Module 5 · 5.2

English

Nederlands English Deutsch Français

Reputation and blocklists

Module 5: Reputation and the major providers · Reading time: 10 minutes

Learning objective: After this lesson, you can explain how recipients build up the reputation of an IP address and a domain, check an IP address against blocklists, and follow the right order if you're listed.

Key concepts: reputation, IP reputation, domain reputation, blocklist (DNSBL), Spamhaus (SBL, XBL, PBL), SpamCop, Barracuda, lookup with a reversed IP address, 127.0.0.x response, error code 127.255.255.x, shared IP, warm-up, delisting

What is reputation?

SPF, DKIM and DMARC prove who is sending the mail. They say nothing about whether that sender is trustworthy. A spammer can easily have their own domain with perfectly valid SPF, DKIM and DMARC. That's why recipients also track how a sender behaves. This is called reputation.

There are two types:

IP reputation: how does the mail coming from this IP address behave? Lots of spam, lots of addresses that don't exist, sudden spikes: reputation drops.
Domain reputation: how does the mail behave that's sent on behalf of this domain, measured against the domain in DKIM (d=) and in the sender address? This is becoming increasingly important, because a domain moves with you to a new server, whereas an IP address doesn't.

What counts? Major providers don't publish their exact formula, but they consistently mention the same signals: how many recipients mark your mail as spam (complaints), how much mail goes to addresses that don't exist, whether recipients open, reply to, or immediately discard your mail, how regularly you send, and whether you hit spam traps (addresses nobody ever signed up with). Gmail shows the complaint rate in Postmaster Tools (lesson 5.3), Microsoft shows the picture per IP address in SNDS (lesson 6.4).

Blocklists: a shared blacklist

Besides their own measurements, many mail servers use public blocklists (also called blacklists or RBLs). Such a list contains IP addresses (sometimes domains) that have sent spam or that should never send mail directly. A mail server receiving an incoming connection from 192.0.2.25 queries the list and refuses the connection if the address is on it.

The best known:

List	What's on it	Getting off the list
Spamhaus SBL	Addresses Spamhaus links to spam or spam services	Via the network administrator, after resolving the cause
Spamhaus XBL	Infected machines: viruses, botnets, hacked servers	First fix the infection, then remove via check.spamhaus.org
Spamhaus PBL	Addresses that shouldn't send mail directly, such as home and customer connections	This isn't a penalty. Send mail via your provider's or hosting company's SMTP server
SpamCop	Addresses users have reported as spam	Goes away on its own: within 24 hours at most if there are no new reports
Barracuda	Addresses with a poor reputation according to Barracuda	Removal request via barracudacentral.org

Spamhaus combines its lists in ZEN (zen.spamhaus.org). There are also dozens of smaller lists. Being listed on a small list that almost nobody uses usually isn't a disaster. Being listed on Spamhaus SBL or XBL is: these are used by a large proportion of mail servers.

How does a lookup work?

A blocklist is simply a DNS zone. If a server wants to know whether 192.0.2.25 is on ZEN, it reverses the address (just as with reverse DNS) and appends the name of the list:

dig +short 25.2.0.192.zen.spamhaus.org

No answer (NXDOMAIN): not on the list.
An address 127.0.0.x: it is on the list. The last number indicates which sublist. On ZEN, 127.0.0.2 is the SBL, 127.0.0.4 is the XBL, and 127.0.0.10 or 127.0.0.11 is the PBL.
An address 127.255.255.x: an error code, not a listing. Spamhaus, for example, returns 127.255.255.254 if you query via a public resolver such as Cloudflare's. Spamhaus doesn't permit that, and so doesn't give a real result.

That last point is a well-known pitfall. A tool or mail server that treats every answer as "listed" raises a false alarm, or even refuses all mail. A tool that treats every non-answer as "clean" misses real listings. A reliable check first queries a test address per list (127.0.0.2 is always listed on every list) and only counts a clear NXDOMAIN as "not listed".

The Email Check and Domain Health tools on weboke.nl work this way, as do well-known independent tools like MXToolbox and Spamhaus's own check page (check.spamhaus.org).

Shared IP addresses

With shared hosting and most mail services, you share the sending server's IP address with other customers. This has an advantage and a disadvantage:

A well-managed shared server has built up a reputation. You benefit from this, even if you send little mail yourself.
If another customer sends spam (often because their password has been stolen), the IP address may end up on a list and you'll suffer the consequences too.

A good provider therefore monitors its own IP addresses against blocklists, sets sending limits, and takes action in case of abuse. At WebOké, for example, this is described in the knowledge base article about how spam is blocked and about abused addresses; other providers have similar rules.

A new IP address: warming up

An IP address that has never sent mail before has no reputation. If it immediately starts sending thousands of emails a day, recipients see that as suspicious. Microsoft, for example, slows down such an address with a temporary error (451 4.7.500 Server busy, lesson 6.4).

That's why you warm up a new IP address: you start with a small number of emails per day, preferably to recipients who expect and open your mail, and increase this step by step over a few weeks. Sending services do this for you if you get a dedicated IP address from them. For ordinary business mail through a hosting package or mail service, you don't need to do this.

You're on a list: what now?

The order matters:

Establish which IP address it is. Is it in the error message? Is it the address of your hosting company or mail service, or of your own internet connection? The latter usually means your mail program isn't sending via your provider's SMTP server (lesson 1.4).
If it's not your server, report it to the administrator. With shared hosting or a mail service, the provider resolves this. Include the full error message.
If it is your server, find the cause first. A hacked password, a vulnerable contact form, an infected website sending mail, a purchased address list. As long as the cause remains, you'll be listed again immediately.
Only then request removal, via the list's website. With SpamCop this isn't necessary: the listing expires automatically if no new reports come in.
Check again after a day.

Never pay a party that promises to "get you off all lists". Legitimate lists remove listings free of charge.

In practice: what it looks like

In this example we use the Email Check on weboke.nl: under Blacklist Status, it shows per list whether the IP address of your first mail server is listed. Note: this is the address where your mail arrives (the MX). For your outgoing mail, you need to check the IP address of the sending server, which you get from the headers (lesson 5.1). Independent tools like MXToolbox and check.spamhaus.org work the same way: you enter an IP address and see the result per list.

Summary

Reputation is about behaviour: complaints, unknown addresses, spikes, spam traps. SPF, DKIM and DMARC only say who is sending.
Recipients look at IP reputation and, increasingly, domain reputation.
A blocklist is a DNS zone: a 127.0.0.x response is a listing, 127.255.255.x is an error code, NXDOMAIN means not listed.
Spamhaus PBL isn't a penalty but a sign that you should send via your provider's server.
If you're listed: first establish the correct IP address and the cause, then request removal.

Quiz

Exercise

Exercise Z5.2: Your sending IP on blocklists. Use the IP address of your sending server from the exercise in lesson 5.1 (or the address of mx00.t-online.de). Look it up yourself at check.spamhaus.org or another blocklist tool and fill in: is the address on Spamhaus (yes/no), and if so, on which sublist. The program checks the same address live against Spamhaus, SpamCop and Barracuda and compares.

Exercise O5.2: What do you do about a listing? You're given a case: a small webshop on its own VPS has been on Spamhaus XBL since this morning. Write down, in a maximum of five steps, what you do and in what order. Afterwards you'll see the model answer.

Exercise O5.2: What do you do about a listing?

Scenario: a small online shop on its own VPS has been listed on Spamhaus XBL since this morning; customers aren't receiving their order confirmations. What do you do, in five steps at most?

Your steps:

Your ticks and notes only stay in this browser; we don't send them anywhere. If you're signed in, we only save in My courses that you've done the exercise.

Cookies at WebOké

Cookie settings

Necessary

Marketing