InboxGrade

Listed on Spamhaus CBL (Composite Blocking List)

The sending IP is listed on the Spamhaus Composite Blocking List (CBL), indicating active infection or exploitation emitting spam, malware, or botnet traffic.

Impact — Critical impact

A CBL listing feeds directly into Spamhaus ZEN, which is consulted by the majority of inbound MTAs worldwide — expect near-total mail rejection with 554 5.7.1 SMTP errors referencing zen.spamhaus.org. Because CBL only lists IPs exhibiting malicious automated behavior (open proxies, trojans, SMTP engines, botnet C2 traffic), the listing is treated as high-confidence evidence of compromise rather than mere reputation drift. Delisting without first identifying and removing the underlying infection or misconfiguration guarantees an immediate relisting, typically within hours.

What causes it

  1. A host on the IP (or sharing its NAT egress) is infected with malware acting as an SMTP engine — e.g., Emotet, Phorpiex, or a Mirai variant pumping spam via smtp.gmail.com-style relays or direct port 25.
  2. An unauthenticated SMTP relay, misconfigured postfix mynetworks, or exposed sendmail instance is being abused as an open relay by external attackers.
  3. A compromised web application (WordPress, Joomla, phpMailer endpoints) is being used to blast outbound mail via PHP mail() with no rate limiting or authentication.
  4. Credential stuffing succeeded against a user mailbox and the attacker is sending authenticated spam through your submission service on port 587.
  5. Outbound NAT shared with CPE/IoT devices (routers, cameras, DVRs) running vulnerable firmware that has been enrolled into a botnet.

How to fix it

Confirm the listing and read the CBL evidence

Query zen.spamhaus.org directly and visit the CBL lookup page — it returns a timestamp, observed protocol, and malware family or behavior fingerprint (e.g., cutwail, necurs, smtp-auth-abuse). This evidence tells you what to hunt for; do not skip it.

dig +short 1.2.3.4.zen.spamhaus.org
# Full detail:
# https://check.spamhaus.org/listed/?searchterm=1.2.3.4

Identify the source of outbound SMTP from the IP

On the sending host, enumerate every process touching port 25 or 587 and inspect queue depth. If you NAT multiple hosts behind this IP, run the same checks on each. Any process you did not deploy — especially under /tmp, /dev/shm, or a web user account — is suspect.

ss -tnp state established '( dport = :25 or dport = :587 )'
postqueue -p | tail
journalctl -u postfix --since '24 hours ago' | grep -E 'client=|sasl_username='

Remediate the root cause before requesting delisting

If malware is confirmed, isolate and reimage the host — do not attempt live cleanup on a server that will keep sending auth-worthy mail. If it is an open relay, lock smtpd_relay_restrictions to permit_mynetworks, permit_sasl_authenticated, reject. If it is auth abuse, rotate the compromised credentials, enforce submission rate limits, and block the attacker's ASN at the edge.

# Postfix hardening
postconf -e 'smtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated, reject'
postconf -e 'smtpd_client_connection_rate_limit = 10'
postconf -e 'smtpd_client_message_rate_limit = 30'
systemctl reload postfix

Submit the self-service CBL delisting

Once the source is remediated, use the CBL self-service form at the Spamhaus lookup URL. Delisting is automated and typically clears within minutes, but Spamhaus throttles repeat delisters — a second listing on the same IP within 30 days triggers escalation and may require manual review. Warm up gradually afterward; a flood of mail immediately post-delist will spike your IP reputation score at every major receiver.

curl -s 'https://check.spamhaus.org/listed/?searchterm=1.2.3.4' | grep -i 'remove'

Fixed it? Run a fresh test to confirm.

Test my inbox →

Related errors