Your domain is on a Spamhaus blacklist. Here is how to get it off.

If your free scan flagged your domain on a Spamhaus list, it means at least one major mail provider, like Gmail, Outlook, or Apple Mail, will treat email from your domain as suspect. That's why customer replies are bouncing or vanishing into junk folders.

Spamhaus is the largest of the public block lists, and a single listing on it can wreck deliverability across most of the inbox providers your customers use. The good news: most listings come from one of three causes, all of which are fixable inside an afternoon.

#What Spamhaus actually flags

Spamhaus runs several block lists, but the two that affect most small businesses are:

1. SBL (Spamhaus Block List): lists IP addresses that have sent confirmed spam.
2. DBL (Domain Block List): lists domain names that have appeared in spam, hosted malware, or shown other abusive behaviour.

Your scan will tell you which list flagged you. The remediation steps differ slightly between them, so check the listing detail before acting.

#The three usual causes

#1. A compromised mailbox is sending spam

This is by far the most common reason a small business gets listed. An employee's password leaks in a third-party data breach, attackers log into their email, and start sending phishing or scam mail using your domain. Your reputation gets blamed.

What to do:

• Force a password reset on every mailbox that uses your domain.
• Turn on multi-factor authentication for all of them. No exceptions.
• Check sent-mail folders and filter rules for anything you don't recognise.
• If your provider supports it, review the mailbox's recent sign-in locations.

#2. Your SPF or DMARC records let other senders impersonate you

If your DNS lets anyone send mail "From: [email protected]" and you have no DMARC policy in place, scammers will use your domain in their phishing campaigns. Spamhaus eventually notices.

What to do:

• Publish a strict SPF record that lists only the mail servers actually allowed to send for you.
• Add a DKIM signing key from your real mail provider.
• Publish a DMARC record set to p=quarantine or p=reject once SPF and DKIM are confirmed working.

The free scan checks all three. The technical report we generate gives the exact DNS records you need to add.

#3. Your hosting IP is shared with a known bad neighbour

If you're on cheap shared hosting and another customer on the same IP gets listed, you can be caught up in the same range. This is rarer but it happens.

What to do:

• Send mail through a dedicated transactional provider (Postmark, AWS SES, Brevo, Mailgun) instead of through the web host's default mail server.
• If you absolutely must send from your hosting account, ask the host to move you to a different IP.

#How to request delisting

Once you've fixed the cause, you can request removal directly:

1. Go to lookup.spamhaus.org and search for your domain or IP.
2. Click the listing details. Spamhaus will show what triggered the listing and roughly when.
3. Use the "Request Removal" form on that page. Be honest about what was wrong and what you've done about it.
4. Spamhaus typically responds within 24 hours. They will not delist you if the underlying problem is still active, so do step one before requesting removal.

Don't bother with paid "blacklist removal services" you might see advertised. Spamhaus removal is free and you don't need an intermediary.

#How to make sure it doesn't happen again

Once you're delisted:

• Set up DMARC reports going to a service like Postmark's free DMARC monitor or dmarc.report. You'll see attempted forgeries before Spamhaus does.
• Run a full scan every quarter so SPF, DKIM, and DMARC don't drift when you change mail provider or add a new sending tool.
• Train your team to spot phishing emails. Most compromised mailboxes start with one careless click.

#Run a free scan

Run our free scanner on your domain and you'll see in 30 seconds whether you're currently listed, what your SPF and DMARC look like, and which fixes will protect you from being relisted.