Spamhaus ZEN
Removal
Depends on component
Cost
Always free
Time to clear
Zone republishes every ~5 minutes after approval
About Spamhaus ZEN
ZEN is a single DNS query that returns any Spamhaus IP listing at once: SBL (manual spam listings), CSS (automated snowshoe/compromised), XBL (exploited machines, formerly the CBL), and PBL (policy — ranges that shouldn’t send direct-to-MX). Because so many mail servers use ZEN, a listing here has an outsized effect on delivery.
The removal path depends entirely on which component listed you — always start by looking the IP up at check.spamhaus.org, which names the exact list and links its removal option.
Why an IP gets listed
- SBL — your IP or its range is on a manually maintained spam-source record.
- CSS — automated detection of snowshoe spam or a compromised/abused host.
- XBL (CBL) — the IP is an infected machine, open proxy, or botnet emitter.
- PBL — the IP falls in a dynamic/residential range an ISP says shouldn’t send mail directly.
How to delist from Spamhaus ZEN
- 1Look the IP up at check.spamhaus.org to see which component (SBL/CSS/XBL/PBL) is responsible.
- 2Fix the root cause first — clean an infected host (XBL), stop the spam source (SBL/CSS), or set up a proper mail server with static rDNS (PBL).
- 3XBL/CBL and CSS listings clear automatically once detections stop; you can also request removal from the CBL removal link on the lookup result.
- 4PBL: if you run a legitimate mail server, use the self-service PBL removal form linked on the lookup page (or ask your ISP to update the range policy).
- 5SBL: end users cannot self-remove — your ISP/ESP’s abuse desk must resolve the issue, then use the “contact the SBL Team” link at the bottom of the specific SBL listing page.
Stay off Spamhaus ZEN
- ✓Never pay anyone to “remove a Spamhaus listing” — Spamhaus never charges, and such offers are scams.
- ✓Keep valid reverse DNS on every sending IP and monitor for compromised hosts.
Return codes
When listed, Spamhaus ZEN answers with one of these 127.0.0.x codes:
| 127.0.0.2 | SBL — Spamhaus Block List |
| 127.0.0.3 | SBL CSS — snowshoe/compromised |
| 127.0.0.4 | XBL — CBL (exploits/botnet) |
| 127.0.0.9 | SBL DROP/EDROP |
| 127.0.0.10 | PBL — ISP dynamic range |
| 127.0.0.11 | PBL — Spamhaus policy |
Before you request removal: fix the root cause first — delisting while the problem persists almost always leads to a fast re-listing. Confirm the IP has valid reverse DNS, and that your SPF, DKIM and DMARC are in order.
Check an IP or domain against 35+ blocklists
Run a blacklist check