On a blocklist: how to get off it
Mail that is treated as spam often disappears before its content is ever read: the receiver looks up the sending address at a blocklist and refuses. That blocklist is a DNS zone — one question about your address is one record lookup, so every mail server in the world can and does ask it. If your addresses are listed somewhere, that touches every send from those addresses.
Blacklist check asks every public IPv4 address of your mail — via the MX or typed in bare — at Barracuda Central, SpamCop, Abuse CBL, PSBL and SpamRATS, and sets down per address what each zone answered: listed with the reason the zone itself gives, not listed, or n/b because the zone does not answer our questions.
This article reads how those zones work and how they prove themselves — RFC 5782 — what each zone may expect of you, and where the removal path runs, because that differs per zone more than anything else. The sender side of the same story, SPF and DMARC, stands in SPF, DKIM and DMARC; here it is about the reputation of the address itself.
1. A blocklist is a DNS zone that remembers addresses
The question to a blocklist is an ordinary DNS request: put your address reversed in front of the zone — 203.0.113.10 becomes 10.113.0.203.b.barracudacentral.org — and the zone answers with a fake address in 127.0.0.0/8 when the address is listed (127.0.0.2 is the code every zone in this roster knows; SpamRATS answers its own test name with 127.0.0.38), and with "does not exist" when it is not. At a listing there is often a TXT record as well, with the reason or the lookup path of the zone itself. Codes in 127.255.0.0/16 are not listings: those are the zone's own error codes, such as "you asked a domain instead of an address".
Two properties make this awkward and interesting. A blocklist knows addresses, not domains: what stands at each of these five zones is the IP address of your mail server, not your domain name. And every zone measures something else: Barracuda lists on the strength of what its own defence network saw, SpamCop on reports from its users and spamtraps, Abuse CBL on detections of compromised and insecure machines, PSBL on mail that arrived at the spamtraps of its participants, and SpamRATS on sensors that watch dynamic addresses, addresses without reverse and spam sources — so a hit at one zone says something very different than a hit at the other. We leave the Spamhaus lists SBL and ZEN out of this tool: those refuse questions from datacentre networks and open resolvers, and from this network their answer cannot reliably be called an answer; Abuse CBL, today Spamhaus' Exploits Blocklist, does answer our self-test.
2. The self-test first: RFC 5782 separates "not listed" from "we know nothing"
A blocklist that does not list you and a blocklist that refuses you both look like "no answer" — and that is exactly the danger. RFC 5782 therefore gave every zone two fixed test names: 2.0.0.127.atthezone must be answered as listed by every honest zone, and 1.0.0.127.atthezone may not be answered by any honest zone. If the listed-test stays silent, the zone does not answer our questions — from our network, because zones may react differently per network — and "not listed" at that zone is not a measurement but ignorance. If the zone answers even its own clean test name, the zone (or the resolver between us) is not to be trusted.
Blacklist check runs that self-test per zone before any question about your address, and shows the outcome in the report: a refused zone gets no address questions and stays n/b, and a half measurement does not produce a "net" verdict. Address questions to the zones concern public IPv4 addresses only — the zones know no IPv6, and private addresses stand on no blocklist by definition.
3. From listing to recovery: every path is different
The treatment differs per zone more than anything else. Barracuda Central has a removal form: IP address, e-mail address, phone number and a substantiated reason; with a valid reason a request is typically handled within 12 hours, and a second request for the same address is ignored — one chance, well argued. SpamCop accepts no removal requests: the address drops out of the list automatically 24 hours after the last report, every new report resets that clock, and up to four hours later the mirrors stand without it too. Abuse CBL removes only through Spamhaus' Reputation Checker, PSBL through its own form that works within half an hour — and expires on its own after a few weeks — and SpamRATS through its removal page, where whoever manages no mail server of their own need do nothing. A listing without knowledge of its source is an unproven accusation: that is why the report carries each zone's own policy and its own removal path, and at a listing the TXT reason the zone itself provided.
Before requesting removal, find the cause: an open relay or a relay unintentionally open, a compromised machine on your network, a web form that mails to arbitrary addresses, a dynamic IP that sends mail anyway, or an address that was already on the list longer than your service. At SpamCop the TXT reason helps — often with a report link — to find the first report; at Barracuda the persuasive argument is that your address, your role (mail server of your domain) and the repair measure make one convincing whole.
4. What the grade does and does not say
The tool judges what it measured: a listing at a zone is a fail, a refused or untrustworthy zone a warning, and only five zones that each passed their self-test and answered clean produce a net verdict. An A means: none of the five zones treats your address as a spam source today — not that you stand nowhere, because there are more blocklists and every zone has different sources. And n/b is not a grade: a refusing zone is no proof of cleanliness.
Start at the measurement side: Blacklist check for your status at the five zones, Mail ports to see whether your mail server is reachable on port 25 at all — the same port senders approach you on — and DNS lookup for the reverse question: the PTR record behind your address, which many zones read as the basis of a mail reputation. Those three together are the reputation side of your mail.