What is an email blacklist?

An email blacklist — the term of art in 2026 is "blocklist" — is a published database of IP addresses, domains, or URLs that a maintaining organisation has identified as sources of spam, phishing, malware, or other abuse. Receiving mail servers consult one or more of these blocklists during the SMTP transaction and use the result to reject, quarantine, or score incoming mail. Understanding which blocklists matter, how listings happen, and how to get delisted is core knowledge for anyone running a mail domain.

How blocklists actually work

Blocklists are distributed as DNS zones (DNSBL, DNS-based blocklist). When a mail server receives a connection from IP 1.2.3.4, it reverses the IP to 4.3.2.1 and queries a TXT and A record at 4.3.2.1.zen.spamhaus.org. If the record exists, the IP is listed, and the returned code indicates which sub-list it's on. The lookup takes a few milliseconds and happens on every inbound SMTP connection at providers that use DNSBLs.

There are three categories of blocklist:

1. IP blocklists — list sending IP addresses. Used during SMTP connection.
2. Domain blocklists (DBL, URIBL, SURBL) — list domains that appear in message bodies. Used during content filtering.
3. Hash blocklists (HBL) — list hashes of known spam content. Less common.

The blocklists that matter in 2026

Most public blocklists are noise. Only a handful are actually queried by meaningful volumes of mail. If you are listed on one of these, real mail is being blocked:

Spamhaus ZEN — by far the most important. ZEN aggregates SBL (verified spam sources), CSS (snowshoe spam), XBL (exploited hosts), and PBL (policy-based listings for dynamic IPs). A listing on SBL or CSS is serious; an XBL listing usually means malware; a PBL listing is often just "this IP is in a residential ISP range".

Spamhaus DBL — domain blocklist. If a URL in your message body is on DBL, Gmail, Microsoft and most commercial filters reject the message.

SURBL — aggregate of multi-source URI blocklists. Widely consulted.

URIBL — similar scope to SURBL. Used by many commercial filters.

Barracuda BRBL / Reputation Block List — queried by Barracuda appliances, which sit in front of a large slice of enterprise inboxes.

Invaluement ivmSIP — commercial but highly accurate list, used by many large MTAs.

Lists that used to matter but no longer do: SORBS (unreliable since 2023), UCEPROTECT (aggressive false positives), CBL (folded into Spamhaus XBL).

Why a domain or IP gets listed

Common listing reasons, in rough order of frequency:

1. A compromised account on your server sends spam.
2. A web form on your site is abused to send outbound mail without rate limiting.
3. A customer on shared hosting sends spam from their application.
4. Your mail server is misconfigured as an open relay.
5. Your domain is used by a spammer as a forged From: (this causes domain-level listings even though you did nothing wrong).
6. Your IP falls into a range previously used by a known spammer and inherits its listing.
7. You send mail to a spamtrap address (an email address specifically seeded in lists to catch spammers).

Spamtraps are the silent killer. A single hit on a pristine spamtrap (an address that has never been valid) can get you listed on Spamhaus SBL instantly. Pristine spamtraps usually end up in purchased or scraped lists, which is why buying email lists is the fastest path to a Spamhaus listing.

How to check if you are listed

Run a scan on IntoDNS.ai with your sending IP and domain. It checks the four blocklists that matter (Spamhaus ZEN, Spamhaus DBL, SURBL, URIBL) and returns the listing category and delist URL for each hit. You can also check each list's own lookup page directly.

For bulk monitoring, most MTAs can be configured to log blocklist status on every outbound SMTP session, giving you near-real-time alerts when a recipient blocks your mail due to a listing.

How to get delisted

Spamhaus has the most professional process. Visit the Spamhaus Blocklist Removal Center, enter your IP, and you will see the exact listing reason and evidence (redacted message sample, spamtrap hit, etc.). Most SBL listings require you to explain what caused the listing and what you have done to prevent recurrence. First-time listings for small volumes are usually delisted within a few hours. Repeat offenders wait longer.

SURBL and URIBL delisting is generally automatic once the flagged content is removed from the domain's web presence and at least a few days have passed without new complaints.

Barracuda delisting requires a form submission. Response time is usually 1-3 business days.

Common delisting mistakes:

• Requesting delisting before fixing the underlying cause. You will be re-listed within hours.
• Filing multiple delist requests simultaneously. This extends the wait time on several lists.
• Assuming "but I did not send spam" will get you delisted. Provide evidence of the fix.

Prevention

The cheapest blocklist listing is the one that never happens. Standard prevention:

• Authenticate outbound mail (SPF, DKIM, DMARC).
• Rate-limit every web form that triggers email.
• Log every outbound message with authenticated-user attribution.
• Monitor bounce rates and complaint rates; pause campaigns above 0.3% complaints.
• Never purchase or scrape email lists.
• Use double opt-in for all new subscribers.
• Remove hard bounces within one send cycle.
• Prune subscribers with zero engagement for 180 days.
• Monitor Spamhaus, SURBL and URIBL daily via IntoDNS.ai or similar.

Reputation vs blocklists

Blocklists are binary: listed or not listed. Reputation is continuous: a score from 0 to 100 based on dozens of signals. Gmail, Microsoft and Yahoo increasingly rely on reputation over blocklists, which is why a domain can be unlisted on every public blocklist and still land in spam.

If blocklists are clean and mail still lands in spam, the problem is reputation. Fix with Google Postmaster Tools monitoring, Microsoft SNDS, engagement-based pruning, and steady sending volume (no sudden spikes).

When to use IntoDNS.ai

IntoDNS.ai runs every scan against Spamhaus ZEN, Spamhaus DBL, SURBL and URIBL by default. A listing is flagged at the top of the report with the delist URL included. For ongoing monitoring, run a daily scan and alert on any new listing before receivers start bouncing your mail.

Types of listings explained

Not all listings mean the same thing. Spamhaus ZEN alone encapsulates four sub-lists with very different implications:

SBL (Spamhaus Block List) — manually reviewed, high-confidence spam source. An SBL listing means a human at Spamhaus reviewed evidence and concluded the IP is spamming. Getting delisted requires responding to the specific evidence Spamhaus presents. Takes hours to days.

CSS (Composite Snowshoe Spamlist) — automated, based on patterns consistent with snowshoe spam (low volume from many IPs to avoid traditional filtering). False positives are relatively rare but do happen. Delist through the Spamhaus removal form.

XBL (Exploits Block List) — the IP is showing signs of malware, open proxy, or other exploit activity. Fix the underlying compromise and XBL typically auto-delists within 24 hours.

PBL (Policy Block List) — the IP is in a range the ISP has declared should not send mail directly (typically residential IPs, mobile networks, VPS pools used for spam). Not a listing for any misbehaviour, but it still blocks mail. The fix is to send through an authenticated relay rather than direct-to-MX.

Understanding which sublist you are on determines the fix. An XBL listing is a compromise to clean up. A PBL listing is an architectural choice to route via a proper SMTP relay. An SBL listing is a genuine reputation problem.

Domain listings versus IP listings

Domain blocklists (DBL, URIBL, SURBL) flag the domain itself, typically because domains in message bodies are flagged as malicious or promoting spam. Domain listings are harder to recover from because they persist across IP changes and hosting providers. If your domain lands on DBL, every mail from every IP linking to your domain is flagged, not just the IP that sent it. Domain reputation is an increasingly important attack surface in 2026 precisely because it is sticky and hard to rebuild.