How to remove your domain from SURBL

SURBL flags the domains inside your mail, not your sending IP. Here is what a listing means, and how to get your domain removed.

Check your domain free → SURBL removal tool ↗

What it is

The list, in plain terms.

SURBL is a URI blocklist run by SURBL BV, which has operated since 2004. Unlike an IP blocklist, it lists the domains and hostnames that appear in the body of a message — the links a recipient would click — rather than the server that sent the mail. Filters such as SpamAssassin extract the domains from a message and query SURBL to decide whether the content points at spam, phishing or malware.

The public data is published through a single zone, multi.surbl.org, which bundles every SURBL list into one bitmasked lookup. A filter runs one query and gets back one return code whose value encodes each sub-list the domain sits on, so a single answer can say a domain is on several lists at once.

Because SURBL flags the domain in the message, a listing follows that domain everywhere it is used — across senders, IPs and mail streams — until the cause is cleaned and the domain is removed. Which sub-list triggered the listing decides how you fix it, so the first job is to read the return code.

Why you get listed

What a listing on SURBL means.

AB — abused site (127.0.0.64) The domain is advertised in unsolicited mail or tied to abused categories SURBL tracks — pills, counterfeits, dating and similar spam-promoted content. This is the broadest listing and usually reflects how the domain is being promoted.

PH — phishing (127.0.0.8) The domain is hosting or serving a phishing page, sourced from feeds including PhishTank and URLAbuse plus SURBL research. Often the result of a compromised site being used to harvest credentials.

MW — malware (127.0.0.16) The domain is distributing malware, drawn from feeds such as abuse.ch and URLAbuse. As with phishing, a legitimate site is frequently the victim of a compromise rather than a deliberate bad actor.

CR — cracked (127.0.0.128) The site has been broken into — criminals are exploiting a vulnerability in the CMS or stealing credentials. The listing is a signal that your own site needs securing, not that you sent spam.

How to get removed

Delisting, in order.

Removal is free. Fix the cause first — a listing you clear without a fix comes straight back.

1 Look up the domain and read the return code. Enter the domain at surbl.org/lookup. The multi zone is bitmasked, so the return code tells you which sub-list flagged it: 127.0.0.8 is phishing, 127.0.0.16 is malware, 127.0.0.64 is abuse, 127.0.0.128 is cracked, and combined values are the sum. Do not act until you know which list you are on.
2 Fix the cause before you ask for removal. For phishing, malware and cracked listings, remove the malicious pages, clean any infection, patch the vulnerability and secure the accounts that were abused — a professional audit is worth it if the site was compromised. For abuse listings, stop the spam-advertised promotion. SURBL will not remove a domain while the problem is still present.
3 Submit the removal request. From the surbl.org/lookup page, follow the instructions on the removal form to request delisting. Removal is free and handled by SURBL directly. Provide the domain and be ready to show the cause is resolved, since requests made before the site is clean are declined.
4 Re-check before you rely on the domain again. Allow time for the change to propagate, then query surbl.org/lookup again to confirm the domain no longer resolves in the multi zone before you resume sending mail that references it.

The official route

Straight to the source.

Removal happens on SURBL's own tool — never through a paid service.

SURBL removal tool ↗

Return codes

127.0.0.4 DM — disposable mail domain

127.0.0.8 PH — phishing site

127.0.0.16 MW — malware site

127.0.0.32 CT — click-tracker domain

127.0.0.64 AB — abused / spam-advertised site

127.0.0.128 CR — cracked / compromised site

127.0.0.126 Test point — the built-in test record, not a real listing

How long it takes

SURBL does not publish a fixed removal timeframe. Requests are reviewed against whether the cause is actually resolved, so the effective wait is however long it takes SURBL to confirm the site is clean, plus the DNS TTL for the change to propagate to filters. Request removal before you have fixed the cause and it will be declined; fix it first and a clean domain clears on the next review.

Common questions

About SURBL, specifically.

Does SURBL charge to remove my domain? No. Removal is free through the form on surbl.org/lookup. Any third party offering to remove a SURBL listing for a fee is a scam — nobody outside SURBL can influence or speed up a removal.

SURBL lists domains, not IPs — what does that mean for me? SURBL checks the domains and links inside a message, not the server that sent it. Changing your sending IP will not help. You have to clean the listed domain itself and request its removal, because the listing follows the domain wherever it appears.

Why is my domain on SURBL if I only send legitimate mail? The most common reasons are a compromise — a phishing page, malware or a cracked CMS on your site that you may not know about — or the domain appearing in spam. Look it up at surbl.org/lookup, read the return code to see which sub-list flagged it, and treat a phishing, malware or cracked listing as a security incident.

How long does SURBL removal take? SURBL does not publish a fixed timeframe. Requests are reviewed manually and clear once SURBL can confirm the cause is resolved, after which you still need to allow for DNS propagation. Submitting before the site is clean only delays things, since the request is declined.

I fixed my site but the domain is still listed — why? Either the fix was incomplete and the malicious content or infection is still detectable, or you have not yet submitted the removal request. Confirm the site is fully clean, remove every phishing or malware page and secure the compromised accounts, then request removal at surbl.org/lookup.

What does a multi.surbl.org return code mean? multi.surbl.org is bitmasked: each sub-list has a value and the code you get back is the sum of the lists the domain is on. 127.0.0.8 is phishing, 127.0.0.16 is malware, 127.0.0.64 is abuse and 127.0.0.128 is cracked, so 127.0.0.80 means both malware and abuse (16 + 64). Fix each flagged component before requesting removal.

The bounce behind the listing.

554 5.7.1 message rejected → The permanent bounce a listing most often triggers — what it means and how to clear it. 550 5.7.1 blocked → A rejection on reputation grounds — usually the same listing, seen from the sender side. Blacklist checker → Re-check your domain and every sending IP once the cause is fixed.

Do not fix it blind.

See every list you are on and every authentication problem behind the listing in one 40-second check — then let monitoring tell you the day a listing comes back.

Check your domain free → See monitoring