- Operator
- The Spamhaus Project
- Zone
- sbl.spamhaus.org
- Lists
- IP addresses
- Status
- Active
- Severity
- Critical
- Lookup
- check.spamhaus.org
- Removal
- request via ISP/network admin to SBL Removals: check.spamhaus.org
- Cost
- free
- Turnaround
- no SLA; zone rebuilds every 5 min once approved
- Auto-expiry
- n/a
What is Spamhaus SBL?
The Spamhaus Block List (SBL) is Spamhaus's manually curated database of IP addresses and ranges observed sending spam: direct spam sources, spam operations, hijacked servers and snowshoe ranges. Unlike automated lists, most SBL entries are researched and documented by Spamhaus investigators, and each listing has a public record page describing the evidence.
There is also an automated tier inside the SBL zone: CSS (return code 127.0.0.3). CSS catches lower-grade bulk abuse such as compromised accounts, poor list hygiene at scale, or authentication abuse, and it self-expires after a few days of clean behavior. A 127.0.0.2 return code is a classic investigator-created SBL entry and will not go away on its own.
| 127.0.0.2 | SBL: Direct spam source |
| 127.0.0.3 | SBL CSS: Spamhaus Compromised Server |
How serious is a Spamhaus SBL listing?
SBL data is consumed by most large mailbox providers and corporate filters, directly or via ZEN. A listing usually produces hard SMTP rejections referencing an SBL record number. If the listing covers a whole range rather than just your IP, every sender in that range is affected, which is common on providers with lax abuse handling.
Why your IP got listed
Spam sent from your IP
Purchased or scraped lists, cold blasts to unconsenting recipients, or spam-trap hits that Spamhaus investigators verified and documented.
A compromised server or account (CSS)
Leaked credentials or a hacked application pushed bulk mail through your IP. CSS exists precisely to catch this pattern quickly.
Your provider's range is listed
Spamhaus escalates to range-level listings when a hosting provider repeatedly ignores abuse. Your individual IP may be clean but caught inside the block.
How to remove your IP from Spamhaus SBL
- 1
Read your listing record
Look the IP up at check.spamhaus.org. An SBL listing links to a record (an SBL number) describing exactly why it exists. Everything in your removal request should respond to that record.
- 2
Actually fix what the record describes
Stop the offending sending, delete acquired lists, clean compromised machines, rotate SMTP and API credentials, and lock down any web forms or scripts that were abused. For CSS, this alone often clears you without a request.
- 3
Submit the removal request via the lookup page
The removal flow at check.spamhaus.org routes SBL cases to the SBL team. Explain factually what caused the listing and what you changed. If the listing belongs to your provider's range, forward the SBL record to your host's abuse desk instead; only the network owner can resolve a range listing.
- 4
Confirm and monitor
Re-check the IP after Spamhaus replies. Then keep an eye on it for the following weeks: a repeat of the same behavior brings the listing back with less goodwill attached.
- 01Look it upcheck.spamhaus.org
- 02Fix the causebefore you ask
- 03Request removalcheck.spamhaus.org
- 04Verifyno SLA
cost: free
How long removal takes
CSS listings (127.0.0.3) expire on their own after roughly three days of clean behavior, and a fixed cause plus a self-service request can clear them faster. Investigator SBL listings (127.0.0.2) are handled by humans: expect several hours to a few business days after a credible removal request. Range listings clear only when the network owner acts, which can take longer.
Frequently asked questions
What is the difference between SBL and SBL CSS?
A 127.0.0.2 return code is a manually researched SBL entry with a public record, created by a Spamhaus investigator, and it persists until resolved. A 127.0.0.3 code is CSS, an automated listing for lower-grade bulk abuse that expires by itself after a few days once the behavior stops.
My IP is clean but inside a listed range. What do I do?
Only the network owner can resolve a range-level SBL. Send your hosting provider the SBL record number and ask their abuse team to work with Spamhaus. If the provider has a pattern of ignoring abuse, moving to a cleaner provider is often faster than waiting.
How do I contact Spamhaus about an SBL listing?
Through the lookup and removal flow at check.spamhaus.org. There is no email queue to jump and no paid channel; the lookup page routes your case to the SBL team with the listing context attached.
Record checked against the operator's site on ; the whole set was last reviewed on . Cells that say undocumented or not found are gaps in the operator's own material, left as they are.