What is Spamhaus (ZEN, DBL, etc.)?
Still have a question, spotted an error, or have a better explanation or a source we should cite?
If your emails suddenly stop reaching people, one of the first places to check is Spamhaus. They run the most widely used blocklists in the world, and a single listing there can cause widespread blocking across major mailbox providers, enterprise mail gateways, and hosting companies all at once.
Unlike smaller lists that cause scattered delivery failures, a Spamhaus listing hits hard and fast. That's why understanding which list you're on matters before you do anything else.
IP-based blocklists
- SBL (Spamhaus Blocklist) lists IP addresses of verified spam sources, known spam operations, and spam support services. These listings are investigated by humans, not automated.
- XBL (Exploits Blocklist) lists IPs of compromised machines: infected devices, open proxies, and hijacked systems used for spam delivery. If you're listed here, something on your network has likely been taken over.
- PBL (Policy Blocklist) lists IP ranges that aren't supposed to send email directly to the internet (residential IPs, dynamic ranges). This isn't a punishment. It's Spamhaus saying those IPs should route through their ISP's mail servers instead of sending directly.
- CSS (Combined Spam Sources) is an automatically generated list targeting low-reputation IPs, particularly ones used in snowshoe spam (where senders spread sending across many IPs to avoid detection).
- ZEN combines SBL, XBL, PBL, and CSS into one zone. Most organizations query ZEN rather than checking each list individually, so ZEN is the one that matters most day to day.
Domain-based blocklists
- DBL (Domain Blocklist) lists domains used in phishing, malware distribution, and spam. Your domain can land here even if your sending IP is perfectly clean, which catches a lot of senders off guard.
How to check your status
Go to check.spamhaus.org and look up your IP or domain. It takes about 30 seconds. You can also run a quick check with our free blocklist checker if you want to scan across multiple lists at once.
Getting delisted
Each list has a different removal process, so don't treat them all the same.
- SBL removals go through the network or hosting company responsible for the IP. If you are not that company, talk to your provider.
- XBL removals are largely automated once the security issue (compromised device, open proxy, etc.) is actually fixed.
- PBL removal means either working with your network provider or demonstrating that you legitimately operate a mail server from that IP range.
- DBL requires addressing the underlying domain reputation issue first, then submitting a removal request.
Reading a ZEN result
zen.spamhaus.org combines Spamhaus's IP lists, so it has no page of its own. A ZEN hit always means a hit on one of them, and the number the lookup returns says which:
| Number | List | Go to |
|---|---|---|
| 127.0.0.2 | SBL | Spamhaus SBL, below |
| 127.0.0.3 | CSS, part of the SBL zone | Spamhaus SBL, below |
| 127.0.0.4 | XBL | Spamhaus XBL, below |
| 127.0.0.10 or .11 | PBL | Is the PBL a bad listing? |
Spamhaus SBL
sbl.spamhaus.org checks IPs. The Spamhaus Project runs it.
What the operator says
"IP addresses that have been identified as malicious" Spamhaus, SBL, read 31 Oct 2026.
What it really measures
A research team's judgment that an IP or range is run by, used by or available to spammers and abusers. Spamhaus asks if mail was unsolicited and bulk. It does not judge what the mail said or whether it was legal.
Why you might be there
- The IP sent bulk mail nobody asked for, including mail spread across many IPs and domains.
- It hosts a site advertised in spam, or services that support spam.
- Your network has a bad enough record that Spamhaus listed more of it.
An informational listing is an early warning. It does not block, and Spamhaus says to act on it anyway.
What to think about
Treat this one as urgent, as an SBL listing is near-universal. If you are a customer on someone's network, the fix sits with them. And removal never costs money: Spamhaus calls any paid offer a scam.
How to get off it
Look it up at check.spamhaus.org by IP, range or SBL ticket number. Spamhaus emails the network or hosting company when it lists, and says only they can handle removal. So talk to your provider, and they ask once the cause has gone.
Spamhaus XBL
xbl.spamhaus.org checks IPs, IPv6 included. The Spamhaus Project runs it.
What the operator says
"individual IPv4 and IPv6 addresses exhibiting signs of compromise" Spamhaus, XBL, read 31 Oct 2026.
What it really measures
Whether a machine behind the IP looks insecure, compromised or infected. It has nothing to do with your list or your content. It is automatic, and nobody can report an IP onto it.
Why you might be there
Spamhaus keeps the exact triggers private, and gives examples: malware on a device, a free VPN app using it as a proxy, brute force attacks, or mail relayed with stolen logins. On a dynamic IP, it may be left over from the last person who had that address.
What to think about
Something on your network may be doing this without you knowing. If you get listed again, Spamhaus says the problem was not fixed.
How to get off it
Find and fix the device first. check.spamhaus.org is the only place XBL removals are handled, and listings also expire some time after the behaviour stops. Allow 24 hours for networks to catch up before you open a new ticket.
Spamhaus DBL
dbl.spamhaus.org checks domains. The Spamhaus Project runs it.
What the operator says
"any domain indicating signs of spam or malicious activity" Spamhaus, DBL, read 1 Nov 2026.
What it really measures
A domain's reputation, worked out from how it behaves. Most listings are automatic. It is checked against the sending names and also the domains inside the mail, so a clean IP does not protect you.
Why you might be there
- The domain was used in bulk mail nobody asked for, phishing, fraud or malware.
- It is a real domain that was hijacked, usually through a hacked website.
- Its behaviour scored badly, which can happen before any harm is seen.
What to think about
Each mailbox provider treats a domain blocklist differently. A DBL listing can cause bounces at Microsoft, while others use it as one data point or not at all.
If you were hacked, deal with the site first. Spamhaus suggests taking it offline if you can, removing infected files, and updating the site software and plugins.
How to get off it
Listings expire by themselves once the domain stops matching. To ask sooner, look it up on the reputation checker and follow the steps. It may not be granted, and repeat requests can get you blocked. An approved removal is immediate, with up to 24 hours for others to catch up. It is free.
Still if you're dealing with a Spamhaus listing right now and not sure where to start, our SOS hotline is free and we can help you figure out which list you're actually on and what the next move looks like.
Want a hand getting this delisted? Here is how to write to a list's operator, or ask a person on our free SOS Hotline. Tell us the list and the IP or domain, and we reply within 48 to 72 hours.
A separate job: cleaning your list does not remove a listing. If you also want to know who on your list is safe to send to, clean your first 1,000 free.
The most useful email questions, once a month
One email a month. New questions worth reading, real deliverability changes (Gmail and Outlook updates, etc.), and any tool or report that landed since the last issue. No fluff, no upsell.
Contributors
Who worked on this answer
Every name links to their profile. Every company links to their site. Real people, real accountability.
