Why is my IP listed on DroneBL and how to remove it?

Summary

An IP address may be listed on DroneBL due to various reasons, including open proxies, IRC drones, spambots, brute-force attacks, compromised systems, sending to honeypots, or, in shared IP scenarios, actions of other users. The listing category might be 'dictionary attack on honeypots,' indicating connections to addresses recognized as honeypots. Addressing this involves verifying the listing's cause, securing the MTA machines, contacting your hosting provider (if applicable), and following DroneBL's delisting process. Also, monitor feedback loops (FBLs), continuously monitor IP and domain reputation, and practice meticulous list hygiene, implement SPF, DKIM, and DMARC, warm up new IPs gradually, and secure your email infrastructure. Note also that SecurityScorecard is unlikely to use DroneBL.

Key findings

  • Listing Causes: Listings are triggered by open proxies, compromised systems, sending to honeypots, or brute-force attacks. For one specific IP, it appears the listing was from sending to bad addresses / honeypots.
  • Shared IP impact: Shared IP addresses mean actions of other users can impact your IP reputation.
  • SecurityScorecard: SecurityScorecard is unlikely to use DroneBL data.
  • Delisting Process: Delisting requires identifying the cause, resolving any underlying security issues, and following the DroneBL delisting procedure.
  • Reputation Monitoring: Continuous reputation monitoring with tools like Google Postmaster Tools helps early detection.
  • List Hygiene: List hygiene, validation, and cleaning are vital to prevent spam trap hits.
  • Email Authentication: SPF, DKIM, and DMARC prevent blacklisting and improve sender reputation.

Key considerations

  • Identify the root cause: First, determine the exact reason for the DroneBL listing to take targeted action.
  • Secure email infrastructure: Implement security measures to prevent unauthorized access and misuse of email systems.
  • Monitor feedback loops: Set up and monitor feedback loops (FBLs) to track spam complaints.
  • Implement IP warming: For new IPs, employ a gradual warming process.
  • Understand blacklists: Familiarize yourself with how different blacklists operate.
  • Delisting Process: Contact DroneBL to delist.
  • Secure MTA Machines: Ensure MTA machines are secure and not compromised

What email marketers say
11Marketer opinions

An IP address can be listed on DroneBL for various reasons, including operating an open relay, compromised systems, shared IP issues where other users' actions affect your IP, or sending emails to spam traps. Solutions include securing your server, maintaining a clean email list, contacting your hosting provider or DroneBL, implementing email authentication protocols (SPF, DKIM, DMARC), warming up new IPs, and continuously monitoring your sender reputation. SecurityScorecard is unlikely to use DroneBL and reputation needs monitoring.

Key opinions

  • Listing Causes: Common causes for DroneBL listing include open relays, compromised systems, shared IP issues, and sending to spam traps.
  • SecurityScorecard: SecurityScorecard unlikely to use DroneBL
  • Shared IPs: If on a shared IP, another user's actions can affect your IP's reputation.
  • Contacting DroneBL: Contacting DroneBL directly can provide specific information about the listing and removal steps.
  • Authentication: SPF, DKIM, and DMARC implementation improves sender reputation and reduces blacklisting risks.
  • Reputation Monitoring: Monitoring sender reputation helps identify potential issues early.

Key considerations

  • Server Security: Ensure your server is secure and not operating as an open relay.
  • List Hygiene: Maintain a clean email list by removing invalid or inactive addresses.
  • Infrastructure Security: Secure your email infrastructure with strong passwords and software updates.
  • IP Warm-up: Warm up new IPs gradually to establish a positive sending reputation.
  • Reputation Tools: Utilize tools like Sender Score or Google Postmaster Tools to monitor sender reputation.
  • Hosting Provider: Contact your hosting provider if you're on a shared IP address and suspect issues.
Marketer view

Email marketer from Return Path advises regularly monitoring your sender reputation using tools like Sender Score or Google Postmaster Tools. This helps identify potential issues early and prevent blacklisting.

January 2022 - Return Path
Marketer view

Expert from Email Geeks shares that SecurityScorecard doesn't currently use third-party data for scoring and is unlikely to use DroneBL over more reputable blocklists.

October 2022 - Email Geeks
Marketer view

Email marketer from Stack Overflow shares that one cause for DroneBL listing can be that your host is running an open relay. It's advisable to determine if the server is secured.

November 2024 - Stack Overflow
Marketer view

Email marketer from MXToolbox explains you can use their tool to check your IP address against multiple blocklists, including DroneBL, to determine if it's listed and the reason for the listing.

April 2021 - MXToolbox
Marketer view

Email marketer from GlockApps recommends gradually warming up new IP addresses by starting with small volumes of emails to engaged subscribers. This helps establish a positive sending reputation and avoids triggering blacklists like DroneBL.

March 2023 - GlockApps
Marketer view

Email marketer from SendGrid Support explains that maintaining a clean email list is crucial, as sending to invalid or spam trap addresses can lead to blacklisting. Regularly clean your lists of inactive and invalid emails.

February 2024 - SendGrid
Marketer view

Email marketer from Web Hosting Talk forum shares that if you're on a shared hosting IP, another user's actions might cause the entire IP to be blacklisted. Contacting your hosting provider is essential to resolve the issue.

February 2025 - Web Hosting Talk
Marketer view

Email marketer from Reddit advises contacting DroneBL directly for more specific information about the listing and any steps required for removal.

October 2024 - Reddit
Marketer view

Email marketer from Reddit user recommends checking server logs for unusual activity, running malware scans, and ensuring all software is up to date, to identify compromised systems.

December 2021 - Reddit
Marketer view

Email marketer from Barracuda Networks emphasizes the importance of securing your email infrastructure to prevent unauthorized access and misuse. This includes using strong passwords, enabling two-factor authentication, and regularly patching software vulnerabilities.

July 2022 - Barracuda Networks
Marketer view

Email marketer from Mailchimp shares that Implementing SPF, DKIM, and DMARC can improve your sender reputation and reduce the likelihood of being blacklisted. These authentication methods verify that you are authorized to send emails on behalf of your domain.

October 2024 - Mailchimp

What the experts say
7Expert opinions

DroneBL listings often result from issues other than direct spam, such as open proxies or sending to honeypot addresses. Addressing these listings involves understanding the specific cause, utilizing DroneBL's delisting process, and examining MTA security. A broader strategy includes understanding blacklist operation, monitoring feedback loops, continuously tracking IP/domain reputation, and maintaining meticulous list hygiene.

Key opinions

  • Listing Reasons: DroneBL listings are not always directly related to spam; open proxies and sending to honeypots are common causes.
  • Delisting Process: DroneBL offers a delisting process that should be followed, and is often relatively easy.
  • MTA Security: Examining the security of MTA machines is important, especially if listed for 'dictionary attack on honeypots'.
  • Blacklist Understanding: Understanding how different blacklists operate is crucial.
  • Feedback Loops: Setting up and monitoring feedback loops (FBLs) aids in identifying issues that lead to blacklisting.
  • Reputation Monitoring: Continuously monitoring IP and domain reputation is essential for early detection of blacklistings.
  • List Hygiene: Meticulous list hygiene practices, including regular validation, are necessary to avoid spam traps.

Key considerations

  • Specific Cause: Identify the specific cause of the DroneBL listing to address the root issue.
  • Security Checks: Regularly examine and secure your MTA machines to prevent compromises.
  • Proactive Monitoring: Implement continuous monitoring of IP and domain reputation.
  • Data Validation: Maintain stringent data validation practices to ensure list hygiene.
Expert view

Expert from Email Geeks advises that you should be able to request delisting from DroneBL. She highlights that because DroneBL primarily lists compromised machines, it's a valid security concern, and the security team's worry is understandable.

August 2021 - Email Geeks
Expert view

Expert from Wordtothewise.com emphasizes the need for meticulous list hygiene practices, including regular validation and removal of invalid or unresponsive email addresses. Poor list hygiene increases the risk of hitting spam traps and being blacklisted.

February 2023 - Wordtothewise.com
Expert view

Expert from Email Geeks points out that the listing category is 'dictionary attack on honeypots'. She suggests examining the security of the MTA machines, but notes the issue might be related to older data rather than a current compromise. Recommends delisting due to how easy it is.

May 2021 - Email Geeks
Expert view

Expert from Wordtothewise.com explains that continuously monitoring your IP and domain reputation is essential for detecting blacklistings early and taking corrective action. Tools like Google Postmaster Tools can provide insights into your sending reputation.

February 2025 - Wordtothewise.com
Expert view

Expert from Spamresource.com shares that setting up and monitoring feedback loops (FBLs) can help identify and address issues that lead to blacklisting. FBLs provide information about spam complaints from recipients, allowing you to remove problematic subscribers.

December 2022 - Spamresource.com
Expert view

Expert from Spamresource.com explains that understanding how different blacklists operate, including their listing criteria and delisting procedures, is crucial for addressing DroneBL listings. Not all blacklists are created equal, and their impact on deliverability varies.

June 2021 - Spamresource.com
Expert view

Expert from Email Geeks explains that a DroneBL listing isn't always related to spam but often due to an open proxy. In this specific case (IP 205.139.105.170), the listing appears to be caused by sending to bad addresses, specifically honeypots, in Sept 2022.

February 2022 - Email Geeks

What the documentation says
4Technical articles

DroneBL lists IPs identified as open proxies, IRC drones, spambots, or brute-force attackers, often indicating compromised systems. Removal requires visiting the DroneBL website, looking up the IP, following delisting instructions, verifying ownership, and resolving the underlying security issue. Listings can be for categories like 'Open Proxy' or 'Brute force attackers'. Reviewing Spamhaus's criteria can proactively prevent listings, even indirectly related to DroneBL.

Key findings

  • Listing Reasons: IPs are listed for various reasons, including acting as open proxies, IRC drones, spambots, or engaging in brute-force attacks.
  • Delisting Process: Delisting involves visiting the DroneBL website, looking up the IP, and following instructions to request removal.
  • Verification Required: Delisting may require verifying ownership of the IP address and ensuring the security issue is resolved.
  • Listing Categories: Listings are categorized (e.g., 'Open Proxy', 'Brute force attackers') to indicate the specific issue.
  • Proactive Prevention: Reviewing Spamhaus's criteria can help prevent listings proactively.

Key considerations

  • Identify Cause: Determine the specific reason for the DroneBL listing (e.g., open proxy, brute-force attack).
  • Resolve Issue: Address the underlying security issue that caused the listing (e.g., secure open proxy, fix compromised system).
  • Follow Instructions: Carefully follow the delisting instructions provided on the DroneBL website.
  • Prevent Recurrence: Implement measures to prevent the issue from recurring (e.g., strengthen security, monitor for malicious activity).
Technical article

Documentation from Spamhaus explains that it is important to review Spamhaus's criteria for listing to understand what activities might lead to an IP being blacklisted, even if indirectly related to DroneBL. This helps in proactively preventing future listings.

August 2024 - Spamhaus
Technical article

Documentation from DroneBL.org outlines that to remove an IP from DroneBL, you should visit the DroneBL website, look up your IP, and follow the instructions to request delisting. The process may involve verifying ownership of the IP address and ensuring the security issue causing the listing has been resolved.

November 2021 - DroneBL.org
Technical article

Documentation from DroneBL.org explains that IPs are listed on DroneBL for various reasons, including being identified as open proxies, IRC drones, spambots, or engaging in brute-force attacks. Listings often indicate compromised machines or systems exhibiting malicious behavior.

January 2024 - DroneBL.org
Technical article

Documentation from DroneBL.org details listing categories such as 'Open Proxy', 'HTTP Proxy', 'Brute force attackers', 'Compromised router / gateway'. If your IP has been listed for 'dictionary attack on honeypots' it means the system has sent connection attempts to addresses recognised as honeypots.

March 2024 - DroneBL.org