If your company's email suddenly starts bouncing or landing in spam, one possible reason is that your IP address or domain ended up on a blocklist. Here's how these lists work, how to check yourself, and what to do if you're listed.
What a DNSBL is
A DNSBL (DNS-based Blackhole List, sometimes called an RBL) is a database of IP addresses or domains seen sending spam. It's run by an independent organization, and mail servers around the world consult it when accepting messages.
Under the hood, the lookup uses DNS. To find out whether IP 203.0.113.25 is listed, a server reverses the address octets, appends the list's domain, and makes an ordinary DNS query:
25.113.0.203.zen.spamhaus.orgIf the query returns an address like 127.0.0.x, the IP is listed. If there's no answer (NXDOMAIN), it's clean. The return code usually indicates why the address was listed.
There are also domain lists (URI DNSBLs such as SURBL). These check the domains in links inside a message rather than the sender.
What a listing means for you
The impact depends on which list you're on and how the receiving server uses it:
- messages are rejected outright and you get a bounce like
554 5.7.1 ... listed at ...; - messages are accepted but get a high spam score and go to the spam folder;
- nothing happens — some obscure lists are barely used by anyone.
So it's important not only to find a listing but to understand how much weight that list carries.
How to check your IP address and domain
- Find the IP address your mail is sent from. Send yourself a message at an outside mailbox, view the message source, and look at the top
Receivedheaders — you need the address of the server that handed the message to the recipient. - Check that IP with a multi-list lookup tool such as mxtoolbox.com (Blacklist Check). It queries dozens of lists at once.
- Check your domain separately to see whether it's on any domain lists.
- To check manually, use
digornslookup:
dig +short 25.113.0.203.zen.spamhaus.org
nslookup 25.113.0.203.zen.spamhaus.orgAn empty answer means the address isn't listed.
Some major lists restrict queries coming through public DNS resolvers and may return a special error code instead of a real result. If a manual check looks odd, use a web lookup tool or the list's own lookup page.
Why senders get listed
| Cause | What it looks like |
|---|---|
| Compromised mailbox | An attacker guessed or stole an employee's password and sends spam through your server |
| Infected computer | Malware on the office network sends mail directly |
| Bulk mail to a bad list | Lots of nonexistent addresses and spam traps |
| Recipient complaints | Mail goes to people who never opted in |
| Bad neighbors | Someone else on the same IP or subnet is spamming |
| Technical misconfiguration | No reverse DNS (PTR) record, wrong server name in the HELO greeting |
For small companies, the most common case is a compromised mailbox. That's why password hygiene and two-factor authentication directly affect email delivery.
How to get delisted
- Find and fix the cause. Otherwise you'll be listed again. Review sending logs, change passwords on suspicious mailboxes, scan computers with antivirus, and stop campaigns to questionable lists.
- Open the list's website. Nearly every DNSBL has a lookup page explaining why an address was listed.
- Submit a removal (delisting) request. This is usually a form on the list's website. Some lists remove addresses automatically after the spam stops.
- Check again after a few hours or days. Receiving servers cache DNS answers, so the effect won't be instant.
Avoid services that offer "paid removal from all blocklists." Reputable lists delist addresses through their own process, and getting relisted because the cause wasn't fixed only makes removal harder.
If you use MCMail and see that one of our server's IP addresses is listed, contact support at @mycloudsupport right away: we handle delisting requests for our server addresses. Include the error text or the message headers.
Sending rate limits and dedicated IPs
On a shared mail server, many customers' messages go out from the same IP addresses. They share a reputation, so the provider has to stop any one mailbox from ruining it for everyone else.
That's why MCMail applies a sending rate limit. It doesn't interfere with normal business email, but if a mailbox is compromised and starts sending spam, the limit prevents it from quickly blasting out thousands of messages. This significantly lowers the risk of the server's IP landing on a blocklist. Brute-force protection adds another layer by making the break-in itself harder.
A dedicated IP is an address used for sending by only one company. Pros and cons:
- your reputation depends only on you — other people's mistakes don't affect it;
- but nobody "dilutes" your mistakes either: one bad campaign hits all of your company's email;
- a new IP with no history needs to be "warmed up" by gradually increasing sending volume.
For everyday business email at a small company, a shared IP on a well-maintained server is usually a perfectly good choice. For other reasons messages miss the inbox, see why emails go to spam.
How to stay off the lists
- Use unique, strong passwords and turn on two-factor authentication for every mailbox.
- Don't send bulk campaigns from business email — use a separate service.
- Don't buy address lists, and regularly remove addresses that bounce.
- Keep office computers updated and protected with antivirus.
- Set up SPF, DKIM, and DMARC to make it harder for scammers to spoof your domain.