Kennisbank
IP blacklisting: which lists matter, how delisting works and what it costs
An IP blocklist, or blacklist, is a list of addresses that receiving systems refuse or treat with suspicion, most often because they sent spam or show signs of compromise. Some lists cover whole ranges or networks rather than single addresses, and a listing can stay with an address when it passes to its next holder, so a block's history matters as much as its use. Most listings end for free once the cause has stopped.
How a blocklist works
Most blocklists answer over DNS. A mail server that receives a connection from 192.0.2.99 asks the list for 99.2.0.192. followed by the list's zone: an answer such as 127.0.0.2 means listed, no answer means not listed, and a text record usually gives the reason, which often ends up in the rejection message. RFC 5782 sets out the convention.
Not everything called a blacklist works that way:
| Kind | How it answers | Examples |
|---|---|---|
| DNS blocklist | Listed or not, per address or range | Spamhaus, SpamCop, UCEPROTECT, Barracuda |
| Reputation score | A graded score | Cisco Talos, from -10 to +10; AbuseIPDB, from 0 to 100 |
| Threat feed | A list firewalls and routers use to drop all traffic, not only mail | Spamhaus DROP, Spamhaus BCL |
| Classification | A label such as hosting, VPN or proxy, not a judgment of abuse | MaxMind's anonymous IP data, AWS WAF's hosting provider list |
Leased space most often runs into the last kind. A block with no abuse record can still be labeled as hosting space and refused by a streaming service or a website behind a firewall that filters on that label.
What gets an address listed
| Cause | Lists it feeds |
|---|---|
| Mail to spam traps | UCEPROTECT Level 1, PSBL, Abusix |
| Recipients reporting mail as spam | SpamCop |
| A compromised machine: malware, brute-force logins, a proxy app | Spamhaus XBL, Abusix |
| Low-reputation bulk mail, poor list hygiene, a misconfigured server | Spamhaus CSS, invaluement |
| Spam operations and the hosting that supports them | Spamhaus SBL, which can widen a listing to a whole network |
| Ranges taken over or leased by criminal operations | Spamhaus DROP and its list of ASNs |
| End-user space that should not send mail directly | Spamhaus PBL, which says its entries are "not necessarily 'bad'" |
| Port scans and attacks on the list's own network | UCEPROTECT Level 1 |
| Brute-force and other attacks reported by servers that take part | blocklist.de |
| A previous holder's behavior | Any list that has not cleared the listing |
Single addresses, ranges and whole networks
Most lists name single addresses. Several work at a larger scale:
- Spamhaus SBL lists "both individual IPs and IP ranges" and can extend a listing to a network's own infrastructure.
- Spamhaus PBL and DROP list ranges.
- UCEPROTECT Level 2 lists a whole allocation once it collects enough Level 1 hits within seven days: four, for a /24.
- UCEPROTECT Level 3 lists every address announced by an ASN with too many listings, so the same block can be listed under one network and clean under another.
- invaluement has a list of whole /24s.
A clean block can therefore be listed because of its neighbors or the network that announces it.
The lists that matter in 2026
| List | How a listing ends |
|---|---|
| Spamhaus SBL, CSS, XBL, PBL, DROP | SBL: only the network operator can ask for removal. CSS: about three days after the last spam, or self-removal. XBL: automatically, once the behavior stops. Never a fee |
| Barracuda BRBL | A removal request, usually handled within 12 hours |
| SpamCop, run by Cisco | Automatically, 24 hours after the last report |
| UCEPROTECT Levels 1 to 3 | Level 1: seven days after the last spam trap hit. Levels 2 and 3: once the criteria no longer match. Faster removal for a fee |
| Microsoft blocked senders | Self-service at its delist portal, which can take up to 24 hours or longer |
| Proofpoint and Cloudmark | A request through its lookup |
| Abusix | Self-service after registering; listings otherwise expire about five days after the last bad event |
| Mailspike | A request form, handled within 6 to 36 hours |
| PSBL | Anyone can remove an address, for free |
| AbuseIPDB, run by Marathon Studios | A score from user reports that decays over time; there is no delisting |
| blocklist.de | A delist page |
Lists close and merge. SORBS was shut down on 5 June 2024, NiX Spam closed in January 2025, the CBL became part of Spamhaus XBL in 2021, Spamhaus folded EDROP into DROP on 10 April 2024, and its Blocklist Removal Center has been the IP and Domain Reputation Checker since 4 March 2021. A checker that still reports SORBS is out of date.
Getting delisted
- Find the cause and stop it first. A request for an address that is still sending spam is refused, and repeated requests are often ignored.
- Use the list's own process, from the table above. A list that names a network, such as an SBL listing, takes its request from the network operator, not from the end user.
- Do not pay a third party. Spamhaus never charges, and says any offer to remove a Spamhaus listing for a fee is a scam. Where a fee exists, the list itself sells it: UCEPROTECT charges 89 CHF to delist one address from Level 1 at once, 249 CHF for an allocation and 449 CHF for an ASN, all optional, since the listings also expire for free.
- Wait for the list's own timing. SpamCop clears after 24 hours, Spamhaus CSS after about three days, Abusix after about five, UCEPROTECT Level 1 after seven.
Checking a block
| Tool | What it checks |
|---|---|
| Spamhaus IP and Domain Reputation Checker | Every Spamhaus list, for IPv4, IPv6 and domains |
| MXToolbox | Over a hundred DNS blocklists, with monitoring on its plans |
| MultiRBL | Hundreds of lists, for IPv4, IPv6 and domains |
| HetrixTools | Some 60 IP lists, IPv4 only, with monitoring from once a day |
| UCEPROTECT | Its three levels, and whether a range or the ASN is listed |
| AbuseIPDB | Reports against an address, and a /24 at once through its API |
| Microsoft SNDS | Outlook.com data for addresses you have proven you control; access lapses after ten months |
Check through your own resolver: Spamhaus answers queries that come through public DNS resolvers with 127.255.255.254, which is a refusal, not a listing. Before you take a block, check every address in it, the range and the network that will announce it; the rest of what to look at is in checking a block before you buy it, and how to keep it clean is in IP reputation management.
How often to check
No standard sets an interval, so ours follows from how long listings last. At least once a day: SpamCop clears a listing after a day and Spamhaus CSS after about three, so a weekly check can miss one entirely. Every few hours for addresses that send mail. What matters most is that a new listing reaches someone who acts on it.
Where RTM Networks fits
We check every IPv4 address we hold against blocklists every day. A block we lease to you is checked before you get it and monitored while you have it, and we monitor blocks for other companies too, with a report of their listings: see blacklist monitoring, and ask us if you would like it for yours.
Contact
Uw IP-ruimte schoon houden?
Vertel ons welke ranges u gemonitord wilt hebben en hoe abuse-meldingen naar uw klanten moeten worden gerouteerd. Wij reageren meestal in 1-3 kantooruren.
