Emails Bouncing Because of a Blacklist (RBL) Listing Print

The symptom

Your emails to certain recipients bounce back with a message similar to:

554 5.7.1 Service unavailable; Client host [x.x.x.x] blocked using zen.spamhaus.org

or wording like "blocked using," "listed in," "blacklisted," or "rejected due to poor reputation," usually naming a specific list. Mail to some providers may work fine while mail to others fails, because each receiving server chooses which blacklists it consults.

What a blacklist is

A blacklist, formally an RBL or DNSBL, is a constantly updated database of IP addresses and domains observed sending spam. Receiving mail servers check incoming connections against these lists and reject or spam-folder mail from listed sources. Well-known examples include Spamhaus, SpamCop, and Barracuda.

The listed address is usually the sending server's IP rather than your domain. On shared hosting, many domains send through the same server IP, which means a listing can be triggered by any account on the server, and every account on the server feels the effect. So a blacklist bounce does not automatically mean you did anything wrong.

How to check

1. Read the bounce message. It names the blacklist and usually includes the listed IP, and often a link to the listing itself with the reason.
2. Run a full check. Put the IP from the bounce into the blacklist checker at MXToolbox. It queries dozens of blacklists at once and shows exactly which ones list the IP.
3. Check your own domain too. Run your domain name through the same tool. Domain listings are rarer than IP listings but hit harder, and a domain listing does point at your own sending rather than the shared server.

What to do

1. If the server IP is listed: open a support ticket and include the bounce message. Delisting a server IP is our job. We identify what triggered the listing, deal with the source, and submit the delisting request. Please do not submit delisting requests for our server IPs yourself, duplicate or premature requests without the cause fixed can make some lists slower to clear.
2. If your domain is listed, the cause is almost always one of two things: a compromised account or website sending spam under your name, or bulk mail practices that recipients are reporting, such as a bought list or missing unsubscribe handling. Rule out compromise first using our article on the signs of a compromised email account, then honestly review any bulk sending.
3. While the listing clears, urgent mail can still reach people through an alternative channel. Delisting typically takes from a few hours to a few days depending on the list, and some lists remove entries automatically once the spam stops.

Preventing repeat listings

• Keep SPF, DKIM, and DMARC in place for your domain, authenticated mail is far less likely to be misjudged and protects your domain from forgery-driven reputation damage. See our article on SPF, DKIM, and DMARC.
• Keep your website and its plugins updated. Hacked WordPress sites quietly sending spam are the single biggest cause of server listings we deal with.
• Never send to bought or scraped lists, and clean bounced addresses out of any newsletter list immediately, repeated sending to dead addresses is a strong spam signal.
• Use strong, unique passwords on every mailbox, a single weak password on a forgotten mailbox is all a spammer needs to burn the whole server's reputation.

Good to know

Blacklist bounces sometimes name lists that matter very little. A handful of aggressive or defunct lists list huge swathes of the internet, and almost no real mail servers consult them, so a listing found by a checker is only worth acting on if mail is actually bouncing because of it. The bounce message, naming the list that actually blocked you, is always the more reliable guide than a scan showing every list you appear on.