Getting off a blocklist
Mail starts bouncing, and a bounce message names a list you have never heard of. Here is how to deal with it in the right order.
Read the bounce
The rejection almost always names the list and gives a URL. That is the single most useful piece of information you have — different lists exist for completely different reasons, and the fix depends on which one you are on.
Check what else is listed:
dig +short 50.2.0.192.zen.spamhaus.org
That is the address reversed, with the list's domain appended. Any answer means
listed; NXDOMAIN means not listed. Most lists work this way, and most
have a web lookup if you would rather not reverse octets by hand.
Work out why, before asking for removal
Listings are symptoms. The usual causes, in the order we see them:
- A compromised application sending through a web form or an exploited CMS. Check your mail queue for messages nobody wrote.
- An open relay or an open submission port. Test it from outside.
- A compromised account whose password turned up in a breach, now being used to send through you.
- Legitimate mail sent badly — no PTR, no SPF, no DKIM, to a list you did not clean.
- History attached to the address, from before it was yours. This one is not your fault and is usually the quickest to resolve.
If you cannot find the cause, assume compromise and work through what to do with a compromised server before anything else.
Then ask for delisting
Most lists have a self-service removal form and most will remove a first-time listing straight away. Some are automatic once the behaviour stops; some need a short explanation. Be factual: what happened, what you changed, when. Nobody running a blocklist is impressed by indignation, and a request that does not describe a fix tends to be refused.
Do not request removal while the cause is still live. A second listing is harder to clear than the first, and a pattern of listing and delisting is itself a signal.
Reputation lists are different
Large providers also run their own internal reputation systems, which are not public lists and have no delisting form. These recover with time and consistent behaviour: low volume, clean recipients, correct authentication, no complaints. Expect days to weeks, not minutes, and do not try to force it by sending more.
Where we come in
If the listing refers to our address space rather than specifically to your machine, send us the detail and we will deal with the list. If it is your machine and your traffic, the fix is yours — but tell us anyway. We would rather hear it from you than from an abuse report, and we can confirm from our side whether something is still leaving the machine.
Prevention is in sending mail from your server and reverse DNS. Nearly every listing we see would have been prevented by one of those two pages.
Still stuck? Mail support@novogara.com — an engineer answers, at any hour. Back to the knowledge base