Mail server IP blacklisted: delisting runbook Pro

When a mail server IP is blacklisted, the pressure is to request delisting straight away. That is the one step that makes things worse if you do it first: the lists that matter re-list within hours when the source is still active, and repeat listings last longer each time. This runbook for a mail server IP blacklisted by Spamhaus, Barracuda, SpamCop or Microsoft gets the order right: confirm, find the source, stop it, clean up, fix authentication, and only then ask for removal, with a relay keeping legitimate mail moving in the meantime.

Symptoms

• Bounces with 550 5.7.1 and a list name: blocked using zen.spamhaus.org, b.barracudacentral.org, bl.spamcop.net.
• Microsoft rejects with S3150 (“part of their network is on our block list”) or S3140.
• Gmail defers with 421-4.7.0 or rejects with 550-5.7.1 ... likely unsolicited mail.
• The Exim or Postfix queue grows into the thousands and customers report delayed mail.

First 5 minutes

Establish the scale before you touch anything: