Blocklists – when your mail server is refused at the door

Blocklists refuse mail from addresses that have sent spam. Here is how the check queries six of them, what gets a server listed, and how delisting works.

A blocklist is a shared bad-address book. Operators collect the addresses that spam has recently come from and publish them so that any mail server can ask, in a fraction of a second, whether the machine currently connecting is on the list. Most large providers ask several lists before they accept a message.

Being listed is not a warning letter. Depending on the recipient, your message is rejected at the door or filed straight into spam, and very often nobody tells you. The first sign is usually a customer saying they never received a reply.

How this check asks

We take the addresses your mail servers resolve to, plus any single address named directly in your SPF record, and ask six lists about each of them. The question is a DNS query, which is why the answer arrives in milliseconds.

Two well-known lists are deliberately absent. Spamhaus does not answer queries from data centre addresses without an access key, and would reply to us with a "query refused" code – recording that as "clean" would be a false statement, and as a hit even worse. UCEPROTECT lists whole address ranges because of one neighbour and asks for payment to remove an entry, so a hit there says nothing about your domain.

How a server ends up on a list

Almost never through malice. The four common causes, in the order we see them:

1. A compromised mailbox. Somebody's password ends up in a data leak, an attacker signs in and sends a few thousand messages through your provider before anyone notices.
2. A compromised website. An outdated contact form or plugin is used as a mail relay. The mail leaves your web server, which is often not the machine you think of as your mail server.
3. A neighbour. On shared hosting, many domains share one sending address. Someone else's mistake becomes your listing.
4. A bad list. An address list bought or scraped, or a newsletter sent to addresses that have not been touched in years, produces complaints and trap hits very quickly.

What to do about a listing

1. Find the cause first. Delisting without fixing anything gets you listed again within days, and repeat listings are harder to clear.
2. Check the outgoing queue on your server, or the sent volume in your provider's admin console. A spike is the signature of a compromised mailbox.
3. Reset passwords for every mailbox on the domain, and switch on two-factor authentication where the provider offers it.
4. Update the website – core, plugins, contact forms – and check that no form can send to an address supplied by the visitor.
5. Request delisting on the operator's site. The finding names the list; each has a form, and most take a few minutes. SpamCop, GBUdb and PSBL entries often expire on their own once the sending stops.
6. Watch for a few days. Run this check again after 24 hours, and again after a week.

If the mailboxes are hosted – Microsoft 365, Google Workspace, GoDaddy, Namecheap, Bluehost, Rackspace, Fasthosts or 123-reg – the listed address usually belongs to the provider, not to you. Then the job is a support ticket with the exact address and the list name, and a check of your own accounts for a break-in. Providers act quickly on this, because the address serves many of their customers.

For a service you send campaigns through – Mailchimp, SendGrid, Mailgun, Postmark or Brevo – the same applies: their sending addresses are theirs to clear. What is yours is the list quality that caused the complaints.

The findings in detail

Mail server on a blocklist

At least one of the addresses we checked is currently listed. The finding names the address and the list.

Mail from that address is being rejected or filed as spam right now, at every recipient that consults this list – and the sender usually receives no notice. If the address belongs to your own mail server, the effect covers your entire company's mail. If it belongs to a shared platform, only some of your mail is affected, which makes the problem harder to recognise from the inside.

What to do: work through the six steps above, in that order. Cause first, delisting second. If the address is not yours – a hosted mail platform or a sending service – open a ticket with the provider and quote the address and the list, then check your own accounts for a compromised mailbox in parallel. Afterwards, look at whether DMARC reports would have shown you the unusual sending earlier; on most domains they would have.

Frequently asked questions

How long does a listing last?

It depends on the list. Complaint-driven ones such as SpamCop expire within a day or two once the sending stops. Others hold an entry until you request removal. None of them is permanent, but repeated listings extend the wait.

Can I be listed without having done anything wrong?

Yes – shared hosting, a shared sending address at a provider, or an address range listed because of a neighbour. That is annoying and usually fixable through the provider. It is also a reason to look at whether your mail really should leave from an address you share with strangers.

Does a clean result mean my mail reaches the inbox?

No. Blocklists are one filter among many. Authentication, content, sending history and the recipient's own reputation data all count as well. A clean result removes one obstacle, not all of them.

Why is Spamhaus not checked?

Because Spamhaus does not answer queries from data centre addresses without a paid access key. Any answer we received would be the "query refused" code, and presenting that as a result either way would be misleading. The other six lists answer normally.