What are Spamhaus CSS and DROP lists?
Still have a question, spotted an error, or have a better explanation or a source we should cite?
If you've looked up your sending IP on Spamhaus and seen a reference to CSS or DROP, you're probably wondering whether this is a minor hiccup or a five-alarm fire. The honest answer is: it depends on which list you're on, because they catch very different problems.
CSS (Combined Spam Sources) is Spamhaus's automated list for catching snowshoe spam operations. Snowshoeing is when a sender spreads email across dozens or hundreds of IPs to keep the volume on any single IP low enough to slip under traditional spam thresholds. CSS is built to catch exactly that. It's automatically generated, so there's no human reviewing your case before you land on it. It's also a subset of the SBL, which means it rolls into the ZEN combined list that most receiving servers actually query.
If you're a legitimate sender and you've landed on CSS, it usually means your sending patterns look suspicious from the outside. Low engagement, inconsistent volumes, or shared infrastructure with bad neighbours can all trigger it. The good news is that CSS listings are behaviour-driven. Clean up the sending patterns and the listing typically clears on its own. If it doesn't shift after a few weeks, you can contact Spamhaus directly.
DROP (Don't Route Or Peer) is a different beast entirely. DROP and its extended version EDROP list entire netblocks that Spamhaus considers hijacked or controlled by professional spam operations. These aren't individual IP listings. They're ranges of addresses that have been taken over, leased directly to bad actors, or allocated with no legitimate use ever intended.
The critical distinction is how these lists are used. CSS is a DNSBL that mail servers query during the SMTP conversation. DROP is designed for network-level firewall and routing rules, not for mail filtering. If your IP is on DROP, the problem isn't just your email. It means the IP address itself has a serious registration or allocation issue that needs to be resolved at the hosting or ISP level, not by changing your sending behaviour.
For most legitimate senders, CSS is the one to watch. You can check your IP at check.spamhaus.org and CSS listings show up as SBL entries with CSS-specific return codes. If you want to run a quick check and see exactly what's flagged, our free blocklist checker covers Spamhaus and several other major lists at once.
If you're staring at a DROP listing and not sure how you even got there, that's worth a conversation rather than a DIY fix. Feel free to reach out via our SOS hotline and we'll help you figure out what actually happened.
Contributors
Who worked on this answer
Every name links to their profile. Every company links to their site. Real people, real accountability.
