My domain is blacklisted: how to get it removed

What a blacklist is

It is a database of domains or IP addresses with a bad reputation, checked by browsers, antivirus software and mail servers. There is not just one: each organization keeps its own, with its own criteria. The ones that hit a small website hardest:

• Google Safe Browsing: used by Chrome, Firefox and Safari. If you are on it, your visitors see a red screen before they get in.
• Spamhaus DBL (Domain Blocklist): a list of domains used by a huge number of mail servers to filter spam. If you are on it, your emails, and any emails that link to your site, end up in spam or bounce.
• Spamhaus IP lists (part of its combined ZEN list): they affect the IP address you send email from, which on shared hosting is the server's.
• Microsoft Defender SmartScreen: the filter in Edge and Windows.
• Antivirus engines (the ones VirusTotal brings together): each with its own list.

How to check

1. Google: look up your domain in the Safe Browsing site status tool, in Google's Transparency Report. If the site is in Search Console, also check Security & Manual Actions → Security issues.
2. Spamhaus: look up your domain and your mail server's IP at check.spamhaus.org. It is the official tool; Spamhaus explicitly asks people not to query it with automated tools.
3. VirusTotal: scan the URL at virustotal.com to see which antivirus engines flag it.
4. Your emails: if they bounce, read the full bounce message. It usually says which list caused the rejection.

The free scan checks the domain's reputation on threat lists and reviews the email setup (SPF, DKIM and DMARC). If something comes up, the next step is the official tool of that list.

Why you were listed

Almost always for one of these reasons, and almost never by bad luck:

• The site is hacked: it serves malware, has phishing pages created by the attacker or redirects to scam sites. It is the most common cause on browser lists.
• Your site or your server sends spam: an unprotected contact form, an injected script that sends bulk email, or an email account with a stolen password.
• The domain shows up in someone else's spam: someone has put links to your site (for example, to spam pages they slipped onto it) in bulk email campaigns.
• A neighbor on the server: on shared hosting, the IP can be listed because of what another website does. It affects email, not your domain.

Clean up first

Requesting removal without removing the cause does not work. The lists check again and add you back, and some treat repeat requesters worse. Before you request anything:

1. Find and remove the malware, the spam pages, the backdoors and any users you do not recognize. The guide how to tell if your WordPress site is hacked explains where to look.
2. Close the way in: update the vulnerable plugin or module and change every password (hosting, FTP, database, administrators and email accounts).
3. If the problem is email, protect the forms against automated submissions, check which accounts are sending and change the password of the compromised one.
4. Check from the outside that the affected URLs no longer show anything malicious, in a private window and from a phone.

How to request removal

Google Safe Browsing

From Search Console, under Security issues, with the Request Review button. Explain what was there, what you did and how you have stopped it from happening again. According to Google, security reviews take from a few days to a few weeks; do not send another request while one is pending. I go through it in detail in Google says my site is dangerous.

Spamhaus

Removal is requested only at check.spamhaus.org: you look up the domain or IP and follow the steps it gives you. What is worth knowing, according to Spamhaus:

• It is free. Spamhaus never charges to remove a listing; anyone offering to get you off Spamhaus for money is a scammer.
• Most DBL listings are automatic and expire on their own once the domain no longer meets the criteria.
• If the site was hacked, it has to be cleaned, updated and the passwords changed first.
• Once approved, removal is immediate at Spamhaus, although some servers take up to 24 hours to pick it up.

Microsoft SmartScreen

If Edge blocks your site, the warning page itself has a link under “More information” to report that the site does not contain threats. Fill it in once the site is clean.

Antivirus engines (VirusTotal)

VirusTotal does not remove detections: it only shows what the engines say. You have to write to each vendor that flags your site; VirusTotal publishes a list of each vendor's contacts for false positives.

If you prefer, I can handle the paperwork: the Google review is included in every cleanup, and delisting from external blacklists is a €75 surcharge. Cleanups start at €219 (WordPress) and €349 (online stores), with a 90-day guarantee; the details are in hacked website repair.

SPF, DKIM and DMARC: keeping it from happening again with email

These are three DNS records that say who can send email on behalf of your domain. They will not get you off a blacklist, but they make it much harder for someone to spoof your domain and they improve delivery of your legitimate email. Gmail requires them: every sender needs SPF or DKIM, and anyone sending more than 5,000 messages a day to Gmail accounts also needs DMARC.

• SPF: the list of servers allowed to send with your domain. Example: v=spf1 include:_spf.your-provider.com ~all. A domain can only have one SPF record.
• DKIM: a signature on each email that proves it has not been altered. You turn it on with your email provider, which gives you the DNS record to publish.
• DMARC: says what to do with emails that fail SPF and DKIM and where to send reports. Start by monitoring: v=DMARC1; p=none; rua=mailto:dmarc@your-site.com. When the reports show that all your legitimate email passes, move to p=quarantine and then to p=reject.

How to set up each one step by step, the most common mistakes (two SPF records, more than 10 DNS lookups, website email sent without authentication) and how to go from monitoring to rejecting without losing legitimate email, in the guide to SPF, DKIM and DMARC.

And one habit that prevents a lot of listings: do not send newsletters from the website's server. Use an email delivery service, which handles unsubscribes and reputation.

What to expect afterwards

Getting off a list does not bring everything back to normal instantly. What usually happens:

• Browsers: once Google approves the review, the warning stops showing in Chrome and in search results as its data updates. Other browsers that use Safe Browsing take a little longer to reflect it.
• Email: even when you are no longer on the list, email providers have their own memory. For a few weeks, some email may keep landing in spam until the domain's reputation recovers through normal sending.
• Antivirus engines: each vendor has its own timelines, and some never reply. Prioritize the ones your customers use (Windows' own and the ones most common in businesses).

So you do not find out from a customer next time, check the domain's reputation every so often and turn on email alerts in Search Console: Google writes to you when it detects a security issue. If you receive DMARC reports, glance at them now and then; an unknown sender using your domain shows up there before it shows up on any list.

Sources

• Spamhaus: Domain Blocklist (DBL) and removal
• Google: Security issues report
• Google: Safe Browsing site status
• VirusTotal: false positive contacts
• Google: email sender guidelines for Gmail