Emails from your server suddenly bounce with messages like 554 5.7.1 Service unavailable; Client host [203.0.113.25] blocked using zen.spamhaus.org. Your server’s IP is on a DNS-based blocklist (DNSBL). Mail providers check these lists on every incoming connection. Here’s how to check your IP, understand why it was listed, fix the cause and get removed.
How blocklists work
A DNSBL publishes IP addresses associated with spam, malware or abuse. Receiving servers query it via DNS:
# reverse the IP octets and query the list (example IP 203.0.113.25)
dig +short 25.113.0.203.zen.spamhaus.org- No answer (NXDOMAIN): not listed.
- An answer like
127.0.0.2–127.0.0.11: listed. The return code indicates which sub-list.
Note: Spamhaus blocks queries via large public resolvers (Google, Cloudflare). Query through your own resolver, or use their lookup website.
Check your IP
- Spamhaus (most important): check.spamhaus.org.
- Multi-RBL checkers (MXToolbox Blacklist Check and similar) query dozens of lists at once.
- Microsoft SNDS and Google Postmaster Tools show reputation at Outlook and Gmail (domain-level for Gmail).
Not all lists matter equally. Spamhaus (SBL, XBL, CSS, PBL), Barracuda and SpamCop are widely used. Many small lists are ignored by major providers.
Why IPs get listed
| Cause | Typical list |
|---|---|
| Spam sent from the server (compromised mailbox, a hacked WordPress form, an open relay) | Spamhaus CSS / SBL, SpamCop, Barracuda |
| Malware or a botnet on the server (sending to many hosts) | Spamhaus XBL |
| Sending mail directly from an IP range meant for end users | Spamhaus PBL (“policy” list) |
| Previous user of the IP (recycled addresses) | Various |
| Hitting spam traps (old or invalid addresses in your mailing list) | Spamhaus, others |
| Poor DNS: no PTR, generic rDNS, missing SPF/DKIM | Contributes to listings and rejections |
Fix the cause first
Delisting without fixing the cause gets you relisted quickly, and some lists then make removal harder.
- Check the mail queue for spam:
mailq | tail -1 # queue size
mailq | head -50 # senders and recipients- Find the source: a compromised mailbox (look at SASL logins in the mail log), a PHP script or contact form sending spam (Postfix logs show the local user, and you can add
X-PHP-Originating-Scriptheaders via php.inimail.add_x_header = On), or malware.
grep 'sasl_username' /var/log/mail.log | awk '{print $NF}' | sort | uniq -c | sort -rn | head- Stop it: reset passwords, disable the account or script, delete spam from the queue (
postsuper -d ALL deferred, after saving evidence), and patch the hole. See detect a compromised server and WordPress malware removal. - Harden: SMTP auth only over TLS, rate limits per user, no open relay, Fail2Ban for SASL brute force. See SMTP security.
Request delisting
Each list has its own process. Most offer a removal form on their website (look up your IP there). Expect:
- Spamhaus: self-service removal for many listings once the issue is fixed. Explain what you fixed.
- Barracuda: a removal request form, with review.
- SpamCop: listings expire automatically (usually within 24 hours) once spam stops.
- Some lists expire automatically after a period without abuse.
Avoid lists that charge for “express delisting”. Major providers rarely use them.
If the listing comes from a previous user of a recently assigned IP, contact your provider’s support with the listing details.
Set up mail correctly from the start
- Reverse DNS (PTR) matching your mail hostname. See PTR records.
- SPF, DKIM and DMARC. See SPF, DKIM and DMARC.
- Warm up new IPs: start with low volumes to engaged recipients, and increase gradually over weeks.
- Clean lists: double opt-in, remove bounces, never buy lists.
- Separate traffic: transactional mail on one IP or service, marketing on another. Or use a reputable transactional email provider for bulk sending.
On VPS.DO, sending mail and setting rDNS are available on USA VPS plans, and all IPs are subject to the Acceptable Use Policy and zero-spam policy. See email VPS and email deliverability.
Not just email
IP reputation also affects:
- Web traffic: some firewalls and CDNs challenge IPs with bad reputation (relevant if your server makes outbound requests, as scrapers or APIs do).
- Abuse reports: providers act on complaints (spam, scanning, attacks) from your IP. Respond quickly, and fix the cause.
Quick reference
| Task | Command / place |
|---|---|
| Query a DNSBL | dig +short <reversed-ip>.zen.spamhaus.org |
| Multi-list check | MXToolbox Blacklist Check |
| Queue size | mailq | tail -1 |
| Top SASL senders | grep sasl_username /var/log/mail.log … |
| Delete deferred spam | postsuper -d ALL deferred |
| Removal | Each list’s website, after fixing the cause |
Related: MX records and brute-force protection.