malicious email. It just means that more mailbox providers rely on Spamhaus for filtering and blocking decisions. Nearly all blacklistings are a signal that you're sending email to addresses that didn't sign up to receive it. Contacting the blacklist for more information about why you were listed is a great way to tie up loose ends with your address collecting and email sending practices.
Delisting is equally difficult with both, and they ask very similar questions. If you're dealing with a SURBL listing instead, our guide to the SURBL blacklist and how to get removed walks through that process. For a lower-impact list by contrast, see our scan of 1,055 domains against Validity's Heatwave blocklist.
What This Means for Senders
Most senders will never deal with Spamhaus directly. The senders who end up on the Spamhaus blacklist are usually the ones buying, scraping or renting lists, keeping addresses long after people stopped engaging, or building sending setups that look like evasion even when they aren't meant to.
If you do get listed, the fix is the same as the thing that prevents it in the first place: permission you can prove, permission that expires, and a list that only contains people who still want to hear from you.
If you're dealing with a Spamhaus listing or seeing blocks at Microsoft and ISP mailbox providers you can't explain, SH Consulting helps senders find the cause and fix it at the source through our email deliverability services. You can book a call with our team.
