Top Five Tips for Dealing with Blacklists (Updated for 2024)

Is your IP address on a blocklist? What does that mean and what should you do about it?

First, here's what you need to know about blocklists (aka blacklists).

There are more than 90 blocklists out there in the world, and fewer than a dozen of them are actively used as spam filters at any large ISP or webmail provider. If you plug your IP address into a web form and go a reply that said "OH NOES! YOU'RE ON A blocklist!" that does NOT mean you have a deliverability issue. Allow me to repeat: OMG YOU'RE LISTED ON A BLOCKLIST DOES NOT MEAN YOU ARE GOING TO HAVE A PROBLEM DELIVERING MAIL.

Anybody can create a blocklist! You, me, some guy with his cat in his basement, a Linux user in Belgium, Huey Callison, anyone. Just because a blocklist exists does not mean it is widely used. You can hang a disco ball in your basement, but that doesn't make it Studio 54.

The only way a blocklist can cause your mail to get blocked at an ISP is if that ISP purposely chooses to subscribe to that blocklist. That means that a listing on Joe's blocklist, the one where he lists everybody who sends emails with the letter J in them, is not going to get your mail blocked at Yahoo.

Here are some real world examples. The various Spamhaus (SBL, XBL, PBL, etc.) blocklists are probably the most widely used blocklists in the world. If you're blocklisted on Spamhaus, you're going to have trouble delivering mail to Yahoo, Comcast, RoadRunner and a bunch of other ISPs. If you're listed on Spamcop or UCEPROTECT, the number of big sites that block your mail may be few, but lots of smaller sites use these lists to decide which mail to accept and which mail to reject. Getting listed on Spamcop or UCEPROTECT is something of an automated process; it is typically an accurate indicator that somebody sending mail from that IP address is sending mail to spamtrap addresses.

On the other end of the spectrum, a blocklist like SpamRATS or "Spam Eating Monkey" is likely to broadly list anything they don't like. Meaning, if somebody else on your network did something bad, they could and probably are listing the entire network. Indeed, certain blocklists do have a criteria wherein they blocklist entire ESPs who don't require confirmed opt-in/double opt-in. Sounds like a neat idea for a spam filter….unless you want to receive your shipping notification or flight status notification. All of that mail comes from ESPs and none of it is confirmed opt-in. Which is one of the reasons why you will never find random blocklists being casually used by a major mailbox provider. (Not that any blocklist is inherently evil; to each their own, and email administrators have the right to use whatever spam filters they want. I mean only that in a typical production email receiving environment at a top tier ISP, users would scream bloody murder if this type of blocklist were used as a spam filter.)

A special note on UCEPROTECT: UCEPROTECT is actually three different blocking lists.

1. Level 1: Directly lists IP addresses that have attempted to deliver emails to UCEPROTECT's network of spamtrap addresses.
2. Level 2: An "escalation" listing, where UCEPROTECT is saying that they've seen too many spam attempts from various IPs in a given network block, so they have implemented this listing against a whole network block (range of IP addresses).
3. Level 3: An "AS level" listing, another type of escalation. "AS level" means at the "autonomous system" level -- meaning it lists whole internet service providers or network providers.

The level two and level three listings are quite broad and will definitely include many IP addresses that did not attempt to send spam. This means that if you're trying to be very careful about blocking mail only from spammy IPs, you probably wouldn't want to use these level two and level three blocklists in your spam filtering decisions. Generally speaking, very few mailbox providers utilize these lists, because of that broadness.

The one exception is that the level one UCEPROTECT blocklist is indeed used by a number of smaller and regional mailbox providers and internet service providers in Germany; this is where you're likely to see the greatest impact from a UCEPROTECT blocklisting issue.

If you think you have a blocklist issue, here's what you should (and shouldn't) do.

1. Don't panic. Calm and rational wins the race.
2. Check your bounces for reference to the blocklist. If you can't find any references to that blocklist in your bounces, forget about it and get on with your life. Read what I wrote above about how just because a blocklist exists, doesn't mean it's able to block your mail. Even if your IP address is listed.
3. Don't call the blocklist on the phone. Don't call your ISP or ESP and tell them to get the blocklist on the phone. Seriously, it doesn't work that way, and nobody that works for a blocklist cares about your business model. There is no, "if they could just understand how this impacts my business." blocklist operators do what they're doing to stop spam, not make friends. And they're jaded from ignorant and/or bellicose listees driving them nuts. Be better than that. I can't say this enough times. Nobody cares, nobody cares, nobody cares.
   
4. Figure out what you did to upset them and fix it. If it's UCEPROTECT or Spamcop, you're hitting spamtrap addresses. What list did you mail on the day the listing started? That list may be dirty. It might be time to dump it, or reconfirm it. If it's a Spamhaus SBL listing, and it's because of a spamtrap hit, get ready to reconfirm your entire database. And too bad if you don't like it, that's the way it goes.
5. Request removal from the blocklist AFTER you've fixed your problem. After you've shelved the bad list, after you've reconfirmed the questionable database. Be mindful that many blocklists work in a way where listings expire automatically after a given amount of time.
   

Keep in mind that whitelisting does not prevent blocklisting. You could get certified by Validity or the Certified Senders Alliance (CSA), but if you later send spam, buy a list, or send mail to a bunch of spamtraps, you are likely to end up blocklisted. No blocklist checks some magic list of whitelisted IP addresses and says "oh, we see all this spam from this IP address, but it's on a whitelist, so we won't blocklist it." (A very small number of blocklists occasionally make exemptions for technical issues, but that's not going to be something you qualify for.) And if you do bad things, you're similarly likely to get kicked off of the whitelist or certification program you're enrolled in.

And finally, if you're going to sue a blocklist, just go do it already and don't even tell us about it. Don't waste time commenting on the blogs, and don't bother sending angry hate mail to the maintainer of the blocklist. People that are going to sue, sue. People that aren't really going to sue, they just endlessly threaten and complain. It's useless noise. The quickest way to lose friends and alienate people who run blocklists is to threaten and bluster. It's all crap, and the blocklist operator knows it. You're not going to get delisted on the basis of your sheer force of personality. Or lack thereof, as the case may be.

(That Neko Case album? Really good, by the way.)