Blacklist removal guide

Spamhaus SBL removal: how to get delisted

An SBL listing means Spamhaus believes your IP is a verified source of spam, or sits in a range they have blocked. It is the most serious Spamhaus listing, and removal goes through a human-reviewed request after the cause is genuinely fixed.

Published Updated 6 min read
Spamhaus SBL, at a glanceChecked
Operator
The Spamhaus Project
Zone
sbl.spamhaus.org
Lists
IP addresses
Status
Active
Severity
Critical
Removal
request via ISP/network admin to SBL Removals: check.spamhaus.org
Cost
free
Turnaround
no SLA; zone rebuilds every 5 min once approved
Auto-expiry
n/a
Check Spamhaus SBL nowsbl.spamhaus.org

What is Spamhaus SBL?

The Spamhaus Block List (SBL) is Spamhaus's manually curated database of IP addresses and ranges observed sending spam: direct spam sources, spam operations, hijacked servers and snowshoe ranges. Unlike automated lists, most SBL entries are researched and documented by Spamhaus investigators, and each listing has a public record page describing the evidence.

There is also an automated tier inside the SBL zone: CSS (return code 127.0.0.3). CSS catches lower-grade bulk abuse such as compromised accounts, poor list hygiene at scale, or authentication abuse, and it self-expires after a few days of clean behavior. A 127.0.0.2 return code is a classic investigator-created SBL entry and will not go away on its own.

What sbl.spamhaus.org answersthe A record the zone returns for a listed query
127.0.0.2SBL: Direct spam source
127.0.0.3SBL CSS: Spamhaus Compromised Server

How serious is a Spamhaus SBL listing?

SBL data is consumed by most large mailbox providers and corporate filters, directly or via ZEN. A listing usually produces hard SMTP rejections referencing an SBL record number. If the listing covers a whole range rather than just your IP, every sender in that range is affected, which is common on providers with lax abuse handling.

Why your IP got listed

Spam sent from your IP

Purchased or scraped lists, cold blasts to unconsenting recipients, or spam-trap hits that Spamhaus investigators verified and documented.

A compromised server or account (CSS)

Leaked credentials or a hacked application pushed bulk mail through your IP. CSS exists precisely to catch this pattern quickly.

Your provider's range is listed

Spamhaus escalates to range-level listings when a hosting provider repeatedly ignores abuse. Your individual IP may be clean but caught inside the block.

How to remove your IP from Spamhaus SBL

  1. 1

    Read your listing record

    Look the IP up at check.spamhaus.org. An SBL listing links to a record (an SBL number) describing exactly why it exists. Everything in your removal request should respond to that record.

  2. 2

    Actually fix what the record describes

    Stop the offending sending, delete acquired lists, clean compromised machines, rotate SMTP and API credentials, and lock down any web forms or scripts that were abused. For CSS, this alone often clears you without a request.

  3. 3

    Submit the removal request via the lookup page

    The removal flow at check.spamhaus.org routes SBL cases to the SBL team. Explain factually what caused the listing and what you changed. If the listing belongs to your provider's range, forward the SBL record to your host's abuse desk instead; only the network owner can resolve a range listing.

  4. 4

    Confirm and monitor

    Re-check the IP after Spamhaus replies. Then keep an eye on it for the following weeks: a repeat of the same behavior brings the listing back with less goodwill attached.

  1. 01Look it upcheck.spamhaus.org
  2. 02Fix the causebefore you ask
  3. 03Request removalcheck.spamhaus.org
  4. 04Verifyno SLA

cost: free

The removal path for Spamhaus SBL, from the operator's own documentation: no SLA; zone rebuilds every 5 min once approved; expiry: n/a.

How long removal takes

CSS listings (127.0.0.3) expire on their own after roughly three days of clean behavior, and a fixed cause plus a self-service request can clear them faster. Investigator SBL listings (127.0.0.2) are handled by humans: expect several hours to a few business days after a credible removal request. Range listings clear only when the network owner acts, which can take longer.

Do not submit an SBL removal request before the cause is fixed. Spamhaus re-checks, and a bounced-back listing is treated less charitably each time. Removal is always free.
Getting off Spamhaus SBL removes a block; it does not restore the trust the providers withdrew while you were listed. If placement does not recover within a couple of weeks, the domain needs a structured re-warm, and the warmup guide for your provider has the ramp and the limits it runs against. Re-running the free blacklist checker monthly stops the next listing getting a head start.

Frequently asked questions

What is the difference between SBL and SBL CSS?

A 127.0.0.2 return code is a manually researched SBL entry with a public record, created by a Spamhaus investigator, and it persists until resolved. A 127.0.0.3 code is CSS, an automated listing for lower-grade bulk abuse that expires by itself after a few days once the behavior stops.

My IP is clean but inside a listed range. What do I do?

Only the network owner can resolve a range-level SBL. Send your hosting provider the SBL record number and ask their abuse team to work with Spamhaus. If the provider has a pattern of ignoring abuse, moving to a cleaner provider is often faster than waiting.

How do I contact Spamhaus about an SBL listing?

Through the lookup and removal flow at check.spamhaus.org. There is no email queue to jump and no paid channel; the lookup page routes your case to the SBL team with the listing context attached.

Record checked against the operator's site on ; the whole set was last reviewed on . Cells that say undocumented or not found are gaps in the operator's own material, left as they are.

Sources

Every claim above that rests on a third party links to that party's own page. Checked . If something has changed since, tell us and we will correct it.