Get the order right
Most important point first: delisting without fixing the cause is wasted time. Most lists re-add an IP within hours if the behaviour is unchanged. With Spamhaus, repeated delisting without improvement leads to further requests being declined.
Step 1 — Find the cause
The most common triggers, in order of likelihood:
- Compromised mailbox. A stolen password is used to send spam through your authenticated server. Check the mail logs for unusual senders, recipient counts and sending times.
- Open relay or open form mailer. A contact form without sender validation is enough.
- Hacked website on the same server sending spam via PHP mail.
- Infected machine on the network behind the same outbound IP.
- Botched bulk send — stale address lists with high bounce rates or spam traps.
- Neighbourhood: UCEProtect levels 2 and 3 list you because of what others in the same netblock did. Only the hosting provider can help there.
The return codes of the respective list hint at the reason — the report shows them alongside every listing.
Step 2 — Stop the problem
- Reset affected passwords, enable multi-factor authentication
- Flush the outbound queue so no further spam goes out
- Set outbound rate limits per account
- Review relay configuration, secure form mailers
- Scan the website for malicious code, update CMS and plugins
- Configure SPF, DKIM and DMARC properly and set up FCrDNS
Step 3 — Request delisting
- Spamhaus — check the IP through the lookup form on spamhaus.org, where the removal link appears. SBL entries are reviewed manually; a short, factual description of the fix helps. PBL entries can be removed yourself if the IP is static.
- SpamCop — expires automatically, typically after 24 to 48 hours without new reports. A request is usually unnecessary.
- Barracuda — dedicated removal form at barracudacentral.org. Requires a valid contact address.
- UCEProtect — level 1 expires automatically after seven days without incident. Immediate delisting requires payment; this is contentious and generally unnecessary, since the list carries little weight with large providers.
- SORBS, PSBL, Blocklist.de and others — each has its own form on the list's website.
Step 4 — Prevent recurrence
- Monitor outbound volume and alert on outliers
- Watch the bounce rate — persistently high rates signal poor lists
- Set up feedback loops with the large providers to see complaints early
- Check regularly instead of waiting for complaints
What about a domain listing?
Domain blacklists such as Spamhaus DBL weigh heavier because a domain cannot be swapped. The cause is almost always a hacked website or an abused redirect. The procedure is the same: clean up first, then request delisting.
Checking
Send an email to hello@analyzemy.email. The report checks the sending IP against 25 DNSBLs, the domain against 6 domain blacklists and every link domain against 3 URI blacklists — each with return codes.