# My domain is blacklisted: how to get it removed

> How to check if your domain is blacklisted (Google Safe Browsing, Spamhaus and others), why it happens, how to request removal and how to protect your email.

URL: https://webintacta.com/en/guides/domain-blacklisted
Language: English (Spanish version: see the hreflang alternate of the HTML page)
Last updated: 2026-10-24

**In short:** If your domain is on a blacklist, browsers warn your visitors (Google Safe Browsing) or your emails stop arriving (Spamhaus and others). The order is: find out which list you are on, remove the cause (malware, spam or a compromised email account) and only then request delisting through each list's own procedure. For email, a correct SPF, DKIM and DMARC setup keeps it from happening again.


By Jose Soriano (WebIntacta) · published 2026-10-24

You notice your domain is on a blacklist in one of two ways: browsers warn your visitors, or your emails stop arriving. In both cases the order is the same: find out which list you are on, remove the cause and, only then, request removal through each list's official procedure.

## What a blacklist is

It is a database of domains or IP addresses with a bad reputation, checked by browsers, antivirus software and mail servers. There is not just one: each organization keeps its own, with its own criteria. The ones that hit a small website hardest:

- **Google Safe Browsing:** used by Chrome, Firefox and Safari. If you are on it, your visitors see a red screen before they get in.
- **Spamhaus DBL (Domain Blocklist):** a list of domains used by a huge number of mail servers to filter spam. If you are on it, your emails, and any emails that link to your site, end up in spam or bounce.
- **Spamhaus IP lists** (part of its combined ZEN list): they affect the IP address you send email from, which on shared hosting is the server's.
- **Microsoft Defender SmartScreen:** the filter in Edge and Windows.
- **Antivirus engines** (the ones VirusTotal brings together): each with its own list.

## How to check

1. **Google:** look up your domain in the [Safe Browsing site status](https://transparencyreport.google.com/safe-browsing/search?hl=en) tool, in Google's Transparency Report. If the site is in Search Console, also check **Security & Manual Actions → Security issues**.
2. **Spamhaus:** look up your domain and your mail server's IP at [check.spamhaus.org](https://check.spamhaus.org/). It is the official tool; Spamhaus explicitly asks people not to query it with automated tools.
3. **VirusTotal:** scan the URL at [virustotal.com](https://www.virustotal.com/) to see which antivirus engines flag it.
4. **Your emails:** if they bounce, read the full bounce message. It usually says which list caused the rejection.

The [free scan](https://webintacta.com/en/free-website-security-scan) checks the domain's reputation on threat lists and reviews the email setup (SPF, DKIM and DMARC). If something comes up, the next step is the official tool of that list.

## Why you were listed

Almost always for one of these reasons, and almost never by bad luck:

- **The site is hacked:** it serves malware, has phishing pages created by the attacker or redirects to scam sites. It is the most common cause on browser lists.
- **Your site or your server sends spam:** an unprotected contact form, an injected script that sends bulk email, or an email account with a stolen password.
- **The domain shows up in someone else's spam:** someone has put links to your site (for example, to spam pages they slipped onto it) in bulk email campaigns.
- **A neighbor on the server:** on shared hosting, the IP can be listed because of what another website does. It affects email, not your domain.

## Clean up first

Requesting removal without removing the cause does not work. The lists check again and add you back, and some treat repeat requesters worse. Before you request anything:

1. **Find and remove the malware**, the spam pages, the backdoors and any users you do not recognize. The guide [how to tell if your WordPress site is hacked](https://webintacta.com/en/guides/how-to-tell-if-wordpress-is-hacked) explains where to look.
2. **Close the way in:** update the vulnerable plugin or module and change every password (hosting, FTP, database, administrators and email accounts).
3. **If the problem is email**, protect the forms against automated submissions, check which accounts are sending and change the password of the compromised one.
4. **Check from the outside** that the affected URLs no longer show anything malicious, in a private window and from a phone.

## How to request removal

### Google Safe Browsing

From Search Console, under **Security issues**, with the **Request Review** button. Explain what was there, what you did and how you have stopped it from happening again. According to Google, security reviews take from a few days to a few weeks; do not send another request while one is pending. I go through it in detail in [Google says my site is dangerous](https://webintacta.com/en/guides/google-says-site-is-dangerous).

### Spamhaus

Removal is requested **only** at [check.spamhaus.org](https://check.spamhaus.org/): you look up the domain or IP and follow the steps it gives you. What is worth knowing, according to Spamhaus:

- **It is free.** Spamhaus never charges to remove a listing; anyone offering to get you off Spamhaus for money is a scammer.
- **Most DBL listings are automatic** and expire on their own once the domain no longer meets the criteria.
- **If the site was hacked**, it has to be cleaned, updated and the passwords changed first.
- Once approved, removal is immediate at Spamhaus, although some servers take up to 24 hours to pick it up.

### Microsoft SmartScreen

If Edge blocks your site, the warning page itself has a link under “More information” to report that the site does not contain threats. Fill it in once the site is clean.

### Antivirus engines (VirusTotal)

VirusTotal does not remove detections: it only shows what the engines say. You have to write to each vendor that flags your site; VirusTotal publishes a list of each vendor's contacts for false positives.

If you prefer, I can handle the paperwork: the Google review is included in every cleanup, and delisting from external blacklists is a €75 surcharge. Cleanups start at €219 (WordPress) and €349 (online stores), with a 90-day guarantee; the details are in [hacked website repair](https://webintacta.com/en/hacked-website-repair).

## SPF, DKIM and DMARC: keeping it from happening again with email

These are three DNS records that say who can send email on behalf of your domain. They will not get you off a blacklist, but they make it much harder for someone to spoof your domain and they improve delivery of your legitimate email. Gmail requires them: every sender needs SPF or DKIM, and anyone sending more than 5,000 messages a day to Gmail accounts also needs DMARC.

- **SPF:** the list of servers allowed to send with your domain. Example: `v=spf1 include:_spf.your-provider.com ~all`. A domain can only have one SPF record.
- **DKIM:** a signature on each email that proves it has not been altered. You turn it on with your email provider, which gives you the DNS record to publish.
- **DMARC:** says what to do with emails that fail SPF and DKIM and where to send reports. Start by monitoring: `v=DMARC1; p=none; rua=mailto:dmarc@your-site.com`. When the reports show that all your legitimate email passes, move to `p=quarantine` and then to `p=reject`.

How to set up each one step by step, the most common mistakes (two SPF records, more than 10 DNS lookups, website email sent without authentication) and how to go from monitoring to rejecting without losing legitimate email, in the guide to [SPF, DKIM and DMARC](https://webintacta.com/en/guides/spf-dkim-dmarc).

And one habit that prevents a lot of listings: do not send newsletters from the website's server. Use an email delivery service, which handles unsubscribes and reputation.

## What to expect afterwards

Getting off a list does not bring everything back to normal instantly. What usually happens:

- **Browsers:** once Google approves the review, the warning stops showing in Chrome and in search results as its data updates. Other browsers that use Safe Browsing take a little longer to reflect it.
- **Email:** even when you are no longer on the list, email providers have their own memory. For a few weeks, some email may keep landing in spam until the domain's reputation recovers through normal sending.
- **Antivirus engines:** each vendor has its own timelines, and some never reply. Prioritize the ones your customers use (Windows' own and the ones most common in businesses).

So you do not find out from a customer next time, check the domain's reputation every so often and turn on email alerts in Search Console: Google writes to you when it detects a security issue. If you receive DMARC reports, glance at them now and then; an unknown sender using your domain shows up there before it shows up on any list.

## Sources

- [Spamhaus: Domain Blocklist (DBL) and removal](https://www.spamhaus.org/blocklists/domain-blocklist/)
- [Google: Security issues report](https://support.google.com/webmasters/answer/9044101?hl=en)
- [Google: Safe Browsing site status](https://transparencyreport.google.com/safe-browsing/search?hl=en)
- [VirusTotal: false positive contacts](https://docs.virustotal.com/docs/false-positive-contacts)
- [Google: email sender guidelines for Gmail](https://support.google.com/a/answer/81126?hl=en)

## Frequently asked questions

### How do I know if my domain is blacklisted?

Check Google's Safe Browsing site status, look up the domain and your mail server's IP at check.spamhaus.org and scan the URL on VirusTotal. If your emails bounce, the bounce message usually names the list.

### How much does Spamhaus delisting cost?

Nothing. Spamhaus never charges to remove a listing. Anyone asking for money to get you off Spamhaus has nothing to do with them.

### Why do my emails go to spam if my website is fine?

The server's IP may be listed because of another website on the same hosting, or SPF, DKIM or DMARC may be missing. Check the bounces and the domain setup before switching providers.

### How long does Google take to remove the dangerous site warning?

According to Google, a security review can take from a few days to a few weeks. It can only be requested from Search Console, and only once the site is clean.

### Is it worth requesting removal if I have not cleaned the site?

No. The lists check the domain again and add you back, and repeated requests can delay the next ones. Clean up and close the way in first.

## About the author

[Jose Soriano](https://webintacta.com/en/about): Full-stack developer specialized in PrestaShop, WordPress and WooCommerce, who has passed the official PrestaShop course and exam. He has been building online stores and modules since 2023 and is the founder of WebIntacta, the website security service through which he scans, cleans and maintains small-business websites and online stores himself, remotely from Ibi (Alicante, Spain). WebIntacta facts: https://webintacta.com/en/about#datos