Domain reputation instead of IP reputation
IP blacklists target the sending server. Domain blacklists target the domain itself — and that is the considerably more unpleasant case. An IP can be swapped, a domain usually cannot. A listing on Spamhaus DBL follows you to every new server.
Domain blacklists are also why abandoning a burned IP often does not help: if the domain advertised in the messages or used as the sender is listed, the filters apply regardless of where you send from.
Which lists are queried
- Spamhaus DBL — the authoritative domain blacklist, very widely deployed
- URIBL (multi) and URIBL Black
- SURBL (multi)
- ScrolloutF1 reputation domain RBL
- NordSpam DBL
Queries run in parallel; the answer code is shown for every listing.
How domains end up on these lists
- Compromised mailbox: spam is sent with your domain as the sender through a breached account.
- Hacked website: a phishing page or malware is hosted on the domain — frequently after an unpatched CMS installation.
- Redirects to bad destinations: a URL shortener or redirect on your own domain points at listed content.
- Domain history: buying a used domain means inheriting the previous owner's baggage.
- Collateral damage: a freemail or shared hosting provider gets listed wholesale.
How to handle a listing
The underlying content problem has to go first, otherwise you are re-listed immediately:
- Scan the website for malicious code and foreign files, update CMS and plugins, reset credentials.
- Check every mailbox for unusual outbound activity, change affected passwords, enable MFA.
- Close open redirects and URL shorteners on your own domain.
- Only then use the respective list's delisting form. Spamhaus reviews manually and declines while the problem persists.
Some lists carry freshly registered domains as a precaution, because spam campaigns typically use new domains. Those entries expire on their own after a few days — a good reason not to put a new domain straight into bulk sending, but to ramp volume up gradually.