IP addresses are listed on the SBL because they appear to Spamhaus to be under the control of, used by, or made available for use by spammers and abusers in unsolicited bulk email or other types of Internet-based abuse that threatens networks or users.

The Spamhaus definition of "spam" is "unsolicited bulk email" (UBE). Spamhaus does not evaluate the content or legality of the contents of an email message, merely whether that message constitutes spam by this definition. The responsibility for complying with Spamhaus SBL policy begins and ends with the senders of bulk email, owners of websites advertised by bulk email, and providers of services that are used to support bulk email operations. SBL listings are based on evidence which has satisfied the SBL team that the IP address or IP address range meets its listing criteria.

SBL listings are immediate. In cases that involve known spam operations or IP address ranges that exhibit characteristics associated with spam or malware, SBL listings may be preemptive. The SBL does not provide warnings or have a grace period. SBL listings do not require physical evidence of spam received from any specific IP address. IP addresses owned by or under the control of entities listed in the Spamhaus Register of Known Spam Operations (ROKSO) are listed in the SBL on sight. Notifications sent about new or modified SBL listings are discussed below.

SBL Listings

The purpose of SBL listings is to protect Spamhaus users from abusive IP addresses. Listings provide DNSBL protection for SBL users, a notification to the ISP that owns the problem IP address or range, and a summary of the problem that caused the SBL listing. Listings are advisory: they represent Spamhaus’s opinion about activity involving that IP address or IP range. Types of abuse that can lead to SBL listings include all aspects of unsolicited bulk email (spam) and other types of security threats. The SBL Listing Criteria FAQ discusses these types of abuse in detail.

Escalation Listings

When a network appears to Spamhaus to be a threat or hazard to Spamhaus users and and therefore to require proactive measures to protect our users, Spamhaus may apply escalated SBL listings to that network's own infrastructure IP addresses, to extended ranges of that network, or even to that entire network or networks related by ASN or RIR assignment. Some of the signals which Spamhaus views as hazards include ignoring SBL listings and notifications for a significant period of time, claiming to remove a spammer that repeatedly reappears, providing bulletproof hosting or connectivity for blackhat operations such as other networks on Spamhaus DROP, or exhibiting other patterns that demonstrate persistent spam or security issues.

Notifications of Listings

An automatic notification is sent at the time an SBL listing is created to the owner of the respective top-level network, as assigned by Regional Internet Registries (RIR). Spamhaus maintains its own contact list for those networks. Generally SBL notifications are sent to the Abuse Point of Contact (POC) from a network's RIR whois records. There are exceptions, and Spamhaus can accommodate a network's request for additional notification contacts.

SBL notifications are a courtesy provided by Spamhaus to network operators and service providers. Spamhaus is not an abuse reporting service. If a network or service provider does not wish to receive SBL notifications, Spamhaus will accommodate that request. If at any time Spamhaus sees that SBL notifications are ignored or not acted upon, it may choose to stop sending them.

Delisting / Removal

SBL listings are removed after the network's Abuse desk or administrator emails the SBL Team and explains what was done to resolve that issue. If the request does not appear to come from an authoritative source Spamhaus may require to hear from the top level network. Spamhaus expects the problem to be fully resolved, and may decline the removal request if the corrective actions taken do not appear sufficient to prevent further abuse.

See SBL Delisting Procedure for a detailed description. The SBL Removals Team normally processes and replies to valid removal requests within 24 hours. Important removal information -- including the contact email address for the SBL Removals Team and the information that its email system requires in the Subject header of removal requests -- is located at the bottom of every SBL listing page.

Updating

Spamhaus does not routinely review SBL records to remove those that are no longer needed. It is the network owner's responsibility to notify Spamhaus of any changes that affect an SBL listing, and to request removal when the conditions that caused the SBL listing no longer apply. Spamhaus welcomes updates from the operators of networks about old and stale SBL records.