Your Mail Server IP Is on a Blacklist: What Now?

At the start of the work week, several employees report that their emails to customers are bouncing. The bounce message names a blacklist, or contains phrases such as blocked, listed or poor reputation. This means the receiving server has flagged your mail server’s IP address as a source of spam and is refusing its messages. It’s tempting to rush to request removal, but if the cause isn’t fixed, the IP will be listed again, this time with a worse record.

What is a blacklist?

Blacklists (DNSBL or RBL) are databases of IP addresses and domains that have shown spam-like behavior. When receiving a message, mail servers look up the sender’s IP in these lists and, depending on the result, reject the message or give it a higher spam score. Not all lists carry the same weight or impact; some, such as the Spamhaus lists, are very widely used, while others have little effect. Large providers such as Microsoft and Gmail also have their own reputation systems.

Step 1: Pinpoint the problem

1. From the bounce message, find the list name and the blocked IP. Make sure this IP is the same public IP your mail server sends email from.
2. Check the IP with an online tool that queries many blacklists at once, and look it up on the Spamhaus site itself.
3. Read each list’s explanation; it usually states why the IP was listed and the conditions for removal.

Step 2: Find and fix the cause

The most common causes:

• Compromised mailbox: A user’s password has leaked and spam is being sent through your server. Check the outgoing queue and SMTP logs; there is usually one user with unusually high sending volume. Change the password, delete the spam from the queue and enable two-factor authentication for webmail.
• Infected device on the network: If the mail server and office computers share one public IP, one infected computer can send spam directly over port 25 and get the shared IP listed. On the firewall, block outbound port 25 for everything except the mail server.
• Vulnerable website or form: A contact form or site script on the same server may have been abused to send spam.
• Bulk email: Newsletters sent to old or purchased lists generate many spam complaints and bounces.
• Policy lists: Some lists, such as the Spamhaus PBL, list ranges that shouldn’t send email directly, such as residential internet IPs. This doesn’t necessarily mean spam was sent; the mail server should be on a suitable static IP with a correct PTR record.

Don’t request removal until the cause has been found and fixed. Many lists make the next removal harder or slower if the IP starts sending spam again right away.

Step 3: Request removal

Once the problem is fixed, submit a request on each list’s removal page. Some lists remove the IP automatically after a while once the spam stops. Some less reputable lists ask for money for fast removal; before paying, check whether they affect your email delivery at all. For Microsoft services, use their dedicated delisting form, and for Gmail, use Postmaster Tools to see your domain’s reputation status.

Prevention

• Per-user sending limits within a time window; many mail servers, including SmarterMail, offer this.
• Strong passwords and two-factor authentication for mailboxes.
• A correct PTR record, along with SPF, DKIM and DMARC.
• Sending newsletters and bulk email from a separate service or IP.
• Automatic daily monitoring of the server’s IP on the main lists, with alerts.

Checklist

• The IP and list name have been identified from the bounce message
• The cause of the listing has been found and fixed
• The outgoing queue has been cleared of spam
• Outbound port 25 is open only for the mail server
• A removal request was submitted after the problem was fixed
• Daily blacklist monitoring is enabled

ITPlus724 engineers can find and fix the reason your company’s mail server was listed, follow up on removal requests and set up ongoing IP reputation monitoring.