Why are ESP customer domains getting listed in Spamhaus, and what can be done about it?

Summary

ESP customer domains get listed on Spamhaus due to various reasons, including spam activity, phishing, malware distribution, being part of compromised networks, or having poor security practices such as allowing open redirects. Phishing attempts often target compromised WordPress installs. A good sender reputation is built and maintained through practices such as email authentication (SPF, DKIM, DMARC), confirmed opt-in, honoring unsubscribe requests, and avoiding spam traps. Crucial steps to avoid blacklisting or to get delisted include identifying and correcting the underlying issues, proactively monitoring domain reputation, and following Spamhaus's specific delisting procedures. The Spamhaus ZEN list combines multiple Spamhaus blocklists, so a listing there indicates a problem across various dimensions.

Key findings

  • Listing Reasons: Domains are blacklisted on Spamhaus due to spam activity, phishing, malware, compromised networks, or poor security.
  • Phishing Target: Compromised WordPress installations are frequently targeted in phishing attacks.
  • Sender Reputation: A good sender reputation relies on email authentication (SPF, DKIM, DMARC), confirmed opt-in, honoring unsubscribe requests, and avoiding spam traps.
  • Open Redirects: ESPs allowing open redirects are more prone to have domains blacklisted.
  • Spamhaus ZEN: A listing on Spamhaus ZEN means the domain is listed on one or more of its component lists.

Key considerations

  • Proactive Monitoring: Continuously monitor domain reputation to detect and address issues promptly.
  • Issue Correction: Identify and rectify the root cause of the listing, such as spam complaints, compromised systems, or poor email practices.
  • Delisting Process: Follow Spamhaus’s delisting process after resolving the underlying problems.
  • Authentication: Ensure proper configuration of SPF, DKIM, and DMARC to prevent unauthorized email sending.
  • List Hygiene: Regularly clean email lists to remove inactive subscribers, spam traps, and unengaged recipients.
  • Compliance: Adhere to email deliverability best practices, including obtaining explicit consent and providing easy unsubscribe options.

What email marketers say
11Marketer opinions

Domains get listed on Spamhaus due to various reasons including spam activities, hosting malware, poor security allowing for open redirects or phishing, and being associated with compromised networks. Contributing factors include low sender reputation, sending to spam traps, and poor list hygiene. Addressing the root cause, such as fixing email authentication, improving list practices, and monitoring sender reputation, is crucial for delisting and maintaining good deliverability.

Key opinions

  • Listing Reasons: Domains are listed on Spamhaus for spam, phishing, malware, compromised networks, or allowing open redirects.
  • Poor Reputation: Low sender reputation, spam traps, and poor list hygiene contribute to Spamhaus listings.
  • ZEN Composite: Spamhaus ZEN combines multiple blocklists, meaning a listing on ZEN indicates a listing on at least one other Spamhaus list.
  • Landing Pages: Sometimes landing pages can be blacklisted on a domain.

Key considerations

  • Root Cause: Identify and rectify the cause of blacklisting, which may involve fixing email authentication issues (SPF, DKIM, DMARC), securing compromised systems, or improving list hygiene.
  • Email Authentication: Ensure email authentication is properly configured to prevent unauthorized use of the domain.
  • List Hygiene: Regularly clean email lists to remove inactive subscribers and spam traps.
  • Sender Reputation: Monitor sender reputation metrics, such as spam complaints and engagement, to detect issues early.
  • Open Redirects: Make sure the ESP doesnt allow open redirects.
  • Delisting Process: Follow Spamhaus's specific delisting process after addressing the underlying issues.
Marketer view

Email marketer from Reddit shares that Spamhaus often lists domains due to spam complaints or the detection of spam traps. It's essential to maintain good list hygiene and avoid sending to unengaged recipients. Regularly cleaning your list can help avoid getting your domain listed.

August 2022 - Reddit
Marketer view

Marketer from Spamhaus explains that domains get listed on Spamhaus blocklists due to involvement in spamming activities, hosting malware, or other malicious online behavior. They may also be listed if they're associated with a network or service known to facilitate spam. Poor security on a domain also may lead to being listed.

April 2022 - Spamhaus
Marketer view

Email marketer from Email on Acid says to improve sender reputation you can clean up email lists, authenticate email using SPF, DKIM, and DMARC, consistently send emails, and monitor IP and domain reputation. Consistent volume and engagement improves sender reputation, reducing the chances of being listed.

February 2023 - Email on Acid
Marketer view

Marketer from Email Geeks explains that the landing page behind the tracking URL is likely being blacklisted. As email sent would contain tracking URLs with the same tracking domain, but each may lead to different landing pages and websites, you may have to check every link to find the blocklisted domain. Benjamin suggests the problem might be that the ESP allows open redirections, which are being abused by phishers.

November 2023 - Email Geeks
Marketer view

Email marketer from StackOverflow shares that you should determine the cause for blacklisting before requesting removal. Rectify the issues by fixing your email authentication (SPF, DKIM, DMARC), improving list hygiene, and removing spam traps. Once rectified, follow the specific delisting procedures provided by each blacklist.

July 2022 - StackOverflow
Marketer view

Email marketer from SendPulse highlights the importance of regularly cleaning your email list to remove inactive or unengaged subscribers. This reduces the risk of sending to spam traps and decreases the likelihood of being listed on spam databases. SendPulse recommends regularly segmenting and re-engaging subscribers.

January 2024 - SendPulse
Marketer view

Marketer from Email Geeks shares if several of the tracking domains are listed, that supports the theory of the ESP having open redirectors.

March 2024 - Email Geeks
Marketer view

Email marketer from Mailjet highlights the importance of following email deliverability best practices to maintain a good sender reputation. This includes obtaining explicit consent from subscribers, using double opt-in, and providing an easy way to unsubscribe. This helps to avoid spam complaints and improve deliverability.

May 2024 - Mailjet
Marketer view

Email marketer from ReturnPath highlights the importance of sender reputation as a key factor in email deliverability. Sender reputation is calculated based on various metrics such as email volume, complaint rates, and engagement. Maintaining a good sender reputation helps to ensure emails reach the inbox and avoids blacklisting.

May 2023 - ReturnPath
Marketer view

Email marketer from Litmus highlights the importance of regularly monitoring your sender reputation. This includes checking your IP and domain reputation, analyzing bounce rates, and monitoring spam complaints. Early detection of issues allows you to take corrective actions before getting blacklisted.

January 2023 - Litmus
Marketer view

Email marketer from GlockApps explains that the Spamhaus ZEN is a combination of multiple Spamhaus blocklists, including the Domain Block List (DBL). If a domain is listed on ZEN, it means it's also listed on one or more individual Spamhaus lists. GlockApps provides tools for monitoring your domain's listing status.

March 2025 - GlockApps

What the experts say
4Expert opinions

Domains get listed on Spamhaus for reasons including spam activity, phishing, malware distribution, or being part of a compromised network. Compromised Wordpress installs are a frequent destination for phishing. Building and maintaining a good sender reputation through proper email practices like confirmed opt-in and honoring unsubscribe requests is key. Monitoring domain reputation and addressing issues proactively, then following Spamhaus's specific delisting process, are essential steps for removal.

Key opinions

  • Listing Reasons: Spamhaus lists domains due to spam activity, phishing, malware, or being part of a compromised network.
  • Phishing Destinations: Compromised WordPress installs are frequently used as phishing destinations.
  • Sender Reputation: Good sender reputation is built through confirmed opt-in, honoring unsubscribe requests, and avoiding open relays.

Key considerations

  • Proactive Monitoring: Monitor domain reputation proactively to detect and address issues early.
  • Issue Correction: Identify and correct the reason for the listing, such as spam complaints or security breaches.
  • Delisting Process: Follow Spamhaus's specific removal process, which may include submitting a delisting request.
Expert view

Expert from Spamresource.com explains that to be delisted from Spamhaus, you must first identify the reason for the listing and correct the issue. This often involves addressing spam complaints, securing compromised systems, and implementing better email practices. Then, follow Spamhaus's specific removal process, which may involve submitting a delisting request.

October 2022 - Spamresource.com
Expert view

Email marketer from Email Geeks shares that most phishing destination sites that they see are compromised Wordpress installs.

March 2024 - Email Geeks
Expert view

Expert from Spamresource.com answers that Spamhaus lists domains for various reasons, including spam activity, phishing, malware distribution, and being part of a compromised network. They emphasize the importance of monitoring your domain's reputation to detect and address issues proactively.

March 2022 - Spamresource.com
Expert view

Expert from Word to the Wise shares that sender reputation is built over time by engaging in proper practices which can include authenticating email, using confirmed opt-in, honouring unsubscribe requests, and ensuring that your mail server is not an open relay. They recommend monitoring your reputation regularly and taking action if it declines.

June 2023 - Word to the Wise

What the documentation says
5Technical articles

Email authentication using SPF, DKIM, and DMARC is crucial for preventing domain forgery, phishing attacks, and blacklisting. Maintaining a good sender reputation through responsible sending practices, including clean email lists and easy unsubscribe options, is also vital. Monitoring blacklist status and diagnosing potential problems with tools like MXToolbox allows for proactive identification and resolution of issues.

Key findings

  • Email Authentication: SPF, DKIM, and DMARC are essential for email authentication and preventing domain forgery.
  • Sender Reputation: Good sender reputation is based on responsible sending practices like clean lists and easy unsubscribe options.
  • Blacklist Monitoring: Tools like MXToolbox can be used to monitor blacklist status and diagnose issues.
  • DNS Records: Valid forward and reverse DNS records (PTR records) for sending servers are important.

Key considerations

  • SPF Configuration: Ensure SPF records are correctly configured to authorize sending servers.
  • DMARC Implementation: Implement DMARC to define how recipient mail servers should handle emails failing authentication checks.
  • Reputation Management: Maintain spam rates below 0.10% and avoid sending unsolicited email.
  • Regular Monitoring: Regularly monitor domain and IP addresses for blacklist listings and diagnose potential issues.
Technical article

Documentation from DMARC.org answers that implementing DMARC helps protect your domain from email spoofing and phishing attacks. It allows you to define how recipient mail servers should handle emails that fail SPF and DKIM checks. This prevents malicious actors from using your domain and helps prevent getting blacklisted.

March 2024 - DMARC.org
Technical article

Documentation from MXToolbox explains that you can use MXToolbox to check if your domain or IP address is listed on various blacklists. It can also test your mail server and diagnose potential problems. Regular monitoring can help identify and address issues that can lead to blacklisting.

February 2024 - MXToolbox
Technical article

Documentation from RFC Editor specifies that SPF (Sender Policy Framework) records are used to prevent sender address forgery. Ensuring that an SPF record is correctly configured can prevent unauthorized use of your domain in email campaigns and prevent being listed in spam databases.

August 2021 - RFC Editor
Technical article

Documentation from Google Support suggests to authenticate your email with SPF, DKIM, and DMARC. They also suggest ensuring that sending servers have valid forward and reverse DNS records (PTR records), keeping spam rates reported in Postmaster Tools below 0.10%, and using a dedicated IP address.

November 2022 - Google
Technical article

Documentation from Microsoft explains that a good sender reputation is based on responsible sending practices. You should authenticate your email, avoid sending unsolicited email, maintain clean email lists, and provide an easy unsubscribe process. A good sender reputation helps prevent domains from being blacklisted.

August 2024 - Microsoft