MXToolbox happily reports you against 80-plus blacklists, most of which receiving mail servers have never heard of. The resulting panic is the "blacklist hysteria" problem: senders try to delist from lists nobody checks and ignore the three or four that actually drive their deliverability. This guide fixes that.
Five lists drive ~95% of blacklist-caused deliverability damage: Spamhaus (SBL, XBL, PBL, CSS, DBL), SORBS, Barracuda, SpamCop, and UCEPROTECT Level 1. Clear those five, stop worrying about the rest.
What a DNSBL is
A DNSBL (DNS-based Block List) is exactly what it sounds like: a zone in DNS that answers with an A record if a given IP is on the list. When a receiving mail server sees an incoming connection from, say, 203.0.113.5, it flips the octets and queries 5.113.0.203.zen.spamhaus.org. If DNS returns an address in 127.0.0.0/8, the IP is listed.
Because the check is a DNS lookup, it is fast (<50ms typically) and every major mail receiver does it at SMTP connect time, usually in the first milliseconds of the conversation. A listing on an influential DNSBL means your mail gets rejected or quarantined before you even get to send DATA.
The ones that matter
Spamhaus — the single most influential set of lists. Check all five zones via zen.spamhaus.org:
- SBL (Spamhaus Block List) — manually curated list of confirmed spam sources. Hard to get on, hard to get off.
- XBL (Exploits Block List) — compromised machines, open proxies, bots. Automated add, automated drop after remediation.
- PBL (Policy Block List) — ranges the owner says should not send directly to MX. Most consumer IPs live here by default.
- CSS (Composite Snowshoe) — snowshoe spam patterns across many IPs/domains.
- DBL (Domain Block List) — domains, not IPs. Listed when a domain appears in spam.
SORBS, Barracuda, SpamCop and UCEPROTECT Level 1 round out the list most senders should actually watch. UCEPROTECT Levels 2 and 3 list whole ASNs and ranges and should be ignored — most receivers don't honour them.
The ones that don't
There is a long tail of DNSBLs run by individuals or tiny projects: backscatterer.org, Hostkarma, IBL, and many more. Most receiving servers do not query them. A listing costs you nothing in deliverability. Attempting to delist is often a time sink (some projects charge fees; others haven't been maintained in years).
Rule of thumb: if a list isn't returned byzen.spamhaus.org, SORBS, Barracuda, SpamCop, or one of the major composite checkers (MXToolbox's top section), it is almost certainly safe to ignore.
How to check all at once
Three free services check dozens of DNSBLs in one query:
- MXToolbox (
mxtoolbox.com/blacklists.aspx) — checks ~85 lists, the top 10 are the ones that matter. Free, no signup for occasional use. - MultiRBL (
multirbl.valli.org) — the most comprehensive free checker, breaks out "whitelist" hits separately (those are good). - dnsbl.info — fast, simple, 60+ lists.
Checking via dig
For scripts or a quick one-off check against a single list, use dig. To check 203.0.113.5 against the Spamhaus ZEN composite zone:
dig +short 5.113.0.203.zen.spamhaus.orgAn empty response means not listed. A response like 127.0.0.2 indicates the SBL zone; 127.0.0.4 through 127.0.0.7 map to XBL; 127.0.0.10 and 127.0.0.11 to PBL. Spamhaus publishes the full return-code table on their site.
Spamhaus delisting
XBL / PBL: automatic. Once the root cause is fixed (compromised account cleaned, proper rDNS set, outbound mail routed through a smarthost), most auto-delistings happen within 24 hours. You can also submit a manual self-removal from spamhaus.org/lookup.
SBL: manual. You need to explain what you were doing, what went wrong, and what you have changed. Spamhaus volunteers review each request. Expect a 1–3 day turnaround. Lying or submitting a second request without changes will extend the listing.
DBL: submit through the same lookup page. If the domain is freshly registered and has no spam history the delisting is usually fast; if the domain was involved in a real spam run, it stays.
SORBS delisting
SORBS runs several separate zones (dnsbl.sorbs.net, spam.dnsbl.sorbs.net, web.dnsbl.sorbs.net, etc.). Most listings auto-expire after 48 hours of clean behaviour. Manual removal from the non-spam zones (misconfigured DNS, dynamic IPs) is free via their online form. Manual removal from the spam zone historically required a donation, which earned SORBS a poor reputation among senders, though policies have softened in recent years.
Barracuda delisting
Free self-service form at barracudacentral.org/rbl/removal-request. Fill in your IP, a contact email on a domain that matches your reverse DNS, and a brief remediation note. Delisting is usually same-day. Barracuda is strict about reverse DNS — if your rDNS looks generic or doesn't match your sending domain, expect the request to be rejected.
SpamCop delisting
SpamCop is unusual: listings self-expire 24 hours after the last complaint report. There is no manual delisting. The right fix is to stop the behaviour that generated the complaints (usually a bad segment on your list or a compromised auth). If complaints stop, you drop off SpamCop automatically the next day.
Preventing re-listing
Delisting without root-cause fixing guarantees you will be back. The four actual causes:
- Compromised account — a hacked mailbox on your server is the #1 cause of a new SBL listing. Enforce MFA, rotate passwords, check outbound queues.
- Bad list — scraped or bought recipients trigger spam traps, which trigger complaints, which trigger SpamCop and Barracuda.
- Missing rDNS / SPF — many DNSBLs list IPs that send without correct authentication.
- Spam complaint rate — Gmail and Yahoo publish complaint data back through Postmaster feedback loops. Above 0.3% and you attract SBL attention.
Domain DNSBLs (DBL, SURBL, URIBL)
These list domains that appear in spam links, not IPs. If your tracking domain or click-through URL is in Spamhaus DBL, URIBL or SURBL, the impact is immediate: receivers see the link, flag the message as spam, even if the IP and From domain are clean.
Check domains the same way you check IPs — MultiRBL covers them. Delisting works via each project's lookup page. Fresh domains (<30 days) get surprise listings if they share a nameserver or ASN with known-bad neighbours, so buying expired-but-clean domains is not always safe.
Run Spamhaus, SORBS, Barracuda, SpamCop and UCEPROTECT-1. If all five are clean, you are not blacklisted in any way that affects deliverability — regardless of what MXToolbox shows in its long tail.