Frequently Asked Questions relating to Spamhaus data

The Spamhaus lookup tool of our Blocklist Removal Center page will show IPs and domains that are currently listed in one or more of Spamhaus’s blocklists.

If the IP or domain you are checking is not found, but you are blocked, there are two possibilities:

1. It can be a DNS resolver issue. More information can be found here.
2. If the IP or domain was listed by Spamhaus, and was recently removed: it takes some networks longer to catch up than others. In this case, wait 1-2 hours and the problem should clear by itself. In rare cases when a specific network is having problems syncing updates from Spamhaus, this can take hours or days.

NOTE: If the issue with sending mail persists after removal, check to see if it is a problem with “all networks” or “just one or two”. If it’s just one or two, the issue lies with the network being sent to. Please contact them. If it is “all networks”, please update your removal ticket with details.

Spamhaus IP and Domain Reputation Checker

The listing of an IP or domain by any of the DNS Blocklists (DNSBLs).

(https://www.spamhaus.org/faqs/?section=DNSBL+Usage) can be checked using the Spamhaus Checker.

How to submit a removal request

• We will not be able to handle removal requests made through other channels (such as email).
• Due to the amount of requests, removal requests must be made by the registered owner of the domain or IP. If that is not you, please contact your service provider for help.

If you are the registered owner of the domain or IP:

• Removal requests must from an IP address that can be associated with the requested IP or domains, and should not be made using a VPN.

• When you submit a removal request, please make sure that you provide us sufficient information so we can handle your request appropriately:

  1. What caused the spam issue,
  2. What action you took to solve it,
  3. When did you solve it (time and date),
  4. What further actions you took to prevent spam problems again in the

  future.

NOTE: Submitting a removal request does not guarantee that the removal will be granted. Please ensure that the problem has been addressed before submitting a request.

Very unlikely! Spamhaus has automated systems that can list email addresses, but these listings almost always occur when the addresses are fully involved in spamming. These are included in the Hash Blocklist.

What probably occurred is that that the domain used by your email address or the IP address that is sending your email are listed.

• You can check whether an IP address or domain is in any Spamhaus dataset using our lookup form.
• If either your domain or IP address are listed and you believe this is incorrect, please read below.

How to submit a removal request

• We will not be able to handle removal requests made through other channels (such as email). Use the Checker and follow the instructions to use the ticketing system.
• Due to the amount of fraudulent requests, removal requests must be made by the registered owner of the domain or IP address. If that is not you, please contact your service provider for help.

If you are the registered owner of the domain or IP address:

• Removal requests must from an IP address that can be associated with the listed IP addresses or domains and should not be made using a VPN or proxy
• Removal requests should not be made from free or disposable email addresses. Use an email address that can be linked to the IP or domain you are requesting.
• When you submit a removal request, please make sure that you provide us sufficient information so we can handle your request appropriately:
  1. What caused the spam issue,
  2. What action you took to solve it,
  3. When you solved it,
  4. What further actions you took to prevent problems again in the future.

NOTE: Submitting a removal request does not guarantee that the removal will be granted. Please ensure that the situation has been addressed before submitting a request.

If you are waiting for a reply from Spamhaus, and you are not receiving one:

• Ensure that the email address to which it was sent is working. For example, if you are trying to set up a PBL account, the “abuse@example.com” address needs to be functional.
• Check your ‘Spam’ folder, promotional tab, etc.
• If that doesn’t locate the email, please contact your IT department or helpdesk and ask them to review the logs to see what happened to the email.

Yes. The Threat Intel Community is a portal that enables users of all types to submit suspicious internet activity. Whether you want to submit a single IP address via a simple form or multiple domains via an API, you can do so from the Portal. We accept IPs, domains, URLs, and raw source emails. If you authenticate and create an account, you will also be able to see if your submissions are being reflected in our datasets. Authentication can be done via Linkedin, Google, and Github.