Domain Blacklisted

A blacklisting is rarely an emergency in the next ten minutes, and it is almost always worse the longer it sits. Read the first fix step before you file a removal request — requesting removal while the cause is still running is how a one-day listing becomes a one-month one.

Symptom

DownBad reports that your domain is listed on one or more DNSBL zones and names them. Mail to your customers starts bouncing with a 5xx that quotes the list by name, links you send get flagged in other people’s inboxes, and delivery to the large mailbox providers drops without an obvious pattern.

How the check works, and why it matters here

DownBad resolves your domain to its IPv4 addresses and queries each address against the selected DNSBL zones. The listing is against the IP address your domain points at, not against the text of the domain name. If you are on shared hosting, a neighbour’s spam is enough to list you, and nothing you change in your own configuration will clear it.

The default zone set is Spamhaus ZEN, SpamCop, Barracuda, CBL, and SORBS. You can add UCEPROTECT L1 and L2, PSBL, SpamRATS, and AnonMails on the monitor.

Likely causes

• A shared IP with a bad neighbour. Most likely if you are on budget shared hosting and nothing about your own setup changed.
• Your server sent mail it should not have. A contact form with no rate limit, a compromised CMS, or a mailer script dropped into the webroot.
• A bulk send to a stale or purchased list, generating complaints and spam-trap hits.
• Compromised SMTP credentials, or a mail server configured as an open relay.
• The IP’s history before you got it. Cloud IPs get recycled, and the reputation comes with them.
• A netblock listing. UCEPROTECT L2 and L3 list entire ranges because of what someone else in the range did. That is a listing about your provider, not about you, and most receivers weight it accordingly.

Fix steps

1. Read the incident. It names each zone that matched and the raw A records the zone returned. Those return codes are the diagnosis: for Spamhaus, 127.0.0.2 and 127.0.0.3 mean a spam source (SBL), 127.0.0.4 through 127.0.0.7 mean a compromised or exploited machine (XBL), and 127.0.0.10 or 127.0.0.11 mean the IP is in a range its owner says should not send mail directly (PBL). Check the zone’s own documentation for its codes.

2. Work out whose IP it is. If the listed address belongs to shared hosting, open a ticket with your host and stop here — you cannot delist an address you do not control.

3. Stop the source before requesting removal. Delisting while the cause is still running gets you relisted, usually faster and for longer. Look for a full outbound mail queue addressed to strangers, a form that sends mail on unauthenticated input, an unpatched CMS, and any SMTP credential you have not rotated.

4. Request removal at each zone’s own page, one at a time. Spamhaus, SpamCop, Barracuda, and SORBS all run self-service lookup and removal tools, and each wants a short, factual account of what happened and what you changed. Vague requests get declined.

5. Know which listings expire on their own. SpamCop listings clear within about 24 hours once the reports stop. Spamhaus XBL clears within a day or two after the machine is cleaned. Those need the cause fixed, not a form filled in.

6. PBL-type listings are not a reputation problem. They mean the address is in a range that should not be sending mail directly. The fix is to relay through your provider’s mail server, or to ask the range owner to remove the entry.

7. Re-check after the delisting confirms. DownBad caches DNSBL answers for five minutes, and receiving mail servers cache them for much longer, so allow several hours before you judge whether delivery has recovered.

Caution

Do not pay UCEPROTECT’s express-delisting fee. Paying to leave a list you were added to by netblock association is exactly why most receivers give their L2 and L3 zones little weight.

Prevention

• Send transactional mail through a reputable provider, on their addresses, not from your web server. Their IP reputation is their full-time job.
• Publish SPF, DKIM, and DMARC, and keep SPF listing only the senders you actually use. They do not prevent a listing on their own, but they make forgery in your name hard, and forgery is a common route to one.
• Rate-limit and captcha anything that sends mail on user input.
• Patch the CMS. Most “we were blacklisted for no reason” incidents are an unpatched plugin.
• Keep the monitor running. The check is cheap, defaults to daily, and finding a listing on day one is much cheaper than finding it on day thirty.
• If the alert is about an email address rather than a domain, see Email Domain Blacklisted.