How to remove your IP from Spamhaus ZEN

ZEN is the blocklist most receivers actually consult. Here is what a listing means, and how to get off it.

Check your domain free → Spamhaus ZEN removal tool ↗

What it is

The list, in plain terms.

Spamhaus ZEN is a single DNS zone (zen.spamhaus.org) that bundles all of Spamhaus's free IP blocklists into one lookup: the SBL, CSS, XBL — which carries the data formerly published as the CBL — and the PBL. A receiver runs one query and gets one answer per list the IP is on, each with its own return code.

That efficiency is why ZEN is the flagship. It is one of the most widely consulted blocklists on the internet, so an IP on ZEN can have its mail deferred or rejected across a large share of the world's inboxes until the cause is fixed and the listing cleared.

ZEN lists IP addresses, not domains — it is your sending server that is flagged, not the domain in your message. Which underlying list triggered the listing decides how you get off it, so the first job is always to find out which one.

Why you get listed

What a listing on Spamhaus ZEN means.

SBL — a spam source The IP or its range is tied to sending spam, hosting spam services, or an operation Spamhaus tracks. This is an evidence-based spam listing and the most serious to resolve.

CSS — spam behaviour Combined Spam Sources: automatically detected snowshoe patterns and compromised or poorly configured sending infrastructure. Published within the SBL data.

XBL — a compromised machine An exploited, malware-infected or hijacked host, or an open proxy or relay. It means a machine on that IP is being abused — not that you deliberately sent spam. This is the ex-CBL data.

PBL — a policy listing The IP sits in a range that should not send mail directly to MX servers, typically dynamic or residential space. It is not a spam listing. You only need PBL removal if you actually run a mail server on that IP.

How to get removed

Delisting, in order.

Removal is free. Fix the cause first — a listing you clear without a fix comes straight back.

1 Find out which list you are on. Look the IP up at check.spamhaus.org. ZEN bundles four lists and the fix differs for each, so do not act until you know whether it is SBL, CSS, XBL or PBL — the checker and the DNS return code both tell you.
2 Fix the cause before you ask for removal. Clean the malware or close the open relay for XBL; stop the spam and secure the abused account for SBL and CSS; for PBL, route mail through your provider's authenticated submission server instead of direct-to-MX. Remove yourself before the cause is gone and the automated lists put you straight back.
3 PBL and XBL: remove yourself. PBL removal is self-service and only appropriate if you run a legitimate mail server on the IP. XBL and CSS clear through the same checker once the machine is clean — one request covers both. Self-removal is blocked while the abuse is still detected, or while the IP is also on the SBL.
4 SBL: your ISP or ESP has to request it. SBL removal is not self-service. The provider that controls the IP must request it after the abuse is permanently resolved, and you cannot clear the other lists on that IP until the SBL listing is gone. Contact your provider's abuse desk with what you fixed.
5 Re-check before you resume sending. Allow about 15 minutes for DNS to propagate, then confirm the listing is gone at check.spamhaus.org before you ramp sending back up.

The official route

Straight to the source.

Removal happens on Spamhaus ZEN's own tool — never through a paid service.

Spamhaus ZEN removal tool ↗

Return codes

127.0.0.2 SBL — known spam source

127.0.0.3 CSS — combined spam sources, within the SBL data

127.0.0.4 XBL — exploited or compromised machine (ex-CBL)

127.0.0.9 DROP / EDROP — returned alongside 127.0.0.2

127.0.0.10 / .11 PBL — IP should not send direct-to-MX (policy, not spam)

How long it takes

PBL and clean-machine XBL/CSS removals are self-service and take effect within minutes — allow about 15 minutes for DNS to propagate. SBL removals are manual: they depend on the abuse being resolved and your provider requesting removal, with no fixed timeframe. Delist without fixing the cause and the automated lists re-add the IP as soon as the behaviour reappears.

Common questions

About Spamhaus ZEN, specifically.

Does Spamhaus charge to remove my IP? No. Removal is always free, at check.spamhaus.org. Any service offering to remove a Spamhaus listing for a fee is a scam — no third party can influence or speed up a Spamhaus removal.

How long does Spamhaus removal take? PBL and clean-machine XBL/CSS removals are self-service and take minutes, plus about 15 minutes for DNS to propagate. SBL removals are manual and have no fixed timeframe — they wait on the abuse being fixed and your provider requesting removal.

Why am I on the PBL if I never sent spam? The PBL is a policy list, not a spam list. Your IP is in a range not expected to send mail directly to other servers, usually dynamic or residential space. Send through your provider's authenticated submission server instead, or request the self-service exclusion if you genuinely run a mail server there.

Can I remove my own IP from the SBL? No. SBL removal is not self-service. The ISP or ESP that controls the IP must request it after the abuse is permanently fixed, and you cannot clear the other lists on that IP until the SBL listing is gone.

I delisted but got relisted — why? Because the cause was still there. The automated lists re-add an IP the moment the bad behaviour is detected again. Removal is not a fix: clean the compromise, stop the spam, or change how you route mail first, then delist.

My IP is on ZEN — which list do I actually fix? Look it up at check.spamhaus.org. The return code tells you: 127.0.0.2 is SBL, .3 is CSS, .4 is XBL, .9 is DROP/EDROP, and .10 or .11 is PBL. Fix each listed component with its own procedure.

The bounce behind the listing.

554 5.7.1 message rejected → The permanent bounce a listing most often triggers — what it means and how to clear it. 550 5.7.1 blocked → A rejection on reputation grounds — usually the same listing, seen from the sender side. Blacklist checker → Re-check your domain and every sending IP once the cause is fixed.

Do not fix it blind.

See every list you are on and every authentication problem behind the listing in one 40-second check — then let monitoring tell you the day a listing comes back.

Check your domain free → See monitoring