Spamhaus: what it is, how its blocklists work, and how to stay off them

Spamhaus is a nonprofit organization founded in London in 1998. It tracks spam sources and provides blocklist data that mail servers query in real time to decide whether to accept, reject, or flag incoming messages. By various estimates, Spamhaus DNSBL data covers over 3 billion mailboxes worldwide. If your sending IP or domain appears in a Spamhaus list, a significant portion of your email stops reaching recipients.

The blocklists

Spamhaus maintains several databases, each targeting a different type of threat. Mail servers check the sender's IP against these databases via DNS queries (DNSBL). A positive result means the IP is listed, and the receiving server can act on that information.

• SBL (Spamhaus Block List) — the primary blocklist. Contains IPs confirmed to be sending spam. Listings come from spam trap hits, user complaints, and Spamhaus investigations. SBL covers individual IPs and entire subnets when a hosting provider fails to act against abusers.
• XBL (Exploits Block List) — IPs compromised by malware: botnets, open proxies, infected servers sending spam without the owner's knowledge. Data comes from the CBL (Composite Blocking List) project.
• PBL (Policy Block List) — IP ranges that should not be sending email directly. Mostly dynamic residential IPs and corporate ranges not designated for mail servers. A PBL listing does not mean spam was sent from that IP; it means the IP should route mail through its provider's relay.
• DBL (Domain Block List) — a domain-level list. Unlike SBL, which works with IPs, DBL checks domain names in message headers and body URLs. If a domain in your From: address or a link in your email is listed in DBL, delivery is affected.

How IPs end up listed

• Spam traps. Spamhaus runs its own trap network. One hit on a pristine trap — an address that never belonged to a real person — can result in an immediate SBL listing.
• Complaint volume. When recipients click "This is spam," that data aggregates. A steady stream of complaints from a single IP draws Spamhaus analyst attention.
• Compromised servers. A hacked VPS, a vulnerable CMS plugin, a compromised SMTP account — any of these can land an IP in XBL.
• Bad neighbors. On shared hosting, one spammer can damage the reputation of an entire IP pool. Spamhaus may list a whole subnet if the provider does not respond to abuse reports.

How to check your status

The Spamhaus Lookup tool on their website lets you query any IP or domain across all lists. Many monitoring services — MXToolbox, Talos Intelligence, multirbl.valli.org — also include Spamhaus in their checks.

Programmatically, you can issue a DNS query against reversed-ip.zen.spamhaus.org. A response means the IP is listed. Different return codes indicate which specific list (SBL, XBL, PBL) contains the entry.

Getting delisted

The process depends on which list you are on. For SBL, you need to fix the root cause first — stop the spam, close the vulnerability, scrub spam traps from your list — then submit a delisting request through the Spamhaus website. Review is manual and takes anywhere from a few hours to a few days.

XBL listings drop automatically once the IP stops showing malicious activity. PBL lets the IP range owner self-remove, provided they have set up proper outbound mail routing through an authorized relay.

Impact on deliverability

An SBL listing is one of the harder deliverability problems to recover from. Bounce rates spike, and mail that does get through often lands in spam folders. Gmail, Yahoo, Outlook, and most large providers query Spamhaus in real time, so the effect is immediate and widespread. Monitoring your listing status is not optional once you are sending more than a few hundred messages per day.

Prevention is straightforward: keep your list clean, avoid purchased lists, validate addresses before sending, and use double opt-in. None of this is complicated, but it is easy to skip until it becomes a problem.