In short
If your server IP is on a blocklist, emails bounce with messages naming the list (Spamhaus, Barracuda, SpamCop or Microsoft). The way out is always the same: identify the list and the reason, fix the cause (almost always a compromised account or a script sending spam), request removal through that list's form, and monitor so it doesn't happen again. Requesting removal without fixing the cause only gets you listed again.
How to tell if you're on a blocklist
- The bounces say so. Look in the error message for the list name or a URL, for example
blocked using zen.spamhaus.orgor a MicrosoftS3150code. - [check.spamhaus.org](https://check.spamhaus.org) checks every Spamhaus list for an IP or a domain.
- Multi-list lookups with tools such as MXToolbox Blacklist Check or MultiRBL.
- On the server, the Exim log shows the rejections:
grep -i "blocked\|listed\|blacklist" /var/log/exim_mainlog | tail.
If you query Spamhaus over DNS from a public resolver (8.8.8.8, 1.1.1.1), the answer is an error code, not a real listing. Use their website or your own resolver.
The main lists and what they mean
| List | What it means | How to get off |
|---|---|---|
| Spamhaus SBL | A verified spam source or a spam operation's network | Spamhaus form, explaining what was fixed |
| Spamhaus XBL (includes CBL) | An infected machine or open proxy sending spam or malware | Clean the server and request removal at check.spamhaus.org |
| Spamhaus PBL | A residential or dynamic IP that shouldn't send mail directly | If it's a real server, request exclusion; if not, send through a relay |
| Spamhaus CSS | Low reputation from poor-quality sending | Fix it and request removal; it often expires once the problem stops |
| Spamhaus DBL | The domain (not the IP) appears in spam or phishing | Clean the site or account and request delisting of the domain |
| Barracuda (BRBL) | Poor sending reputation | Removal form at barracudacentral.org |
| SpamCop | Recent user reports | Expires on its own about 24 hours after reports stop |
| UCEPROTECT | Level 1: the IP; levels 2 and 3: the provider's whole network | Level 1 expires on its own within days; levels 2 and 3 aren't up to you |
| Microsoft (Outlook.com and Microsoft 365) | Bounces with code S3150 or 5.7.1 | Microsoft's delisting form and an SNDS registration |
Gmail doesn't publish a blocklist: it decides based on the reputation you see in Postmaster Tools. If only Gmail rejects you, follow why are my emails going to spam.
First, fix the cause
A server IP gets listed because it sent spam or behaved like an infected machine. On a cPanel server, the usual causes are:
- A mail account with a stolen password. How to find and stop it: compromised email account.
- A website form or vulnerable plugin sending spam through PHP.
- Automatic forwarding of inbound spam to Gmail or Outlook.
- A missing or generic PTR that makes the IP look residential. See PTR, A and MX records.
Make sure the mail queue is back to normal (exim -bpc) and the log shows no odd sending for at least a few hours before requesting removal.
How to request removal
- Go to the list's website and look up your IP: it tells you why it's listed and since when.
- Fill in the removal form. Explain the cause and the fix in a sentence or two, for example: "Compromised mail account; password changed, outgoing mail suspended and server-wide hourly sending limit applied".
- Wait for the answer. Spamhaus usually resolves within a day or two if the problem is fixed; other lists expire on their own.
- Check the IP again and test sending to the domains that were bouncing.
Reputable lists don't charge for removal. If a list offers faster delisting for a fee, you can usually just wait for it to expire.
How to stay off
- Hourly sending and bounce limits per domain in WHM › Tweak Settings.
- cPHulk and mandatory strong passwords. See brute force against email.
- An alert when the mail queue suddenly grows.
- A regular check of the IP at check.spamhaus.org.
- Filtering inbound phishing, the most common way the passwords that later send spam get stolen.
Frequently asked questions
How long does it take to get an IP off Spamhaus?
If the problem is fixed, removal is usually processed within a day or two. If the IP sends spam again, the next listing lasts longer.
Why is my server IP on the Spamhaus PBL?
Because the provider marked that range as not meant for direct mail, or because the IP has no PTR of its own. If it's a real mail server with a proper PTR, you can request exclusion.
Do I have to pay to get off a blocklist?
Not on the major lists. Spamhaus, Barracuda, SpamCop and Microsoft don't charge. Some minor lists offer paid removal, but their listings expire on their own.
What happens if I request removal without fixing the problem?
You get listed again, sometimes within hours, and some lists take longer to accept a second request. Fix the cause first.
Protect inbound email on your whole server
Most listings start with a password stolen through phishing. Clisec blocks that phishing in inbound mail across your whole cPanel server.