Spamhaus runs several blocklists, and the one you land on tells you what kind of problem you have and who is expected to fix it. A manual spam listing, an automated reputation hit, a compromised host, and a policy designation all show up as a Spamhaus listing, but the response you owe each one is completely different. The good news is that you never have to guess. The DNS return code names the zone, and the zone names the problem.
Every Check Is a DNS Query
Spamhaus publishes its data as DNS blocklists. A receiving mail server checks an IP by reversing its four octets and looking up an A record under the zone. To check 192.0.2.10, you query 10.2.0.192.zen.spamhaus.org. The zone Spamhaus recommends for IP checks is ZEN, which rolls SBL, CSS, XBL, and PBL into one lookup.
An IP that is not listed returns NXDOMAIN, an empty answer:
$ dig +short 10.2.0.192.zen.spamhaus.org
$
A listed IP returns one or more 127.0.0.x addresses, one per zone that fired. Spamhaus keeps a permanent test point at 127.0.0.2 so you can confirm your integration works. Query it and every dataset answers at once:
$ dig +short 2.0.0.127.zen.spamhaus.org
127.0.0.2
127.0.0.4
127.0.0.10
That single response is three separate diagnoses stacked together: a manual SBL listing, a compromised-host XBL listing, and a PBL policy listing. Read the codes before you do anything else.
The Return Code Is the Diagnosis
Each 127.0.0.x value maps to exactly one Spamhaus dataset.
| Return code | Zone | What it means |
|---|---|---|
127.0.0.2 |
SBL | Manually listed spam source or spam-support resource |
127.0.0.3 |
CSS | Automated low-reputation or snowshoe listing (part of the SBL) |
127.0.0.4 |
XBL | Compromised or exploited host observed sending mail |
127.0.0.9 |
DROP | IP inside a block assigned to a known rogue operator |
127.0.0.10 |
PBL | Policy listing declared by the network operator |
127.0.0.11 |
PBL | Policy listing inferred by Spamhaus |
127.0.0.5 through 127.0.0.7 are reserved for future XBL components and are not currently returned. Anything in the 127.255.255.x range signals an error in how you queried. 127.255.255.254 means your query went through a public or open resolver, which Spamhaus blocks. See that code and the fix is to point your monitoring at a resolver Spamhaus answers, before you read it as a listing. See Spamhaus's own DNSBL usage reference for the full specification.
The TXT Record Tells You Where to Go
The A record tells you which zone. The matching TXT record carries the human-readable detail, including the removal or query URL:
$ dig +short TXT 2.0.0.127.zen.spamhaus.org
"https://check.spamhaus.org/sbl/query/SBL233"
"https://check.spamhaus.org/query/ip/127.0.0.2"
Follow that URL for the specific listing record and the removal path. It is always a check.spamhaus.org link. Spamhaus never charges for removal, so any page asking for payment to delist is a scam.
SBL: A Manual Spam Listing
The Spamhaus Blocklist is the original, manually curated zone, and 127.0.0.2 is its code. A human at Spamhaus listed the IP or range because of evidence it is involved in sending spam. SBL listings often cover whole ranges allocated to operations Spamhaus considers spam sources, not a single address.
If you are on the SBL, something about your sending, or your provider's, drew a manual review and lost. Spamhaus accepts SBL removal requests from the network operator in charge of the listed addresses. Unless you control the IP space yourself, the request has to come from your ISP or hosting provider. Stop the underlying behavior first, then work through whoever owns the range.
CSS: Automated Snowshoe and Low-Reputation Listings
Combined Spam Sources is part of the SBL, returns 127.0.0.3, and is fully automated. It catches senders that look like snowshoe spam, mail spread thin across many IPs and domains to stay under volume thresholds, along with addresses showing poor list hygiene, spamtrap hits, or mail from a compromised or misconfigured host. It frequently hits legitimate senders who are mailing stale lists or running a server that is quietly relaying something they did not intend.
CSS is self-removable, but removal sticks only if the behavior that triggered it stops. Clean your lists, authenticate your mail, and confirm nothing else on the host is sending. Remove without fixing the pattern and you will be back within days.
XBL: A Compromised or Infected Host
The Exploits Blocklist returns 127.0.0.4 and flags IPs that are compromised: hijacked devices, machines running malware that sends mail, exploited vulnerabilities, and hosts seen connecting to sinkholes. An XBL listing says the host appears to be hijacked and says nothing about your marketing practices.
Treat it as a breach until proven otherwise. Find the compromised process or device, clean it, close the hole, then request removal. Delisting an XBL entry without finding the infection just resets a clock.
PBL: This IP Should Not Send Mail Directly
The Policy Blocklist is the one case where a listing is not an accusation. It lists ranges that should not make direct connections to mail servers, typically residential and dynamic address space, and it returns two codes: 127.0.0.10 when the network operator declared the range, and 127.0.0.11 when Spamhaus inferred it. Your home or office broadband IP is probably on the PBL right now, and that is correct.
You only have a problem if a server that legitimately sends mail ends up in PBL space. If the address is static, runs a real outbound mail server, and has matching forward and reverse DNS, you can file a self-service exclusion: look the IP up in the Spamhaus reputation checker and follow the removal steps from an address at that domain. The exclusion expires after a year and is reversed if spam starts coming from the address. Ranges the ISP maintains as dynamic still need the ISP.
Who Has to File the Removal
The code also tells you whose problem the removal is. Filing against the wrong zone is how people burn a week on a request that was never theirs to make.
| Zone | Code | Removal filed by |
|---|---|---|
| SBL | 127.0.0.2 |
The network operator that controls the range, which is you only if you own the IP space |
| CSS | 127.0.0.3 |
Self-service, and only after the triggering behavior stops |
| XBL | 127.0.0.4 |
Self-service, after the host is cleaned |
| PBL | 127.0.0.10 |
The ISP that declared the range |
| PBL | 127.0.0.11 |
Self-service exclusion, if it is a static IP running a real mail server |
A 127.0.0.9 DROP listing is a different animal: it covers netblocks assigned to rogue operators, and a normal sender should never land in one. Our delisting guide covers the removal mechanics once you know which row you are on, and how blacklists affect you covers the deliverability cost while you wait.
Catch the Next One With the Code Attached
A one-off blacklist check shows which zones list an address right now. That is fine for a spot check, but the listing you care about is the one that shows up next Tuesday at 3am. Generator Labs blacklist monitoring watches your IPs and domains across Spamhaus and hundreds of other sources and hands you the return code the moment a zone fires, so the alert already carries the diagnosis. Start monitoring.