Why Is My Email on a Blocklist, and How Do I Get Off?

Blocklists are the part of email nobody explains until you are already on one. Mail stops arriving. Some recipients get everything, others get nothing. There is no notification, no dashboard, and no obvious way to find out what happened.

Here is how a domain ends up on one, how to check in a few seconds, and what actually gets you removed.

What a blocklist is

A blocklist — you will also see blacklist, DNSBL, or RBL — is a published list of domains and internet addresses associated with spam or malicious mail. Mail servers around the world consult these lists in real time. If you appear on a significant one, receiving servers may refuse your message outright or file it in spam without ever showing it to a person.

There are dozens of these lists. They are run by different organisations, with different rules, different thresholds, and different removal processes. A few carry real weight across the industry; many are obscure enough that appearing on them changes nothing.

That variation is the first useful thing to know. Being listed somewhere is not automatically an emergency. Being on a major list is.

How ordinary businesses end up on one

Almost nobody reading this sent spam. The realistic causes are far more mundane.

A mailbox was compromised. Someone guessed or phished a password and used the account to send. This is the most common serious cause, and the sending usually stops before you notice — but the listing remains.

You share an address with someone who did. On shared hosting, many sites send from the same internet address. Your neighbour's behaviour becomes your reputation. You did nothing, and you are on the list.

You sent something that looked like bulk mail. Two hundred recipients from a normal mailbox, an announcement to your whole customer list, an old address book that had not been cleaned in years. Filters cannot distinguish enthusiasm from spam, and a burst of mail to addresses that no longer exist is a strong signal.

Your authentication is broken. If SPF, DKIM and DMARC do not line up, your mail is already unverified, which makes every other signal count against you more heavily.

You inherited it. New domain, new server address, previous occupant with a history. This one feels particularly unfair and is genuinely common.

Check before you assume

Guessing is the slowest way to solve this.

Run the Blacklist Checker on your domain. It checks the domain and its address against the major spam and malware blocklists and tells you plainly which, if any, you are on. Complimentary, no signup, a few seconds.

Then run the Email Deliverability Test. If mail is not arriving, a listing is one possible cause and broken authentication is a more common one — and the two interact. Fixing the second is usually a prerequisite for the first sticking.

Getting removed

The process is more civilised than people expect, and the order matters.

First, find and stop the cause. Delisting before fixing the underlying problem gets you relisted within days, often with less patience the second time. Change the passwords on every mailbox on the domain. Turn on multi-factor authentication. Check your sent folders for messages you did not write. If it was a bulk send, stop sending that way.

Second, fix the authentication. Get SPF listing everything that sends for you, turn DKIM on, publish DMARC. This is what convinces a list you are a legitimately run domain rather than a temporarily quiet one.

Third, request delisting. Each list has its own form and its own timescale. Most major ones are straightforward and free, and many delist automatically once the behaviour stops. Be honest on the form about what happened and what you changed — these are read by people, and a specific answer moves faster than a generic plea.

Then wait. Some listings clear in hours, others take days. Reputation recovers gradually rather than instantly, so mail may still be treated cautiously for a while after removal.

Two things to avoid: any service charging a meaningful fee to "remove you from all blacklists," which is mostly submitting the same free forms you can submit; and repeatedly requesting delisting without changing anything, which is noted.

The part that prevents the repeat

Nearly every listing we see traces back to one of two things: a mailbox with a weak password and no second factor, or mail authentication that was never completed.

Both are one-time fixes. Both are unglamorous. Together they close off most of the realistic routes onto a list in the first place.

Where we come in

On managed Microsoft 365, mail authentication is configured when the account is set up and kept current as you add software, multi-factor authentication is available on every account, and the mail does not go out from an address shared with strangers. Email starts at $6 per user per month with migration included — no downtime, nothing lost on the way over.

If you are on a list right now and mail is not arriving, that is exactly the kind of thing to raise with us as a case. The assistant is there at any hour, and anything that needs a person gets a reply within one business day rather than disappearing into a queue.

Start here: run the Blacklist Checker on your domain. Most businesses that check find they are clean, which is worth two minutes of your afternoon on its own.