How to Get Removed From the Spamhaus Blacklist (Delisting)

A Spamhaus listing is the deliverability equivalent of a flat tire. You can keep pressing send, but you're not going anywhere. Spamhaus data feeds a huge slice of the mailbox providers and corporate filters your cold email has to pass through, so a single listing can quietly route your whole campaign to spam or get it rejected at the gate.

Here's the part most guides skip. The phrase "how to get removed from the Spamhaus blacklist" implies one process. There isn't one. Spamhaus runs several separate lists, each catches a different problem, and each has its own removal path. Pick the wrong path and you'll either waste a day or get re-listed before lunch.

This is the operator's delisting playbook: find the exact list you're on, fix what put you there, then file the removal so it sticks. If you only need to confirm whether you're listed in the first place, start with our guide on how to check if your domain is blacklisted and come back here once you have a hit.

First, find which Spamhaus list you're on

Removal starts with identification, because the fix is different for every list. Look up your IP or domain in the Spamhaus IP and Domain Reputation Checker at check.spamhaus.org. This tool replaced the old Blocklist Removal Center, and it takes IPv4 and IPv6 addresses, domain names, email addresses, and hash strings from a single field.

The checker does something genuinely useful: it shows your active listings in the required removal order and walks you through each step. That ordering matters. If you're on the Spamhaus Blocklist (SBL) plus other lists, Spamhaus tells you plainly: "You will not be able to remove your IP from any additional blocklists until your ISP has removed your IP from the SBL." So work top down, not in the order that looks easiest.

One distinction frames everything that follows. Spamhaus lists IP addresses on some feeds and domain names on others. If the listing is on an IP you don't own (more on that below), your hands are partly tied. If it's your domain on the Domain Blocklist, that one is squarely yours to fix.

Spamhaus SBL vs CSS vs XBL: which list, which fix

Before you touch a removal form, know what each list flags. Here's the Spamhaus SBL vs CSS vs XBL comparison cold senders actually need, plus the two other lists you'll bump into.

A few facts worth internalizing, all straight from Spamhaus.

The SBL is the big one, holding roughly 30 to 40 thousand listings on average, maintained by a human research team. End users can't request SBL removal. Spamhaus is explicit: contact your system administrator, ISP, or email service provider, because only the network responsible for the IP can clear it.

The CSS sits inside the SBL zone as a subset and is the one most cold senders actually trip. It targets static spam emitters that snowshoe across IPs, plus senders with bad list hygiene or compromised accounts. CSS listings expire on their own, "normally, three days after last spam detection," though chronic abuse keeps them on longer.

The XBL is enormous and fast-moving: about 2 million listings, with roughly 650,000 new detections every 24 hours. It flags machines that look insecure, compromised, or infected, including devices roped into "free VPN" proxy schemes. Removal is self-service only, and check.spamhaus.org is, in their words, "the only place where XBL removals are handled."

The PBL isn't a spam accusation at all. It marks end-user IP ranges that, by policy, shouldn't deliver unauthenticated SMTP straight to other mail servers. If your campaigns route through Gmail, Microsoft 365, or a real relay, a PBL hit on your office IP is mostly noise. It only bites if you're trying to send directly from an IP that providers expect to stay quiet.

The DBL lists domain names, not IPs, which makes it the list a cold email operator can both cause and personally fix. We'll come back to it, because for most readers it's the important one.

ZEN, by the way, isn't a separate list. It's a bundle that combines SBL, CSS, XBL, and PBL into one lookup, which is why a single ZEN hit can mean any of those four underneath.

Why is my IP on Spamhaus? The causes you must fix first

"Why is my IP on Spamhaus" almost always has a concrete answer hiding in your sending behavior. Spamhaus doesn't list at random, and CSS listings in particular are "always the result of multiple events and heuristics," not one stray email. Before you request anything, find and kill the actual cause. The usual suspects:

• Dirty list hygiene. Buying or scraping lists, mailing stale contacts, or hitting spam traps. A single pristine trap hit signals you didn't get permission, and that's exactly the pattern CSS and DBL watch for.
• High complaint rates. When recipients mark you as spam, mailbox providers notice and so does Spamhaus. Keep your Gmail spam complaint rate well under the 0.3% line that Google Postmaster Tools reports, and watch the Microsoft side through SNDS and JMRP.
• Compromised accounts or servers. A breached mailbox, an open relay, or malware on a sending machine pumps out spam you didn't write. That's classic XBL territory.
• Volume spikes with no warmup. Blasting a cold domain on day one looks like snowshoe behavior. If your infrastructure is new, walk the email warmup process before you ramp.
• Weak authentication. Missing or misaligned SPF, DKIM, and DMARC make you look forgeable and lower trust across the board. Our SPF, DKIM, DMARC guide covers the base setup.

Notice none of these are "ask Spamhaus nicely." The listing is a symptom. If you delist without curing the disease, you're just resetting a timer.

The one rule: fix the cause before you delist

This is the rule that decides whether your delisting works or wastes your afternoon. Spamhaus says it in capital letters for CSS: "Whatever caused the problem MUST be identified and corrected before removing an IP from CSS." And the consequence is immediate. CSS "will allow the removal of an IP, but it will also re-list it immediately if a problem continues to be detected."

Self-service removals are also limited in number. Burn them by clicking remove on an unfixed listing and you can lose the easy path, leaving you to wait out the automatic expiry or open a manual ticket. So the sequence is non-negotiable:

1. Stop the active sending from the listed source. Pause the campaign or disconnect the mailbox.
2. Diagnose the cause using the list type as your clue (CSS points at hygiene and snowshoe patterns, XBL at compromise, DBL at domain reputation).
3. Actually fix it: scrub the list, rotate compromised credentials, fix the relay, repair authentication.
4. Only then request removal.

Skip steps one through three and step four is theater.

How to get removed from the Spamhaus blacklist: the delisting steps

Now the mechanics. Below is how to get removed from the Spamhaus blacklist for each list, in plain steps. There's never a charge or fee to remove a Spamhaus listing, so if anyone asks you to pay, you're being scammed.

SBL: route it through your ISP or host

You can't self-remove an SBL listing. The Spamhaus delisting request steps here are about getting the right party to act:

1. Open the listing in check.spamhaus.org and read the evidence and the SBL reference number.
2. Identify who controls the IP. If it's a server you rent, that's your hosting provider. If it's a corporate range, that's your network team.
3. Fix the underlying spam problem permanently, and document what you changed.
4. Contact the responsible party's abuse desk with the SBL reference and your remediation summary, and ask them to submit the removal request to Spamhaus.

Spamhaus won't process the request while the spam issue is still active, so the order of fix-then-ask is what gets it cleared.

CSS and XBL: self-service at check.spamhaus.org

These two share the same front door and are the most common cold-email listings.

1. Look up the IP in the Reputation Checker and open the listing details.
2. Confirm and fix the cause. For CSS that usually means list hygiene and authentication. For XBL it means finding and removing the compromise.
3. Follow the on-page removal steps. When both CSS and XBL are present on one IP, the form generally covers them together.
4. If the checker can't process it instantly, it raises a ticket automatically, so you don't have to chase anyone.

Remember the CSS clock: even without any action, a CSS listing typically clears about three days after the last detection, assuming nothing re-triggers it. XBL expires automatically once the bad behavior stops too. Sometimes the fastest "removal" is fixing the cause and waiting two or three quiet days.

PBL: request an exclusion only if you run a real mail server

PBL is self-service, but the bar is specific. You can request an exclusion only if the IP is static, is an actual outbound mail server, has matching forward (A record) and reverse DNS, and is assigned to you. Look the IP up, click into the details, and follow the exclusion steps. One caveat to plan around: single-IP exclusions from the PBL expire after one year, and they reverse instantly if spam is ever detected from that IP. If you're sending through a provider rather than a self-hosted server, a PBL listing on your home or office IP usually isn't your delivery problem at all.

DBL: the domain listing you can actually fix yourself

If your sending domain lands on the DBL, this is the one to prioritize, because it's tied to your brand and within your control. Steps:

1. Look up the domain at check.spamhaus.org.
2. Fix the reputation problem: stop mailing unverified lists, repair authentication, and remove any compromised content or redirects pointing somewhere shady.
3. Follow the self-service removal steps on the listing page.

Spamhaus processes DBL removals immediately once approved, usually within a few minutes, though some users see up to a 24-hour lag. The DBL is highly automated, so most listings expire on their own once the activity stops, but they re-list automatically if the bad signal comes back. Same rule as everywhere else: clean first, remove second.

The cold email reality: you often don't control the IP

Here's the uncomfortable truth for most cold senders. If you mail through Gmail, Google Workspace, Microsoft 365, or a managed relay, your messages leave from a shared pool of provider IPs. You don't own those IPs, you can't see which one carried a given send, and you can't file an SBL or CSS removal for them. That's the provider's job, and they manage pool reputation at a scale you can't touch.

So when a shared provider IP shows up on Spamhaus, the right move usually isn't a removal request. It's to ask whether your own sending is what flagged the pool, and to clean that up. Often the listing reflects a noisy neighbor and clears on its own as the provider's reputation systems work.

What you can and should own:

• Your domain's DBL status. That's directly tied to your list quality and authentication.
• Your sending behavior. Volume, complaints, and trap hits are the inputs that get pool IPs flagged in the first place.
• Your infrastructure choices. If you genuinely need IP-level control, that's a deliberate decision about a dedicated setup, covered in our provider comparison for cold outreach.

This is also why the answer to "why is my IP on Spamhaus" is sometimes "it isn't your IP, it's your domain." Check both.

After delisting: don't get re-listed

Removal is a checkpoint, not a finish line. Spamhaus re-lists fast when the original behavior returns, and repeat offenders get the chronic-abuse treatment where listings stick around longer. Keep yourself off the list with the same discipline that should have prevented it:

• Verify every list before you send. Validation and suppression of role accounts, catch-alls, and known traps is the single biggest lever against re-listing.
• Monitor reputation continuously, not just after a fire. Set up ongoing domain health monitoring so a complaint spike shows up before a blocklist does.
• Watch placement, not just sends. Run periodic seed-list inbox placement tests to catch drift early.
• Keep volume sane and authenticated. Ramp gradually, keep SPF, DKIM, and DMARC aligned, and don't pour a cold domain into a hot campaign.

If the listing was part of a bigger blowup, where placement cratered and reputation tanked across providers, delisting is one step inside a longer recovery. The full sequence lives in our burned domain recovery guide, and the broader prevention playbook is in how to avoid spam filters and the deliverability audit checklist.

Common questions

How long does Spamhaus delisting take?

It depends on the list. CSS listings normally expire about three days after the last spam detection, and XBL listings auto-expire once the malicious behavior stops. DBL removals, once approved through self-service, process within a few minutes for most people, though some see up to a 24-hour lag. SBL is the slow one, because it depends on your ISP or host fixing the issue and filing the request on your behalf.

Can I remove my IP from the Spamhaus SBL myself?

No. Spamhaus doesn't accept SBL removal requests from end users. You have to get the network owner, your ISP, host, or internal network team, to fix the problem and submit the request. CSS, which is a subset of the SBL zone, does have a limited self-service path at check.spamhaus.org.

Does Spamhaus charge to remove a listing?

Never. Spamhaus states there is never any charge or fee associated with removing any listing. Any service demanding payment for "guaranteed Spamhaus removal" is selling something Spamhaus gives away.

Why did I get re-listed right after delisting?

Because the cause wasn't fixed. CSS explicitly re-lists an IP immediately if a problem continues to be detected, and DBL re-lists automatically if the domain is re-detected. Self-removals are also limited, so clicking remove on an unfixed listing can cost you the easy path. Diagnose and fix first, then remove.

I send through Google Workspace and a Spamhaus listing shows a Google IP. What do I do?

You usually can't delist a shared provider IP, and you shouldn't try. Confirm whether your own domain is listed on the DBL (that part is yours to fix), clean up the sending behavior that could be flagging the pool, and let the provider manage its IP reputation. If you keep hitting pool-level issues, it's a signal to revisit your infrastructure, not to file removals you have no authority over.

What's the difference between Spamhaus SBL, CSS, XBL, and DBL?

SBL lists IPs tied to spam operations and needs ISP-level removal. CSS is a subset of SBL aimed at static spam emitters and poor hygiene, with limited self-service. XBL lists compromised or infected machines and clears automatically once the abuse stops. DBL lists domain names with poor reputation, and it's the one cold senders can self-remove directly.

Sources

• Spamhaus, Spamhaus Blocklist (SBL)
• Spamhaus, Combined Spam Sources (CSS)
• Spamhaus, FAQs on Combined Spam Sources (CSS)
• Spamhaus, Exploits Blocklist (XBL)
• Spamhaus, Policy Blocklist (PBL)
• Spamhaus, Domain Blocklist (DBL)
• Spamhaus, ZEN Blocklist
• Spamhaus, Good-bye Blocklist Removal Center, Hello IP & Domain Reputation Checker
• Spamhaus, IP and Domain Reputation Checker