Spamhaus — The Most Widely Used Email Blacklist

Overview

Spamhaus is the single most influential email blacklist operator in the world. Founded in 1998 and based in Andorra and Geneva, the Spamhaus Project maintains multiple specialized blocklists that collectively protect billions of email inboxes. When someone says "we're blacklisted," Spamhaus is usually the first list that matters.

Unlike most blacklists that operate a single zone, Spamhaus maintains several specialized lists — each targeting a different type of abuse. Understanding which list you're on is the first step toward getting delisted.

Important: Spamhaus requires checking directly at check.spamhaus.org. DNS queries to Spamhaus zones require a commercial Data Query Service (DQS) agreement for production use.

Spamhaus Block List (SBL) {#sbl}

The SBL lists IP addresses involved in direct spam operations. This includes known spam sources, snowshoe spam networks, and bulletproof hosting providers. SBL listings are often manually verified by the Spamhaus research team, making them highly accurate but slower to add and remove. A SBL listing is serious — it indicates Spamhaus has evidence connecting your IP to spam operations.

Removal: Submit a removal request at check.spamhaus.org with evidence that the spam source has been eliminated. Manual review by Spamhaus staff.

Exploits Block List (XBL) {#xbl}

The XBL lists IPs running compromised systems — botnets, open proxies, trojaned machines, and other exploited hosts. The XBL incorporates data from the former CBL (Composite Blocking List). XBL listings are fully automated and typically indicate your server or a device on your network has been compromised.

Removal: Automated. Clean the compromised system, then request removal at check.spamhaus.org. Removal is typically immediate once the exploit is no longer detectable.

Policy Block List (PBL) {#pbl}

The PBL lists IP ranges that should not be sending email directly to the internet. This includes residential/dynamic IP ranges and hosting IPs that ISPs designate as end-user (non-mail-server) space. A PBL listing is not an accusation of spam — it's a policy statement that mail from these IPs should route through an ISP's smarthost or authenticated relay.

Removal: If you operate a legitimate mail server on a PBL-listed IP, submit a removal request. ISPs can also manage their own PBL entries via the Spamhaus portal.

Spamhaus ZEN {#zen}

ZEN is the combined query zone — a single DNS lookup that checks SBL, XBL, and PBL simultaneously. Most mail servers that use Spamhaus query ZEN rather than individual lists. The return code indicates which underlying list triggered the hit.

Not a separate list. ZEN is a convenience zone. If you're listed in ZEN, check which component list (SBL, XBL, or PBL) is responsible and follow that list's removal process.

Domain Block List (DBL) {#dbl}

The DBL lists domains (not IPs) found in spam messages — domains used in phishing URLs, spam landing pages, and malicious redirects. A DBL listing means your domain appeared in the body of spam messages collected by Spamhaus sensors.

Removal: Automated when the domain is no longer observed in spam. Manual removal requests available at check.spamhaus.org.

CSS (Spamhaus CSS) {#css}

CSS targets snowshoe and hailstorm spam operations — senders that distribute spam across many IPs and domains to stay below individual thresholds. CSS is a component of the SBL and represents Spamhaus's most aggressive detection of distributed spam campaigns.

Removal: Same process as SBL. Evidence of legitimate sending required.