Who maintains blocklists (Spamhaus, Barracuda, etc.)?

Blocklists don't come from one central authority. Different organizations run them, each with their own funding model, listing criteria, and delisting process. Knowing who's behind the list you're on makes a real difference when you need to get off it quickly.

Spamhaus is a nonprofit funded by industry partnerships. It operates independently and carries the most weight in practice. Major mailbox providers trust its data directly, so a Spamhaus listing can block delivery at Gmail, Outlook, and most enterprise mail filters simultaneously. Their delisting process is formal and documented, but they don't negotiate. If you want off, you fix the problem first.

Barracuda runs the Barracuda Reputation Block List (BRBL) as part of its commercial security business. It's used by Barracuda customers and shared with the wider anti-spam community. Delisting requires a request through their lookup tool, and they do respond reasonably quickly if your sending practices are clean.

SpamCop is now owned by Cisco. It lists based on user spam reports and automated analysis, so listings can appear fast and expire fast too. It's more reactive than Spamhaus, but still worth monitoring if you send to corporate addresses behind Cisco's security stack.

SORBS is a community-maintained list run by volunteers. Its influence has dropped over the years, but some hosting providers and regional mail systems still query it. Getting delisted from SORBS can be more unpredictable than with the commercial or nonprofit operators above.

There are dozens of smaller lists beyond these four, many run by individual researchers or regional anti-spam groups. Most have minimal real-world impact on deliverability. The ones that actually matter for most senders are Spamhaus, Barracuda, and (depending on your audience) SpamCop.

If you're not sure whether you're on any of them right now, you can run a free blocklist check in about 30 seconds. And if you want to go deeper on how listings happen in the first place, the next logical read is how IPs and domains actually get added.