SURBL — Check, Delist & Monitor
Check if your domain is listed on SURBL. Domain-based URI blacklist used by SpamAssassin and enterprise mail filters. Monitor your domain reputation automatically.
Impact & Usage
Used by SpamAssassin, mail servers, and security appliances to check URIs in message bodies. Being listed means your domain appears in spam.
Typical users: Mail servers, spam filters, and security appliances checking URIs in message bodies
What Gets You Listed
Domains found in body of unsolicited messages detected by multiple spam sources and spamtraps
How to Get Delisted
- Check your domain at surbl.org/surbl-analysis to confirm the listing and see which SURBL sub-lists flag your domain.
- Investigate how your domain ended up in spam — check for domain spoofing, compromised web forms, or unauthorized use of your domain in phishing campaigns.
- Implement DMARC enforcement (p=reject or p=quarantine) to prevent unauthorized senders from using your domain in spam.
- SURBL listings auto-expire once your domain stops appearing in spam. Monitor with mxio Blacklist Check to confirm removal.
Expected Timeline
Automatic (when domain stops appearing in spam)
Auto-delist: Automatic removal after domain is no longer seen in spam; manual removal request available
Common Causes
- Domain spoofing — spammers using your domain in From addresses or message body links without authorization
- Compromised website hosting phishing pages or malware downloads that get linked in spam emails
- Legitimate marketing emails with poor list hygiene triggering spam reports that include your domain
- Hacked web forms or comment sections being used to distribute spam containing your domain URLs
Prevention Tips
- Enforce DMARC with p=reject to prevent unauthorized senders from spoofing your domain in email
- Secure your website against compromise — patch CMS software, use strong admin passwords, monitor for unauthorized content
- Implement SPF and DKIM to authenticate all legitimate email sources for your domain
- Monitor your domain reputation regularly — SURBL listings indicate your domain is appearing in spam, regardless of who is sending it
Overview
SURBL is fundamentally different from IP-based blacklists like SpamCop or Barracuda. Instead of checking the sender's IP address, SURBL checks domains found in the body of email messages — specifically, the domains in URIs (links). If your domain appears on SURBL, it means your domain was found in the content of messages identified as spam by SURBL's collection network.
This distinction matters because a SURBL listing does not necessarily mean your mail server sent spam. It means someone — possibly you, possibly an attacker spoofing your domain — sent messages containing links to your domain, and those messages were flagged as spam. Common scenarios include phishing campaigns that impersonate your brand, compromised websites that host malware linked from spam, and legitimate marketing with poor list hygiene.
SURBL is widely used. SpamAssassin includes SURBL checks by default, and many enterprise mail gateways and security appliances reference it as part of content-level filtering. A SURBL listing can cause messages containing your domain's URLs to be scored as spam or rejected, even if the sender is a completely different organization.
The fix depends on the cause. If your domain is being spoofed, DMARC enforcement (p=reject) prevents unauthorized senders from using your domain and reduces the volume of fraudulent messages that feed SURBL's detection. If your website was compromised, clean it up and patch the vulnerability. Listings auto-expire once your domain stops appearing in spam.
Monitor Your Blacklist Status
Get alerted the moment your IP or domain appears on a blacklist. Catch listings early, before they impact deliverability.
Set Up MonitoringRelated Blacklists
Check if your domain is listed on URIBL. Domain-based URI blacklist used by SpamAssassin and content filters. Monitor your domain reputation automatically.
Check if you're listed on Barracuda BRBL. Manual removal via the BRBL form, typically processed within 12-24 hours. Monitor your IP reputation automatically.