What’s the first step after a domain gets blocked?

Your domain just got blocked. The instinct is to fix it fast, blast a delist request, and get back to sending. Resist that instinct. Moving too quickly before you understand what happened is the fastest route to getting blocked again.

Here's what the first 48 hours should actually look like.

Stop sending right now. Everything on that domain goes on pause. Campaigns, warmup sequences, triggered emails. All of it. Continuing to send through a block doesn't just waste resources. It often makes the situation worse, because every rejected message is another data point against your reputation.

Find out exactly what kind of block you're dealing with. This is where most people skip ahead and regret it. Check your bounce messages first. SMTP errors usually name the blocklist or provider involved (something like "blocked by Spamhaus" or "550 5.7.1 rejected"). Run your domain and sending IPs through a blocklist check. Then open the Postmaster Tools for whichever provider is blocking you. Gmail's Postmaster Tools will show you domain reputation data. Outlook and Microsoft use SNDS and JMRP. These tools tell you how the provider sees your domain, which is different from what a third-party blocklist sees. You may be dealing with both at once (and that's two separate problems to solve).

You can run a free blocklist check at our blocklist checker to see where your domain shows up.

Dig into what triggered this. Pull your campaign history from the last two to four weeks. You're looking for anything that changed: a volume spike, a new list segment, a batch of high-bounce sends, a complaint rate jump, or an authentication failure. Most blocks don't come from nowhere. Something triggered the filter or blocklist operator's threshold, and finding that thing is what makes the delist request credible.

Common triggers to check for:

• Complaint rate spiking above 0.1% (Gmail's threshold)
• Hard bounce rate above 2% in a single send
• Sending to an old or unvalidated list
• SPF, DKIM, or DMARC failures showing up in authentication logs
• A sudden volume increase that looked like a compromised account

Write it all down. Create a simple timeline: when the block appeared, what was sent in the days before, what the bounce messages say, and what postmaster data shows. This isn't busywork. When you submit a delist request or contact a postmaster team, they expect you to explain what happened and what you've fixed. Vague requests get ignored. Specific ones get answered.

Don't file a delist request yet. Not until you've actually fixed the root cause. Spamhaus and other blocklist operators can see if a delisted domain re-offends within days, and repeat requests are treated much more skeptically. The delist comes after the fix, not instead of it.

And if this is happening right now and you're not sure what you're looking at, our SOS hotline is free. No pitch, just help.