ModeesA listing feels like an emergency, and the first instinct is to pay for removal or fire off an angry ticket. Both are usually wrong. Most listings come from one of three mundane causes, and the list that matters is the one your recipient's mailbox provider actually consults.
Check the right lists
Start with the major, widely used lists:
- Spamhaus — SBL, XBL and PBL.
zen.spamhaus.orgcombines them, though PBL is a policy list about residential IPs, not a spam verdict. - Barracuda — widely used by corporate filters.
- Microsoft — JMRP and Smart Network Data Services report what Microsoft sees from your IPs.
- Google Postmaster Tools — not a blocklist, but it shows spam rate and reputation for high-volume senders. Check it first when Gmail placement drops.
Domain-based checks matter too. A link or sending domain can be listed on URI lists (SURBL, URIBL) even when the IP is clean, which is common after a compromised website or a redirect through a bad shortener.
You can test an IP manually by reversing it and querying a DNSBL:
dig +short 3.2.1.198.zen.spamhaus.org
A 127.0.0.x answer is a listing; no answer is not. Check both the sending IP and the domain. Check any IPs in the Received chain if you are diagnosing, but treat only your own as actionable.
What a listing actually means
Different lists mean different things, and the response should differ too.
- A compromised-host listing usually means malware or a hijacked account on the IP — often a shared host, not your mail server.
- A policy listing means the IP range is not supposed to send mail directly, which is common on cloud and residential ranges.
- A spam-source listing means complaints or trap hits were recorded from that IP.
Only the last one is really about your content. If you are on a shared platform, check whether the listing is the shared IP or your dedicated one before you rewrite anything.