Suppose you have set up a mail server, prepared an important B2B email campaign with commercial proposals for client leads, or launched automated order notifications for an online store. But suddenly, emails stop reaching recipients, and terrifying errors start piling up in your mail server logs (/var/log/mail.log): 554 5.7.1 Service unavailable; Client host [IP] blocked using Spamhaus or 451 Blocked due to spam history.

This signifies the absolute worst-case scenario for a mail administrator: your server's IP address has been blacklisted (RBL / DNSBL).

In this guide, we will walk through a step-by-step algorithm: how to check an IP address across global databases, isolate the source of the spam leak on your server, and successfully complete the delisting process (removal from blacklists).

Key Takeaways: Main Points About Blacklists

• Fix the root cause before applying for delisting: Attempting to request removal before the spam stream on your server has completely stopped will lead to a permanent IP ban with no right to appeal.

• Look for hidden web shells: In 90% of cases, new VPS blockages are caused by compromised WordPress/Joomla sites through vulnerable plugins sending spam via local PHP scripts.

• Spamhaus is the most authoritative authority: Being listed on Spamhaus (SBL/XBL/PBL) completely blocks email delivery to 80% of corporate inboxes globally. Clearing this database is priority #1.

• Configure DKIM, SPF, and DMARC: Without these cryptographic DNS records, your IP address's reputation will remain vulnerable to any traffic fluctuations.

1. Express Diagnostics: Where and How to Check Your IP?

If you notice drops in email deliverability, the first step is to conduct a full technical reputation audit of your address across key global DNSBL databases. There is no need to check every site manually—use specialized aggregators:

• MXToolbox (Blacklist Check): The absolute industry standard. Checks your IP against over 100 databases simultaneously and shows the exact reason for the block.

• Spamhaus IP Checker: The official tool by Spamhaus. If MXToolbox flags a red mark next to this database, go directly to the official Spamhaus website to determine the specific listing type (e.g., SBL — direct spam, XBL — botnet/virus on server, CSS — bad mailer settings).

2. Finding and Fixing the Spam Leak on the Server

Before hitting the "Request Removal" button, you must guarantee that your server is no longer sending a single spam packet. Otherwise, you risk getting your address permanently blocked. Let's cover three major technical causes for IP blacklisting and how to fix them.

Cause A. CMS Compromise and Hidden PHP Scripts

If your server hosts websites (especially WordPress), hackers might have uploaded a malicious script into the uploads folder to dispatch millions of emails, bypassing the standard mail server via PHP's built-in mail() function. Many users have suffered from such actions and had to request an IP change from their provider, but that won't help until the root cause is eliminated.

How to isolate:

Access your server via SSH and inspect the mail agent's current queue. If you use Postfix, run:

mailq

If the output shows thousands of queued emails to unknown @gmail.com or @hotmail.com addresses, your server is actively spamming.

To identify which specific local script is generating this avalanche, inspect the headers of any stuck email using its queue ID:

postcat -q EMAIL_ID | grep -E "X-PHP-Originating-Script|pwd"

The X-PHP-Originating-Script header or pwd (working directory) path will point directly to the directory and filename of the PHP file initiating the mailing. Immediately remove this file, patch the plugin vulnerability, and completely purge the spam queue:

postsuper -d ALL

Additionally, during the investigation, you can temporarily block the outbound mail port to guarantee the safety of both your IP and the entire server.

Cause B. Open Relay

Your mail server is improperly configured, allowing any spammer on the internet to use it as a free transit gateway to send their emails.

How to check and fix:

Run an online "Open Relay Test" on MXToolbox. Normally, your server should respond with Relay denied to any unauthorized attempt to relay emails from an external address to another external address.

If the server turns out to be an open relay, open the Postfix configuration file (/etc/postfix/main.cf) and make sure restriction parameters strictly regulate authorization:

smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination

Restart the mail service:

sudo systemctl restart postfix

Cause C. Missing or Misconfigured DNS Records

Spam filters automatically blacklist IPs if the server cannot prove its legitimacy.

How to fix:

Ensure a PTR record (rDNS) is configured for your IP address—it must point to your mail server's domain (e.g., mail.yourdomain.com), and the domain's A-record must resolve back to this same IP. Additionally, configure these records in your domain's DNS zone:

• SPF Record: Specifies which IP addresses are authorized to send mail on behalf of your domain.

• DKIM Key: A cryptographic signature in headers proving the email was not tampered with in transit.

Comparison Table: Major Spam Databases and Delisting Complexity

3. Step-by-Step Delisting Request Guide (Using Spamhaus as an Example)

Once you have fully cleaned the server, closed vulnerabilities, removed malware, and verified DNS settings, proceed to the blacklist removal process.

1. Locate your IP in Spamhaus Lookup ~2 min

   Navigate to the official Spamhaus IP Address Lookup service ([https://check.spamhaus.org/](https://check.spamhaus.org/)). Enter your server's IP address into the search field. The system will display a detailed report, indicating which sub-database (e.g., CSS or XBL) contains your address, alongside log excerpts explaining the block.

   Important! Always check your IP address immediately upon renting a server to avoid potential issues.

2. Fill out the Removal Request Form ~3 min

   Click on the "Show Blocklist Removal Information" button at the bottom of the report. Check the box confirming that you have reviewed the reasons for the block and fully resolved the issue on your side. Complete the form fields: provide your real name, a business email address (preferably under the domain used for sending mail, not a free Gmail account), and the reason for the request.

3. Provide Justification for Taken Actions (Crucial Step) ~2 min

   In the description field, briefly and professionally describe in English what happened and how you resolved it.

   • Bad example: "Please remove my IP, I did not send spam, it's a mistake." (Automated systems will reject this).

   • Good example: "Our server was compromised due to an outdated WordPress plugin. The malicious script has been completely removed, the security holes have been patched, and the email queue has been cleared. We have also configured valid SPF, DKIM, and rDNS entries. Please review and remove our IP from the list."

4. Confirm via Email ~1 min

   Submit the form. A confirmation email containing a special verification link will be sent to your specified work mailbox. Click it to verify your request. Spamhaus automated systems will scan your IP address, and if the spam stream has indeed stopped, the address will be completely delisted within 1–2 hours.

FAQ: Frequently Asked Questions

• What should I do if I just bought a VPS and its IP is already blacklisted?

  Due to the global IPv4 address shortage, hosting providers recycle IP addresses. A previous tenant may have spammed the network and abandoned the server, leaving you with a tarnished IP. If you discover a listing on an entirely clean, freshly deployed server, immediately contact your hosting provider's technical support to request a free IP replacement, as this is the previous user's fault. Almost every hosting provider will swiftly replace your IP address with a clean one.

• Can I insure my mail server against getting blacklisted?

  You cannot guarantee 100% protection, but you can minimize risks. Enroll your server in free reputation monitoring programs provided by major mail services: Google Postmaster Tools and Microsoft SNDS. These tools allow you to view real-time complaint rates from users (spam reports) and catch issues before your IP lands on global RBLs. Additionally, send mass emails in small, throttled batches.

Article Author: Anatolie Cohaniuc