Email Domain Blacklisted

Email reputation takes days to lose and weeks to rebuild, so the order of operations matters more here than the speed. Find the source, stop it, and only then ask to be delisted — a removal request granted while the cause is still running buys you a relisting with a longer memory.

Symptom

DownBad reports that the domain part of your monitored email address is listed on one or more DNSBL zones and names them. Mail from that address starts bouncing with a 5xx that quotes the list, or quietly stops reaching one large mailbox provider while working everywhere else.

Read this before you start fixing things

The check takes the domain from your email address, resolves it to its IPv4 addresses, and queries those addresses against the DNSBL zones. The listing is against the address your domain resolves to.

For most setups that is your web server, which is often not the machine that sends your mail. If you send through a provider such as SES, Postmark, or Mailgun, your outbound mail leaves on their addresses and this monitor is not watching them. A hit here still matters — it is the reputation of the host behind your domain, and it affects how links to your domain are treated — but it is not by itself the reason a message bounced. Work out which address is listed before you decide what to fix.

The default zone set is Spamhaus ZEN, SpamCop, Barracuda, CBL, and SORBS, with UCEPROTECT L1 and L2, PSBL, SpamRATS, and AnonMails available on the monitor.

Likely causes

• A compromised mailbox or a hijacked form. If your application sends mail from your own server, a contact form without rate limiting is the classic route in.
• A bulk send to a stale or purchased list, producing complaints and spam-trap hits. Traps are the expensive ones — they are addresses that never opted in to anything, so a hit is proof the list is bad.
• Stolen SMTP credentials used as a relay.
• Missing or wrong SPF, DKIM, and DMARC. These do not cause a listing directly, but without them anyone can send mail as you, and that does.
• A shared IP with a bad neighbour, or an address whose previous owner spammed.
• A residential or dynamic range listing (PBL). The address should not be sending mail directly at all, regardless of what it sent.

Fix steps

1. Read the incident. It names each zone that matched and the raw responses. When a listing is found, the check also runs email-authentication diagnostics and includes them — read those before assuming the cause.

2. Establish whether you send mail from the listed address. Check what your application actually uses for SMTP. If mail leaves through a provider, the listed host is not your sending path: raise it with whoever runs that host, and take any bounce message you have to your provider’s deliverability support separately.

3. Stop the source. Look at the outbound mail queue on the server first — a queue full of mail to strangers means you are relaying for someone. Then rotate every SMTP credential, patch the CMS, and search the webroot for a mailer script you did not put there.

4. Rate-limit and captcha every form that sends mail on unauthenticated input. Do this now, not after the delisting, or you will be back.

5. Fix authentication properly. Publish an SPF record listing only your real senders, sign outbound mail with DKIM, and publish DMARC — start at p=none with reporting, read the reports until they are clean, then move to quarantine and on to reject.

6. Request removal at each zone’s own page, once the cause is genuinely fixed. Say what happened and what you changed; the operators read these, and a specific account gets a faster result than a template.

7. Warm back up slowly. Send low volume to your most engaged recipients for a couple of weeks before returning to normal sending. Reputation recovers on the receivers’ schedule, not yours, and a second listing arrives faster than the first.

Caution

Do not respond to a listing by switching sending domains. Receivers notice a new domain sending the same mail, and burning through domains is itself a spam signal.

Prevention

• Send transactional mail through a dedicated provider. Keeping IP reputation clean is their entire business and a side quest for you.
• Never send bulk mail from the same address as transactional mail. One bad campaign should not take your password resets down with it.
• Authenticate everything, and read the DMARC reports. They tell you about forgery in your name before the blacklists do.
• Only mail people who asked, and honour unsubscribes immediately — an unsubscribe that takes ten days becomes a complaint on day two.
• Keep the monitor running. It defaults to a daily check, and a listing found on day one is a fixable problem, while one found on day thirty is a reputation rebuild.
• If the alert was about a domain rather than an email address, see Domain Blacklisted.