Removing a mail server from the Spamhaus PBL

If you run a mail server on your slice and find that email sent from your server is being rejected as potential spam, your slice may be on the Spamhaus PBL. Don't be alarmed — that's actually pretty normal. This article will tell you how to get off the PBL quickly and easily.


The Spamhaus policy block list

Spamhaus assists Internet service providers with preventing unsolicited email (spam) from passing through their mail servers. One of the tools Spamhaus employs is a "Policy Block List" (PBL) that lists addresses that get assigned to customers of dial-up, broadband, and hosting service providers. Those addresses are then blocked by default and have to be manually removed from the list when someone has a legitimate need to use one of those addresses to run a mail server (as many Slicehost customers do). It is therefore likely that a new slice, or one that hasn't been used as a mail server before, will be on the Spamhaus PBL.

Being on the PBL doesn't mean your address is blocked for spamming. The list is only there as a precaution against potential abuse. Spamhaus applies this policy to any IP addresses that could change hands from one customer to another. Their goal is to prevent computers that should not be sending email directly from being able to do so if they are compromised in some way.

How to get off the list

Fortunately it's easy to check the Spamhaus PBL to see if your slice's IP address is on the list, and it's also easy to remove it. Go to the Spamhaus Block List Removal Center and enter your slice's IP address. If your address is listed in the PBL you will be provided with a link you can use to remove it. Note that the removal process requires the use of an email account that is not part of a free service (like gmail.com or hotmail.com). Since the PBL does not prevent a mail server from receiving mail (only from sending it to destinations that employ the Spamhaus service), you can use an email address from your blocked mail server for the Spamhaus verification process.

  • -- Jered

Article Comments:

Tom Dogg commented Tue Jan 26 20:38:27 UTC 2010:

If you need to know if your IP is blocked somewhere on the net, you may also want to check a large number of other black list providers with just 1 click:

http://www.mxtoolbox.com/SuperTool.aspx

Max commented Sat Feb 20 12:00:09 UTC 2010:

Thanks, at least from now on I will know how what to do if I'll appear in such a situation.

Neil commented Sun Feb 21 03:35:15 UTC 2010:

It would be great if you have notified slice owners of this possible problem. I was just notified by my users that they are not receiving mail for a password reset.

May help to proactively warn and prevent the issue.

Thanks.

Essay commented Wed Jul 14 12:29:03 UTC 2010:

I just had this problem. I wish I read this article a month earlier. But still thanks a lot.

John commented Wed Jul 28 20:47:46 UTC 2010:

Is there a solution for this on a going forward basis? I've been put back on the list and have very low email volume.

Jered commented Wed Aug 04 15:18:48 UTC 2010:

I'm afraid the only solution is to remove yourself again, though being put back on there is unusual. Spamhaus alone is responsible for their policies and listings.

Cholo commented Mon Dec 13 16:54:31 UTC 2010:

I have been placed on this PBL no less that twice in 6 months. I go through the same process of removing it. Twice is enough.
Slicehost folks: is there anything you can do? Help!

Anti-SPAMHUSist commented Wed Jan 26 19:37:44 UTC 2011:

This article is wrong. At least with all my ISPs.

All ip-addresses of an ISP are blacklisted irrespectively whether they are involved in criminal activities or not.

One cannot remove individual ip-address individually.

See:
http://goo.gl/qXRgG

Jered commented Thu Jan 27 15:42:47 UTC 2011:

Looking at the link, we're talking about different blacklists. Spamhaus maintains several of different types. The blacklist your link talks about is the "SBL", the blacklist they use to indicate likely spam sources. The "PBL" referenced in this article is a list they keep of potential sources of spam - addresses associated with hosting services that are distrusted by default but haven't been recorded doing anything wrong. You can get off the PBL easily, but they're more reluctant to remove addresses from the SBL.

I have no idea why a particular ISP's addresses would be put on the SBL instead of the PBL. We're not affiliated with Spamhaus in any way.

Vic commented Thu Apr 21 05:21:43 UTC 2011:

Getting ur IP blocked twice in 6 months is okay but getting ur IP blocked twice a day is very hectic so is there any solution to avoid this??

Jeremy commented Sat Dec 03 16:50:39 UTC 2011:

Unfortunately, the statement "Being on the PBL doesn't mean your address is blocked for spamming," is not entirely correct. Being on the PBL means that email sent from your server will be blocked by Yahoo, Hotmail, and most corporate and government mail servers. So while you're not block "for spamming" you are blocked for "potential abuse", but you're still blocked.

FWIW, I was told by Slicehost Support that they are continually trying to work to change this with Spamhaus but Spamhaus is uncooperative and every once in a while re-lists Slicehost/Rackspace IP's as being dynamic, even though Rackspace doesn't provide internet service.

Mark Dobson commented Mon Dec 05 18:43:49 UTC 2011:

FYI, as of 12/5/2011, a number of Slicehost addresses have been re-added to the PBL.

Here's one example,

http://www.spamhaus.org/pbl/query/PBL340779

(174.143.149.0/25)

I've requested that this particular /25 be removed from the PBL

David Wall commented Tue Jan 29 22:18:28 UTC 2013:

The PBL is a real pain because it even says you won't be off for more than a year after you request it be removed, and there's no warning you are about to be added back in so you only learn after you've suffered the problems. This is ugly if you are serving customers because they don't care if it's you, Rackspace or whatever for their problems, they just want it working, and even when removed from the PBL, it can take anywhere form 45 minutes to 1 day to be off lists since people like ATT, AOL, etc. may not refresh their caches for an arbitrary amount of time.

This link suggest that Rackspace can take ownership of their IP address blocks, and then can use it to remove assigned IPs so they don't get on the PBL. This is what Rackspace should be doing (assuming this works!): http://www.spamhaus.org/faq/section/Spamhaus%20PBL#240

Want to comment?


(not made public)

(optional)

(use plain text or Markdown syntax)