VPS IP Blacklisted? How to Check & Delist It (Spamhaus)

Your SPF, DKIM, and DMARC records are all correctly set up, your mail server logs look clean, and yet every third email from your VPS bounces with something like 550 5.7.1 Service unavailable, Client host [x.x.x.x] blocked using Spamhaus. That's not a deliverability tuning problem — that's your server's IP address sitting on a spam blocklist. Here's how to confirm it, understand why it happened, and get it removed.

Symptom

The tell is almost always in the bounce message itself, not in your outgoing mail queue. You'll see NDRs (non-delivery reports) that quote a specific RBL (real-time blackhole list) by name — Spamhaus SBL/CSS, Barracuda Reputation Block List, SORBS, or Spamcop are the ones we see most on VPS mail servers. A few common formats:

• 550 5.7.1 Service unavailable; Client host [203.0.113.45] blocked using Spamhaus SBL
• 451 4.7.1 : Recipient address rejected: Message rejected due to local policy - IP blacklisted by Barracuda Reputation
• 550 Blocked - see https://ipcheck.proofpoint.com/?ip=203.0.113.45

Mail to Gmail, Outlook.com, or Yahoo addresses tends to fail first since those providers lean heavily on third-party RBLs alongside their own reputation scoring. Mail between two SkyServer-hosted domains, or to recipients on smaller providers, may still go through fine — which is why this often looks like an "only some emails fail" mystery at first.

Cause

An IP gets blacklisted when a listing provider's spam traps or abuse reports see enough bad traffic originating from it. On a VPS this almost always traces back to one of these:

Fix

Don't request delisting yet — if the underlying issue isn't fixed, most RBLs will just relist you within hours, and repeat requests hurt your standing with some providers. Work top-down.

1. Confirm which lists you're actually on

Run a multi-RBL lookup rather than trusting a single tool. From your VPS or local machine:

dig +short 45.113.0.203.zen.spamhaus.org
dig +short 45.113.0.203.b.barracudacentral.org
dig +short 45.113.0.203.bl.spamcop.net

(Reverse the IP octets before the zone name — for IP 203.0.113.45 that's 45.113.0.203.) Any non-empty answer means you're listed on that zone. Faster in practice: run your IP through a multi-RBL checker like MXToolbox's blacklist tool or WhatIsMyIPAddress's blacklist check, which query dozens of lists at once and tell you exactly which ones flagged you.

2. Find and stop the actual source

Check the mail queue and logs first — this tells you if it's still actively happening:

mailq | tail -30
grep "status=sent" /var/log/exim_mainlog | tail -100
grep "SASL LOGIN authentication failed" /var/log/maillog

A queue with hundreds of stuck outbound messages to unfamiliar domains is the clearest sign of a live spam run. On cPanel/WHM servers, check WHM > Email > Mail Delivery Reports and Track Delivery to see which account or script is generating the volume. If it's a specific mailbox, force a password reset immediately:

whmapi1 passwd user=youraccount password='NewStrongPassword!23'

If it's a compromised WordPress install, isolate it: pull the site offline, scan with something like ImunifyAV or a WP-CLI malware scanner, and check wp-config.php and recently modified theme/plugin files for injected mail() or base64_decode calls. Rotate every credential on that account — database, SFTP, WordPress admin — not just the one you suspect.

3. Lock down the mail server itself

While you're in there, close the gaps that let this happen again:

• Confirm Postfix/Exim rejects relaying from unauthenticated senders (smtpd_relay_restrictions in Postfix, or the relay ACLs in Exim's config)
• Require SMTP AUTH over TLS only — no plaintext auth on port 25/587
• Rate-limit outbound mail per account so one runaway script can't send thousands of messages in minutes (cPanel's built-in "Max Emails Per Hour" per account, or Postfix's anvil limits)
• Enable fail2ban jails for SMTP auth failures so credential-stuffing attempts get banned quickly

4. Request delisting — per provider

Once you're confident the source is fixed, submit removal requests. Each list has its own process and timeline:

Be honest and specific in the removal request: state what caused the listing and what you changed. Vague "please remove us" submissions get rejected more often than ones that say "compromised WordPress account was cleaned, credentials rotated, relay restricted to authenticated users on [date]."

5. If it's a shared/legacy IP problem

If the listing predates your account and nothing on your side explains it, ask SkyServer support to check whether the IP has a history on that block. In some cases we can assign a clean IP from a different range faster than waiting out a stubborn RBL. This is a support-ticket request, not a DIY fix — don't try to route around it by changing PTR records yourself, since a mismatched PTR creates a second deliverability problem on top of the first.

Prevention

• Set outbound email rate limits per cPanel account so a compromised script can't send thousands of messages before anyone notices
• Keep WordPress core, plugins, and themes patched — most spam-run compromises ride in through an outdated plugin, not a zero-day
• Use unique, long SMTP/mailbox passwords and rotate them if you ever suspect a leak elsewhere
• Set up a PTR record that matches your sending domain — many providers score mail lower or reject it outright without one
• Monitor your IP proactively with a free tool like MXToolbox's monitoring alerts, so you hear about a listing within the hour instead of from a customer complaint
• If you run high-volume transactional mail, consider routing it through a dedicated sending service (Amazon SES, SendGrid, Mailgun) instead of your VPS's own IP — that isolates your marketing/transactional volume from your general server reputation

Frequently Asked Questions

How do I know which specific mailbox or script caused the blacklisting?

Check your mail server logs (/var/log/maillog or /var/log/exim_mainlog) for the time window right before the listing appeared, and look for a spike in outbound volume from one account. In WHM, Mail Delivery Reports will usually show one sender dominating the queue.

Will changing my server's IP address fix this immediately?

It removes the immediate symptom, but not the cause — if the compromised script or open relay is still there, the new IP gets listed too, often within days. Fix the source first; only ask for a new IP if support confirms the current one has unrelated history.

How long does it take to get delisted?

Spamhaus and Barracuda are usually the fastest — minutes to a few hours once the trigger is resolved. SORBS and some corporate filters (Microsoft, Proofpoint-protected domains) can take one to three business days. Spamcop listings expire on their own if your traffic stays clean.

Can I be listed on one RBL but not others?

Yes, and it's common. Each list has its own scoring criteria and spam-trap network, so a burst of bad traffic might trip Spamhaus but not Barracuda, or vice versa. Always check multiple lists rather than assuming a clean result on one means you're fully clear.

Does this affect my website, or only email?

Only outbound mail is affected by these blocklists — your website itself stays up and reachable. The one exception is if your web application relies on transactional email (password resets, order confirmations, contact forms) sent from the same server; those will bounce or silently fail until the listing clears.