All guides · Security

Email Blocklists: Why an IP Gets Listed and How to Clear It

A DNS blocklist (DNSBL) is a list of IP addresses that have recently sent spam, run open proxies or shown other signs of abuse. Mail servers query these lists for every incoming connection, and many reject or junk mail from listed addresses. The lists are published over DNS, so anyone can look up an address without contacting the server behind it.

Why it matters

• A listed mail server has its messages refused or sent to spam by every receiver that uses that list. Invoices, password resets and replies to customers stop arriving.
• A listed web server usually doesn’t affect visitors directly, but it is a warning sign: the server, or another site on it, may be compromised and sending spam or attack traffic.

Common causes

• A hacked website or CMS plugin used to send spam through the server’s mail function.
• A compromised mailbox password, used to send spam through your provider.
• An open relay or open proxy left on the server.
• Malware on a device in your office sharing one public IP address.
• Shared hosting neighbours. On shared hosting, hundreds of sites can sit on one IP address. If one of them sends spam, the whole address is listed, including your site. Only the host can fix this, by cleaning up the other account or moving you to another address.

How to get delisted

1. Find the cause first. Look at the server’s outgoing mail logs and queue, scan the site for malware, update the CMS and plugins, and change passwords. Requesting removal before the cause is fixed usually leads to a quick relisting.
2. Read the listing. Each list’s lookup page explains why and when the address was listed.
3. Follow that list’s removal process. They differ:

• SpamCop listings are driven by recent spam reports and expire automatically once the reports stop; the lookup page shows the current state.
• PSBL lists addresses that send mail to its spam traps and lets you remove an address yourself from its website.
• UCEPROTECT level 1 lists single addresses that sent mail to its traps. Its website explains its expiry rules and removal options.
• DroneBL lists addresses of open proxies, compromised hosts and botnet machines. Removal requests are made through its website.

If you use a mail provider (Google Workspace, Microsoft 365, a newsletter service), its servers are its responsibility. Report the listing to the provider’s support; you can’t delist their addresses yourself.

On shared hosting with cPanel or Plesk, send the listing to your host. Ask whether your account was the source, and if not, whether they can move your site or your outgoing mail to a clean IP.

Keeping off the lists

• Send outgoing mail through an authenticated mail provider rather than the web server’s own mail function, and set up SPF, DKIM and DMARC.
• Keep the CMS, plugins and server software updated.
• Rate-limit contact forms and protect them against bots.

How PerfoMetrix checks this

We look up addresses with ordinary DNS queries through public resolvers. We never connect to your web or mail servers.

• Lists: SpamCop, PSBL, UCEPROTECT level 1 and DroneBL.
• Web server: the IPv4 addresses of the scanned host (up to four).
• Mail servers: the first IPv4 address of each of the first three MX hosts, by priority.

A list may refuse queries that arrive through large public resolvers; it answers with a special error code, which we don’t count as a listing. If no list answers, the check is shown as “couldn’t test”. IPv6 addresses aren’t checked.

We don’t query Spamhaus. Its free public mirrors are for low-volume, non-commercial use, and a scanning service doesn’t qualify. Many receivers do use Spamhaus, so check your address on spamhaus.org as well.

Last updated October 28, 2026