Blocked using Spamhaus: how to diagnose and get delisted
Blocklistblocklistaction: pause
This means the receiving server queried Spamhaus, found your sending IP listed, and refused the connection. Delisting is straightforward and usually fast, but it is pointless until the source is fixed, because Spamhaus will relist you.
A CSS listing usually points at snowshoe-style patterns or poor list hygiene rather than outright abuse, and PBL simply means the IP is in a range the owner has declared should not be sending mail directly. Reading which list you are on tells you most of what you need to know before you touch the removal form.
What it looks like in the log
550 5.7.1 Service unavailable; Client host [x.x.x.x] blocked using Spamhaus; https://www.spamhaus.org/query/ip/x.x.x.x554 5.7.1 Service unavailable; Client host [x.x.x.x] blocked using zen.spamhaus.orgWhy it happens
- Spam traps hit, which usually means old or purchased addresses in the list.
- A compromised account or script sending through your infrastructure.
- An open relay or a misconfigured form that lets third parties send through you.
- The listing is on an IP range you inherited rather than on your own sending.
What to do
- Look up the IP on Spamhaus and read which list it is on. SBL, CSS, XBL and PBL mean very different things.
- Find the emitting source before requesting removal. Check for compromised credentials, scripts, and unexpected traffic in the MTA logs.
- Request delisting once, describing what you fixed. Repeated requests without a fix damage your standing with them.
- Move production traffic off the listed range while you work it, so delivery continues.
Related
Blocklist check checks the address against the lists that produced this refusal, and confirms each list is answering correctly first. Open blocklist check