Guide · How-to
Is your mail server on a blocklist? Check it, then get off it.
Messages to certain recipients suddenly stop arriving, and the error mentions “listed” or “blocked”. Usually your mail server’s address is then on a blocklist. You can check this for free and usually fix it.
By Paul Czichos, consulting and project support at czichos.net GmbH · Updated
How you notice
Spotting a blocklist listing. Blocklists rarely announce themselves.
A blocklist, also called a blacklist, records addresses that have sent spam. Mail servers check every incoming message against it and reject the sender if listed.
Typical signs:
- Bounces with phrases like “blocked using”, “listed at” or a reference to a blocklist.
- Messages to some providers no longer arrive, while others still do.
- Recipients suddenly find your messages in their spam folder. The guide to association emails going to spam covers other reasons.
The cause is almost always in-house, such as a mailbox with a stolen password, an infected computer or a contact form without spam protection. Less often, you share the address with someone who sends spam.
How to check
Checking a blocklist. Four steps to a diagnosis.
Everything here is free. All you need is the address your messages are sent from.
-
Step 1: Find the sending address
View the headers of one of your messages on the recipient’s side. The lowest “Received: from” line with a public IP address is your mail server. If your mailbox is hosted by a provider, the address belongs to them, and they are your point of contact.
-
Step 2: Look it up with an aggregator
Services such as MXToolbox or MultiRBL query dozens of blocklists at once. A listing on a large, widely used list weighs more than one on a small list hardly anyone uses.
-
Step 3: Check Spamhaus directly
Spamhaus is the most influential blocklist and does not answer, or answers wrongly, queries made through large public DNS resolvers. A “not listed” from a random online test is therefore not always reliable. Check directly on the Spamhaus website.
-
Step 4: Check reverse DNS and reputation
Your sending address should have a matching name (reverse DNS, PTR record) that points back to the same address. Google’s free Postmaster Tools show your reputation there, Microsoft’s SNDS programme does the same for Outlook.
dig -x 203.0.113.25 +short mail.your-association.org.
Getting delisted
Getting delisted from a blocklist. Fix the cause first, then apply.
Without fixing the cause, you will be back on the list a few days after delisting, and the second delisting takes longer.
-
Step 1: Find and fix the cause
Change the passwords of affected mailboxes, switch on two-factor authentication, check computers and secure open forms. The mail server logs show which account sent unusually much.
-
Step 2: Request delisting
Every blocklist has its own form. Many listings also expire by themselves once the spam stops. Microsoft has its own delisting form for Outlook.com and Hotmail.
-
Step 3: Beware of paid delisting
A few lists offer express delisting for a fee, the large, widely used lists do not. Check first whether the list matters to your recipients at all.
-
Step 4: Notice earlier next time
A regular automatic check reports a listing before the bounces start. That can be a free service or blocklist monitoring such as secMonitor. If you run your own mail system, hijacked accounts should also be stopped automatically, as secMail’s sending does.
Do it yourself or have it monitored
Monitoring blocklists yourself? One server is easy to check yourself.
If you run a mail server, you can run the check regularly with free tools. With several servers and branches, a service that raises the alarm pays off.
Check it yourself
If you run one mail server
- Free monitoring from aggregatorsSome aggregators check one address regularly in their free tier and report a listing by email.
- Postmaster Tools and SNDSShow for free how Google and Microsoft see your mail. Set them up once, look in once a month.
- A script of your ownOne DNS query per blocklist, once an hour, through your own DNS resolver instead of a public one.
Have it monitored
If email is business-critical for your organisation
- Several servers and addressesEvery outgoing address and every hostname needs checking, on many lists and around the clock.
- More than blocklistsA message can get stuck without any listing. Only a test message that really has to arrive shows whether the route works.
- Someone has to read the alertThat needs clear responsibility.
On our own behalf: we earn money from the second column. If your association runs a single mail server, the free services and a look at Postmaster Tools are enough. If your mailboxes are hosted by a provider, they take care of it.
Common questions
Blocklist FAQ. What associations ask.
How do I check whether my mail server is on a blocklist?
Find the public IP address your messages are sent from and look it up with an aggregator such as MXToolbox or MultiRBL. Also check Spamhaus directly on its website, because queries through public DNS resolvers are not answered reliably there.
Why is my server on a blocklist?
Usually spam came from it, via a mailbox with a stolen password, an infected computer or an unprotected form. Sometimes a matching reverse DNS record is simply missing, or the address comes from a range meant for home connections.
How long does delisting take?
It depends on the list. Some listings disappear within hours once the spam stops, others within a day or two of a request. Repeat listings take longer.
Our mailboxes are hosted by a provider. Do we need to do anything?
The mail server addresses then belong to the provider, who deals with blocklists. Report bounces that mention a blocklist to them. You still need to set up SPF, DKIM and DMARC for your domain correctly, as described in the guide to SPF, DKIM and DMARC.
Mail server monitoring with secMonitor
secMonitor checks your mail servers hourly against around 60 blocklists per IP address, through its own DNS resolver so that Spamhaus answers correctly too. Every five minutes a test message runs and its delivery time is measured. When a status changes, you get an email, and the history stays traceable.
Bounces saying “listed”? We’ll take a look.
Send us the error message and briefly describe how you send email. We will tell you what is behind it and whether ongoing monitoring is worth it.
No obligation and no contract. We usually reply within one working day and are happy to show you the tool in a short call.
Prefer to reach us directly? Send an email · call 030 994048000