Your sending IP is on a blacklist. Here is the order to fix it in

Finding out you are on a blocklist is the easy part — dozens of tools will tell you that. What almost none of them tell you is which lists matter, why you were listed, and what to do first. Get the order wrong and you will be delisted on Tuesday and relisted on Thursday.

First: does this list matter?

There are hundreds of DNSBLs. They are not equivalent.

• Widely consulted. Spamhaus ZEN is the one that matters most; being on it materially affects delivery to a large share of the internet. A handful of others (SpamCop, Barracuda, and a few provider-internal lists) carry real weight.
• Narrowly consulted. Many lists are used by a small number of servers, or by nobody. Being on one is worth understanding and rarely worth panicking about.
• Effectively defunct. Some lists have shut down in a way that answers "listed" for every IP on earth. A checker that queries them will report you listed on lists that no longer exist. We only query lists we have verified are live, for exactly this reason.

So the first question is not "am I listed" but "am I listed *where*". Our report names every list individually with its return code and response time, and marks a list that refused or timed out as unknown rather than counting it as a pass — an unverifiable list is not the same as a clean one.

Second: read the return code

DNSBLs answer with an address in 127.0.0.x, and the last octet is a reason code. It is the most useful piece of information in the whole process and the piece most tools discard.

Depending on the list, the code distinguishes between things like: this IP is a known spam source, this IP is in a range the ISP says should never send mail directly, this IP appears to be a compromised host or an open proxy, this IP sent mail to a spam trap.

Those are four completely different problems with four different fixes. "Dynamic IP range" means you should be relaying through your provider's smarthost, not requesting delisting. "Compromised host" means you have a security incident, and delisting is the last step, not the first. Our report decodes the code for each list that returns one.

Third: fix the cause

Before touching a removal form, find out what happened. In rough order of likelihood:

• A compromised account or host. A single credential-stuffed mailbox can send thousands of messages. Check your outbound queue and your submission logs for volume you did not send.
• An open relay or a misconfigured application. A form that emails arbitrary addresses, a badly-configured relay, a forwarder that has become a spam vector.
• A shared IP with someone else's problem. On shared hosting your reputation is partly other people's work. If this keeps happening, the fix is a different IP, not a better relationship with the blocklist.
• A bad list. A purchased list, an old list, or a list imported from an acquisition will hit spam traps. Spam traps are how most lists find senders.
• A sudden volume spike. A new IP that sends a thousand messages on day one looks exactly like a compromised host. Warm up gradually.

Most lists will simply re-add an IP that is still doing the thing that got it listed. Fixing the cause is not the polite thing to do first; it is the only thing that works.

Fourth: request delisting

How this goes depends entirely on the list:

• Self-service. Fill in a form, the listing clears within minutes to hours. Most of the major lists work this way for a first listing.
• Automatic expiry. Some listings simply age out after a fixed period with no traffic. Requesting removal does nothing; stopping the traffic does.
• Manual review. A human reads your request. Say what happened, what you fixed, and what stops it recurring. A one-line "please remove" gets deprioritised, and repeat requests without a change get ignored.

When our report finds your IP listed, it tells you which of these applies for that list and links you straight to its removal form with the IP already filled in. What it will not do is promise delisting — that decision belongs to the list operator, always.

Fifth: stop it recurring

• Monitor. Being told by a customer is the worst way to find out.
• Authenticate everything (SPF, DKIM and DMARC) so your legitimate mail is distinguishable from mail that merely claims to be yours.
• Separate your streams. Transactional mail and marketing mail on the same IP means a bad campaign takes your password resets down with it.
• Keep the list clean. Remove hard bounces immediately and stop mailing addresses that have not engaged in a year — that is where spam traps live.

Check where you stand

Send one message to a test address and the report queries 35 public DNSBLs against your actual sending IP, names each one with its result, and gives you the return code, the reason, and the removal link where you are listed.