What is Spamhaus SBL?
DNS zone: sbl.spamhaus.org
The Spamhaus Block List (SBL) is Spamhaus's manually curated database of IP addresses and ranges observed sending spam: direct spam sources, spam operations, hijacked servers and snowshoe ranges. Unlike automated lists, most SBL entries are researched and documented by Spamhaus investigators, and each listing has a public record page describing the evidence.
There is also an automated tier inside the SBL zone: CSS (return code 127.0.0.3). CSS catches lower-grade bulk abuse such as compromised accounts, poor list hygiene at scale, or authentication abuse, and it self-expires after a few days of clean behaviour. A 127.0.0.2 return code is a classic investigator-created SBL entry and will not go away on its own.
How serious is a Spamhaus SBL listing?
SBL data is consumed by most large mailbox providers and corporate filters, directly or via ZEN. A listing usually produces hard SMTP rejections referencing an SBL record number. If the listing covers a whole range rather than just your IP, every sender in that range is affected, which is common on providers with lax abuse handling.
Why your IP got listed
Spam sent from your IP
Purchased or scraped lists, cold blasts to unconsenting recipients, or spam-trap hits that Spamhaus investigators verified and documented.
A compromised server or account (CSS)
Leaked credentials or a hacked application pushed bulk mail through your IP. CSS exists precisely to catch this pattern quickly.
Your provider's range is listed
Spamhaus escalates to range-level listings when a hosting provider repeatedly ignores abuse. Your individual IP may be clean but caught inside the block.
How to remove your IP from Spamhaus SBL
Read your listing record
Look the IP up at check.spamhaus.org. An SBL listing links to a record (an SBL number) describing exactly why it exists. Everything in your removal request should respond to that record.
Actually fix what the record describes
Stop the offending sending, delete acquired lists, clean compromised machines, rotate SMTP and API credentials, and lock down any web forms or scripts that were abused. For CSS, this alone often clears you without a request.
Submit the removal request via the lookup page
The removal flow at check.spamhaus.org routes SBL cases to the SBL team. Explain factually what caused the listing and what you changed. If the listing belongs to your provider's range, forward the SBL record to your host's abuse desk instead; only the network owner can resolve a range listing.
Confirm and monitor
Re-check the IP after Spamhaus replies. Then keep an eye on it for the following weeks: a repeat of the same behaviour brings the listing back with less goodwill attached.
How long removal takes
CSS listings (127.0.0.3) expire on their own after roughly three days of clean behaviour, and a fixed cause plus a self-service request can clear them faster. Investigator SBL listings (127.0.0.2) are handled by humans: expect several hours to a few business days after a credible removal request. Range listings clear only when the network owner acts, which can take longer.
After delisting: the part most guides skip
Getting off Spamhaus SBL removes a block; it does not restore trust. While you were listed, mailbox providers were accumulating their own negative signals about your domain (bounces, spam-folder placements, dropped engagement), and those persist after the listing clears. If placement does not bounce back within a couple of weeks, the domain needs a structured re-warming: reduced volume, genuinely engaged recipients and clean authentication, sustained until providers trust the domain again.
Frequently asked questions
What is the difference between SBL and SBL CSS?
+
A 127.0.0.2 return code is a manually researched SBL entry with a public record, created by a Spamhaus investigator, and it persists until resolved. A 127.0.0.3 code is CSS, an automated listing for lower-grade bulk abuse that expires by itself after a few days once the behaviour stops.
My IP is clean but inside a listed range. What do I do?
+
Only the network owner can resolve a range-level SBL. Send your hosting provider the SBL record number and ask their abuse team to work with Spamhaus. If the provider has a pattern of ignoring abuse, moving to a cleaner provider is often faster than waiting.
How do I contact Spamhaus about an SBL listing?
+
Through the lookup and removal flow at check.spamhaus.org. There is no email queue to jump and no paid channel; the lookup page routes your case to the SBL team with the listing context attached.