IP Address Blacklisted on RBL

1. Identify your outgoing mail server IP

# Find the public IP your mail server uses
curl -4 https://ifconfig.me

# Or check the mail server's bound interface
postconf inet_interfaces
postconf mynetworks

2. Check your IP against major blocklists

Use the MXToolbox or manual lookups:

# Check Spamhaus ZEN (covers SBL, XBL, PBL, DBL)
host YOUR_IP.zen.spamhaus.org
# If listed: returns 127.0.0.x (not NXDOMAIN)

# Check Barracuda
host YOUR_IP.b.barracudacentral.org

# Check SORBS
host YOUR_IP.dnsbl.sorbs.net

# Check SpamCop
host YOUR_IP.bl.spamcop.net

# Helper: query all common DNSBLs (replace 1.2.3.4 with your IP reversed)
# For IP 203.0.113.5, reversed = 5.113.0.203
for rbl in zen.spamhaus.org b.barracudacentral.org bl.spamcop.net dnsbl.sorbs.net cbl.abuseat.org; do
    result=$(host 5.113.0.203.$rbl 2>&1)
    if echo "$result" | grep -q "127\."; then
        echo "LISTED on $rbl"
    else
        echo "Clean on $rbl"
    fi
done

3. Investigate why you were listed

# Check mail logs for spam-like outbound activity
sudo grep "status=sent" /var/log/mail.log | awk '{print $7}' | sort | uniq -c | sort -rn | head -20

# Look for unusually high message volume from one account
sudo grep "from=<" /var/log/mail.log | awk '{print $7}' | sort | uniq -c | sort -rn | head -20

# Check for open relay test (should be rejected)
telnet YOUR_IP 25
EHLO test.example.com
MAIL FROM:<[email protected]>
RCPT TO:<[email protected]>
# Should return: 554 Relay access denied

4. Review SPF and DKIM alignment

# Check SPF record for your domain
dig TXT yourdomain.com | grep spf

# Check DKIM public key exists
dig TXT default._domainkey.yourdomain.com

Step 1: Stop the bleeding — identify and block the spam source

# If a compromised account is sending spam, disable it
sudo postfix flush           # Clear queued mail
sudo mailq | head -50        # Inspect queued messages for patterns

# Temporarily restrict outbound SMTP if under active attack
sudo iptables -A OUTPUT -p tcp --dport 25 -j DROP  # Extreme measure — use only if needed

Step 2: Remove from blocklists

Each major blocklist has its own removal process:

• Spamhaus: https://www.spamhaus.org/lookup/ — automated removal for PBL; SBL requires investigation.
• Barracuda: https://www.barracudacentral.org/rbl/removal-request — free self-service.
• SpamCop: Auto-expires after 24h of no reported spam.
• CBL/Abuseat: https://www.abuseat.org/lookup.cgi — automated.

Step 3: Fix the root cause before requesting removal

# Ensure SPF record authorises your sending IP
# Example: v=spf1 ip4:YOUR_IP include:_spf.google.com ~all

# Verify DKIM signing is active
sudo opendkim-testkey -d yourdomain.com -s default -vvv

# Add DMARC record to signal policy
# _dmarc.yourdomain.com TXT "v=DMARC1; p=quarantine; rua=mailto:[email protected]"

Step 4: Submit removal request and monitor

After cleanup, submit removal requests with evidence that the issue is resolved. Monitor re-listing with a daily cron job.

# Daily check script
for rbl in zen.spamhaus.org b.barracudacentral.org bl.spamcop.net; do
    host $(echo YOUR_IP | awk -F. '{print $4"."$3"."$2"."$1}').$rbl | grep -q "127\." && echo "LISTED: $rbl" || echo "Clean: $rbl"
done

• Publish SPF, DKIM, and DMARC records: Proper email authentication dramatically reduces spam classification and protects your sending reputation.
• Avoid shared IPs for transactional email: Use a dedicated sending IP via a reputable ESP (SendGrid, Postmark, SES) rather than your general-purpose server IP.
• Monitor your IP proactively: Schedule weekly RBL checks; integrate with UptimeRobot or a monitoring service that alerts on new listings.
• Lock down SMTP relay: smtpd_relay_restrictions = permit_mynetworks reject_unauth_destination in Postfix — never allow open relay.
• Rotate compromised credentials immediately: If a listing follows a breach, rotate all SMTP authentication credentials and audit mail server access logs.