Email Blacklist also called a blocklist

A note on terminology

Since around 2020 the industry has been moving from "blacklist" to "blocklist" because the older term carries unintended racial connotations. Major DNSBL operators (including Spamhaus) and most mailbox providers now publish "blocklist" in their documentation. We use both terms on this page because senders still search both, but the rest of the site will favour "blocklist" where the term comes up.

The three categories

• Public DNS-based blocklists (DNSBLs). Spamhaus SBL, CBL, PBL, ZEN. Barracuda BRBL. SpamCop. SORBS. UCEPROTECT. Hosted at well-known DNS zones; mailbox providers query them per inbound mail. Spamhaus is the most influential by a wide margin.
• Private internal blocklists. Gmail, Outlook, Yahoo, and others all run private lists that aren't published. You only learn you're on one indirectly, through delivery rejections or sustained spam-folder placement. These are harder to remediate because there's no public ticket.
• URI blocklists. Surbl, URIBL, Spamhaus DBL. These list domains that appear inside email bodies (not the sender). If a URL you link to is on one of these lists, your mail can be filtered even if your sending IP and domain are clean. Common trap for affiliate marketers and senders who recently bought a domain that was previously abused.

How listings actually happen

Each list has its own listing criteria, but the common entry routes are:

• Spam-trap hits. One pristine spam trap hit is enough to land you on Spamhaus SBL. Trap hits are how most of the worst listings start.
• Complaint-rate spikes. Sustained spam-complaint rates above 0.5% at any major mailbox provider get noticed. Some lists ingest complaint feedback directly.
• Botnet or compromised-host signals. Spamhaus CBL specifically targets IPs that look infected. If your IP shares space with a compromised neighbour on the same /24 block, you can get caught in collateral damage.
• Authentication failures at scale. Lots of mail failing SPF/DKIM/DMARC from your IP signals either spoofing or misconfiguration; both get you noticed.
• Reports from honeypots. Anti-spam organisations operate spam reporting addresses and honeypot mail boxes that feed listings directly.
• Manual investigations. Spamhaus does manual research for SBL listings; persistent bad behaviour leads to listings regardless of automated triggers.

How to check if you're listed

The two-step quick check:

• MXToolBox blacklist check. Free, queries 50+ major DNSBLs in one shot for an IP or domain. Good first-pass diagnostic.
• Spamhaus IP/Domain Lookup. Authoritative check against Spamhaus's own data, plus reason codes if you're listed.

If both come back clean and you're still seeing delivery issues, the problem is most likely a private internal blocklist at one specific mailbox provider. Gmail Postmaster Tools and Microsoft SNDS are the best (limited) windows into those private signals.

Delisting

Each list has its own delisting process and they vary in friction:

• Spamhaus. Fill out the reason form; explain what was wrong and what you fixed. They respond within 24-72 hours typically. They are not soft. If you ask for delisting without actually changing your sending practices, you'll get re-listed within days. Be honest about what happened.
• Barracuda BRBL. Self-service removal form. Usually instant if your IP isn't actively generating complaints; otherwise a wait period of 24-48 hours.
• SORBS. Notoriously hard to delist. They expect a track record of clean sending and can take weeks. Reputation matters.
• SpamCop. Mostly automatic: if your IP stops generating complaints for 24 hours, listings expire on their own.
• Private internal lists. No delisting form. The path is sustained good sending behaviour over weeks until the mailbox provider's internal reputation score recovers. Patience and discipline only.

Critical principle for all of them: don't ask for delisting until you've actually fixed the cause. Repeat listings hurt much more than the first one.

How blacklists relate to mailbox-provider reputation

A blacklist hit is a binary signal. A sender reputation score is graded. Most filtering decisions use both: the mailbox provider checks public DNSBLs first (binary), then weights the result into their own reputation score (graded), then applies their internal filtering decision. A Spamhaus SBL listing essentially short-circuits all of this; you're getting rejected before the graded scoring even runs.

This is why blacklist hits are catastrophic in a way that high bounce rate or complaint rate aren't. Bad bounce rate degrades your reputation gradually; a Spamhaus listing cuts off the conversation entirely until you delist.

How sendmsg.io handles blacklist risk

The Cortex engine monitors major DNSBL responses for every sending IP and feeds listings into the per-domain reputation temperature in real time. A new listing triggers graduated throttle on the affected IP across the whole pool while we investigate the cause and start the delisting workflow. The principle is the same as everywhere else: cap the blast radius before the downstream damage compounds.

But the honest framing applies here too: the best blacklist defence is the discipline before send. Confirmed opt-in, no bought lists, no append services, clean URL hygiene in your content. Once you've hit Spamhaus, even a clean platform can only manage the recovery. Prevention is upstream and procedural; we can't substitute for it on the platform side.