Listed on Spamhaus? How to Check, Get Delisted, and Stay Off

The bounce says your mail was "blocked using dbl.spamhaus.org," and your campaign is suddenly going nowhere.

If Spamhaus lists your domain, pause sending from it, confirm the listing on Spamhaus's own checker at check.spamhaus.org, fix the cause, then file the free removal request there. In cold email the cause is usually a list that hit spam traps. Once Spamhaus approves the request, the removal goes live within minutes.

So removal is the fast part. The fix is slow, and Spamhaus says domains "may re-list automatically after removal if they are re-detected." Delisting is a form. Staying delisted is a list.

Two things most guides skip. First, your quick check might be wrong. On October 8, 2026, we ran 180 lookups through 12 public DNS services, and only 95, barely half, came back right. Second, Spamhaus's Domain Blocklist reads the links inside your email, so the website you link to can get listed along with the domain you send from.

Is my domain actually on a Spamhaus blocklist?

Start with the bounce. Spamhaus doesn't block mail itself. It publishes lists, and receiving mail servers choose to check them, so the bounce usually names the list:

• zen.spamhaus.org is an IP address list. ZEN bundles four Spamhaus lists (SBL, CSS, XBL and PBL) into one lookup. The problem is the server your mail left from.
• dbl.spamhaus.org is the Domain Blocklist. The problem is a domain somewhere in your message.

Then confirm it at check.spamhaus.org, Spamhaus's IP and Domain Reputation Checker. Spamhaus's DBL page calls the checker "the only place where DBL removals are handled" (checked October 2026). Look up every domain your emails touch: the sending domain, the click-tracking domain, anything you link to, and your main website.

Can I trust a quick DNS blocklist lookup?

Not always. A blocklist lookup is a DNS query, the same kind your laptop makes to turn a web address into a server address. Spamhaus refuses queries that come through big public DNS services, and its own FAQ names them as the most common reason blocklist answers go wrong. We tested how often.

We asked 12 public DNS services, in five rounds, about three names. Two were test entries Spamhaus keeps listed on purpose. The third was example.com, which is clean. A working service says "listed" for the first two and "not listed" for the third.

Source: Ken test, October 8, 2026, 18:37-18:46 UTC, from a Leaseweb server in Frankfurt, Germany. n = 180 lookups (12 public resolvers x 3 names x 5 rounds), plus our server's own resolver as a control. Results can differ by location and time.

Only OpenDNS, Control D, Comodo and Hurricane Electric got all 15 answers right. Google Public DNS and Level3 said "not listed" for both test entries in every round. Cloudflare and CleanBrowsing answered everything with the refusal code 127.255.255.254, even example.com. The other four changed their answers from round to round. Our own server's resolver, the control, got 15 of 15.

The wrong answers go both ways:

• False all-clear. 30 of the 120 lookups for listed entries came back "not listed." That's 1 in 4.
• False alarm. 19 of the 60 lookups for clean example.com returned a 127.255.255.x code. A script that reads any answer starting with 127 as "listed" would flag a clean domain.

Spamhaus's DNSBL usage FAQ explains both (checked October 2026). It says Google Public DNS answers "not listed" in most cases, and that the 127.255.255.x codes are errors that "must not be taken to imply" a listing. The same FAQ warns that "some mail servers mistakenly reject all mail" over that code. So if one receiver bounces you citing Spamhaus but the checker says you're clean, suspect their setup first.

What's the difference between SBL, DBL, XBL and CSS?

Each Spamhaus list answers a different question:

• The SBL, or Spamhaus Blocklist, lists IP addresses that Spamhaus's investigators tied to spam or other abuse.
• The CSS, or Combined Spam Sources, lists IP addresses an automated system caught sending low-reputation mail.
• The XBL, or Exploits Blocklist, lists IP addresses of hacked or infected machines.
• The DBL, or Domain Blocklist, lists domains with a bad reputation. Receivers check it against your sender details and every link in your email.
• The ZRD, or Zero Reputation Domain list, holds newly registered domains for their first 24 hours.
• The PBL, or Policy Blocklist, lists IP ranges like home internet connections that shouldn't send mail directly. Being on it isn't a penalty.

On Google Workspace or Microsoft 365, the sending IPs are Google's or Microsoft's, so an IP listing is theirs to fix. Your part is the domain, which means the DBL.

Which list am I on, and how long until it clears?

Each list runs on its own clock. Everything below comes from Spamhaus's own pages, checked October 2026.

Vendor guides quote delisting times from "a few minutes" at GlockApps to "a few hours to a couple of days" at Warmy. Both describe the removal. Neither counts the cleanup, and the cleanup is what takes time.

What should I do in the first hour?

1. Pause the domain. Every email you send while listed is more evidence against you.
2. Check everything on check.spamhaus.org. Sending, tracking and link domains, plus your website. Note the list and the return code.
3. Match it to the table. A DBL listing on your domain is yours. An IP listing on Google's, Microsoft's or your platform's servers goes to their support.
4. Find the cause before you file. Which list went out just before the bounces started, and where did it come from? A spike in hard bounces is often the giveaway, as our cold email bounce rate guide explains.
5. Fix it for real. Delete the bad segment, suppress every bounce and complaint, and drop that data source.
6. File one short, honest request through the checker, as the domain owner. Say what happened and what you changed. Don't argue that cold email is legal. Spamhaus says it doesn't evaluate legality, only whether mail was unsolicited and bulk. Requests by email go nowhere, and "excessive removers" may be blocked.
7. Restart slowly. Come back at a fraction of your old volume and watch bounces and replies for a week before you scale.

Why did my domain get listed? In cold email, it's usually the list

A spam trap is an address no person ever signed up with. The Spamhaus glossary defines traps as addresses "which have not opted into any email." Spamhaus's 2022 spamtraps post lists several kinds. Seeded traps are planted around the web to catch scrapers. Dead address traps are old accounts that providers switched off, then turned back on. Dead domain traps are expired domains that trap owners buy to collect whatever mail still arrives.

That last kind is why old B2B lists are dangerous. The US Bureau of Labor Statistics found that only 34.7% of business establishments that opened in March 2013 were still operating in March 2023. When a company dies, its domain can lapse, and trap owners buy expired domains. An address that bounced last year can be a spam trap this year.

Spamhaus is blunt about cold email. Its June 2025 post, "Spamhaus' take on Cold Emailing...AKA spam", says cold email becomes spam when it's "automated, scaled, and sent in bulk," and that bulk cold outreach hitting its spamtraps is a candidate for listing. The same post accepts one-to-one messages to carefully selected people with a real business reason. I don't think every cold email is spam. But that's the side of the line I'd want to be on anyway, and it's the line Spamhaus judges you by.

Verification helps less than people think. It checks that a mailbox exists, and Spamhaus wrote in a 2015 post that it "does nothing to verify the permission of the recipient." Its glossary adds that Spamhaus "frequently sees mail in its spamtraps" from lists sold as verified. Verify every address to stop bounces, but where the list came from matters more.

Can my main website get listed if I send from other domains?

Yes. Separate sending domains keep cold email off your main domain's sender reputation, but they can't hide your main domain when it appears inside the email.

Spamhaus's DBL page tells receivers to check "domains appearing in the mail headers and body e.g., URLs or contact email addresses," and a listing covers every subdomain. So if your campaigns trip Spamhaus's criteria, the domain they keep linking to is exposed. Spamhaus doesn't publish the exact criteria, so nobody can tell you the threshold.

That's the expensive kind of listing. Receivers that scan links can then block any mail that mentions your domain, invoices included.

Here's what I'd do. Keep links out of the first email. Use a tracking domain that isn't your main domain. Skip public link shorteners, since Spamhaus has a return code just for abused redirectors. And whenever a sending domain gets listed, check your website domain too.

How do I keep it from happening again?

Fix the list first. Then look at the domains. Spamhaus's DBL FAQ says "unknown reputations begin as 'poor' by default" and "domains which act like they are snowshoeing will get treated like snowshoers." Snowshoeing means spreading spam across many domains and IPs so no single one looks bad. A lazy cold email setup, with dozens of fresh, cheap domains each sending a little, looks a lot like that from outside.

Your domain extension also puts you in a neighborhood. Spamhaus's half-year Domain Reputation Updates report how many domains it listed in each top-level domain (TLD, the part after the dot) and how big each TLD is. Divide one by the other to see how rough each neighborhood is.

Source: Spamhaus Domain Reputation Updates, four six-month reports, Apr 2024-Mar 2026. n = 17 TLDs, 58 TLD-report points. Each dot is listed domains divided by zone size, the way Spamhaus computes "% of zone listed." Latest report: 506,482 of 168.0M .com domains listed vs 93,940 of 535,716 .cfd domains.

From October 2025 to March 2026, Spamhaus flagged 2.15 million malicious or suspicious domains, about 358,000 a month. That was 0.30% of .com, 2.4% of .top, 9.7% of .icu and 17.5% of .cfd, so a .cfd domain was about 58 times as likely to be listed as a .com. Spamhaus calls 5% listed "a red flag" and anything above 10% "clearly indicative of a problematic TLD."

The pattern holds in all four reports. Across them, .com, .net and .org never went above 0.5%, while .top, .vip, .icu, .sbs and .bond never dropped below 1.8%. From April to September 2025, 54% of all .bond domains were listed. Spamhaus ties this to price. Its October 2024 to March 2025 report says "the vast majority of newly registered malicious domains exist at the lower-priced tiers."

A TLD won't get you listed on its own. But a fresh domain where 1 in 10 neighbors is a known bad actor gets little benefit of the doubt.

Here's what I'd do in your seat:

• Source fresh, targeted data. Know where every address came from, and skip bought lists and old exports. Spamhaus says role addresses like postmaster@ and abuse@ "should almost NEVER be on a marketing mailing list."
• Suppress forever. Once an address bounces, complains, opts out or shows up in a trap notice, never mail it again. Our anti-spam policy applies suppression across every domain and mailbox we run, and it never expires.
• Use boring, aged domains. Pick .com or another clean extension, use names that clearly belong to your brand, and never send on day one. We warm new domains for 2 to 4 weeks first, and our warmup guide explains why.
• Go slow and keep checking. Keep volume per domain low and steady, and look up every domain on check.spamhaus.org each week.

Ken runs cold email and LinkedIn outreach for B2B companies, done for you, on infrastructure we own. We send from our own mail servers on dedicated US and EU IPs, your main domain never sends, and a person approves every campaign before the first email. The rest of the setup is in our cold email deliverability guide.

Frequently asked questions

Does Spamhaus charge to remove a listing?

No. Spamhaus says there is "never any charge or fee" for removing any listing. Anyone who offers to get you delisted for money is running a scam.

Should I just switch to a new domain?

Not until you've fixed the list. A new domain starts with an unknown reputation, which Spamhaus treats as poor, and sits on the ZRD for 24 hours. If the list was the problem, the new domain will hit the same traps.

Do SPF, DKIM and DMARC protect me from a DBL listing?

No. Spamhaus says DBL listings "occur for domains with and without those records." Authentication proves who sent an email, not that anyone wanted it.

Which DNS service should I use to check Spamhaus myself?

Use check.spamhaus.org. For your own scripts, Spamhaus recommends running your own DNS resolver. In our test, Google Public DNS never reported a listing at all.

What if I'm still blocked after the removal?

If the checker still shows the listing 24 hours after approval, contact Spamhaus. If the checker is clean but one or two networks still block you, Spamhaus's general FAQ says "the issue lies with the network being sent to," so contact them.

Will Spamhaus tell me which address was the spam trap?

No. Trap owners never reveal them. Spamhaus says senders who do find a trap usually just suppress that one address and never fix the data problem that put it there.

The short version

Check on Spamhaus's own checker, not a random lookup. Pause, find the list that caused it, fix it and file one honest request. The removal takes minutes, and the list behind it decides whether you stay off. If you'd rather start with a campaign built on fresh, verified data and owned infrastructure, your first campaign is free.