One morning your messages stop going out. The sending log repeats the same line, and it contains a name: Spamhaus.
A predictable sequence follows. Someone searches for “get IP removed from Spamhaus”, lands on a service promising delisting within 24 hours for a fee, and hesitates.
One sentence settles the question, and Spamhaus publishes it: “There is never any charge or fee associated with removing any Spamhaus listing.”
The criterion, and what it does not look at
The page for the main list, the SBL, states the listing criterion bluntly:
“Spamhaus’ listing criteria for SBL inclusion is ‘unsolicited bulk email’ (UBE). Spamhaus does not evaluate the content or legality of the contents of an email message, merely whether that message constitutes spam by this definition.”
Read the second sentence again. Spamhaus evaluates neither the content nor the legality of the content. Only whether it is unsolicited and bulk.
A perfectly lawful campaign, based on legitimate interest, addressed to professionals, with every required notice, falls within that definition as soon as it is bulk and unsolicited.
It is the same dividing line we have described elsewhere: the law and the operators are not judging the same thing. Being compliant with your data protection authority and listed by Spamhaus is not a contradiction. It is two different courts.
The list you are probably on, which is not a punishment
Before assuming you have been accused of spamming, check which list it is. The largest one, the PBL, says nothing about your behaviour.
“The Policy Blocklist is a dataset containing end-user IP address ranges from which email should never be sent directly to the final destination.”
And this clarification, which ought to head every troubleshooting guide:
“The IPs in this dataset are not necessarily ‘bad’ – simply, they should never be sending email.”
The PBL holds more than 1.4 billion IPv4 addresses, close to 40 percent of routable IPv4 space. These are residential ranges and ranges not meant to host a mail server.
If your application sends directly from a poorly declared server, or from a consumer connection, you are not being punished: you are simply in the wrong place. The exit is provided for, at the user’s initiative: “If the Policy for a particular network allows it, end users can have their IP excluded from PBL.”
The SBL is incomparably narrower: “On average, this dataset contains 30-40 thousand listings, maintained by an Open Source Intelligence (OSINT) research team.” Thirty to forty thousand entries, kept by a team of investigators. Being on it means a human looked at you.
How you actually get off
The sequence Spamhaus publishes has four steps, and the order matters.
Read the listing page, which describes the observed problem. Fix that problem permanently. Contact your provider’s abuse desk. Let that provider submit the removal request.
The surprising step is the third. On an SBL listing covering a range, it is not you who requests removal, it is the owner of the address space. Which explains the perceived slowness: you are waiting on an abuse desk that does not share your priorities.
Propagation itself is fast: “The SBL DNS zone is rebuilt and reloaded every 5 minutes, 24/7, to ensure that new spam problems are swiftly blocked and that fixed problems are swiftly removed.”
Five minutes after removal, the removal is effective everywhere. The delay is never technical. It is in how long you take to fix things, and how long your provider takes to process the case.
What Spamhaus recommends, and what that says about you
The same page publishes best practices for avoiding a listing. Two points deserve attention, because they identify causes you would not imagine.
The first concerns your forms: Spamhaus recommends a captcha or another robot prevention mechanism “in order to prevent ‘mail bombing’ and unauthorized subscriptions”.
An unprotected signup form is a weapon. An attacker injects thousands of stolen addresses, your system dutifully sends a welcome message to each, and it is your IP that ends up on the list. You did nothing wrong, except leave a door open.
The second concerns outbound SMTP: “configure your firewall to allow outbound SMTP traffic (destination port 25) only if originated from your mail server internal IP”. A compromised machine on your network talking directly on port 25 guarantees a listing, and the error message will never tell you which machine.
The rest of the list is more expected, and still regularly neglected: list hygiene “to avoid spam traps and ensure only real and interested recipients are sent your emails”, which verifying that addresses really exist settles before the send, and consistency between hostname, HELO and reverse DNS.
That last point matches exactly the coherent reverse DNS requirement Google publishes on its side. The same causes, everywhere.
What the operators do with it
Spamhaus blocks nothing. It publishes data, and others decide.
Yahoo, in its error code page, sends senders explicitly to that source: “Your IP is listed by Spamhaus. Please check with https://www.spamhaus.org.”
Google, in its guidelines, recommends checking that a shared IP is on no blocklist before using it.
Using the data is free for low volumes and non-commercial use, and paid by annual subscription beyond that. That is the Spamhaus business model: it sells access to the data to those who filter, never an exit to those who are filtered.
What to do tomorrow morning
If you are listed, identify the list first. PBL, CSS and SBL do not tell the same story and are not handled the same way. The first is almost always an architecture mistake, the last is almost always a genuine incident.
Then look for the cause before the exit. An IP removed without a fix is an IP that comes back onto the list, and repeated round trips weigh more heavily than a single listing.
Check today that your signup form is protected against automated injection. That is the most frequent cause of an incident at a company with nothing to reproach itself for, and it takes an hour to fix.
And if a provider offers you express delisting for a fee, you now know what that offer is worth. Removal is free, it always has been, and Spamhaus takes the trouble to write it with the word “never”.
Sources
- Spamhaus. Spamhaus Blocklist (SBL)
- Spamhaus. Policy Blocklist (PBL)
- Spamhaus. Marketing email FAQ
- Yahoo. SMTP error codes, Yahoo Sender Hub
- Google. Email sender guidelines, Google Workspace Admin Help
LaFactory works email on the evidence: headers, DNS records, rejection logs. No open rate promises, ever. Get in touch for a deliverability audit.