Your WordPress emails suddenly start bouncing, or a customer forwards you a rejection message that mentions Spamhaus, Barracuda or a "blocklist". Your site might be on an email blacklist.
Before you panic, check whether the listing is real and whether it's for the server that actually sends your email. Many people check the wrong IP address. This guide shows you how to check properly, which listings matter, and how to get removed and stay off.
What email blacklists are
A blacklist (also called a blocklist or DNSBL) is a public list of IP addresses or domains linked to spam. Mail servers look up every incoming email against the lists they trust, and reject or spam-folder anything that's listed.
IP blacklists
These list the IP address of the server that delivered the email. Spamhaus, Barracuda, SpamCop and UCEPROTECT are among the best known. A listing usually means spam was seen coming from that IP, or it sits in a range that shouldn't send email directly.
Domain blacklists
These list domain names, both the domain in your From address and any domains linked in the email body. Spamhaus DBL, SURBL and URIBL are common examples. A listing usually means the domain appeared in spam, often because of a hacked site or injected links.
The IP that matters is the one that sends
This is where most checks go wrong. Your website's IP address and your email's sending IP are often different.
- If your site sends through PHP mail(), the sending IP is usually your hosting server, but not always the same IP as your website.
- If you use an SMTP plugin with Brevo, Mailgun, Postmark, SendGrid or Amazon SES, the sending IP belongs to that provider. Your web server's IP doesn't touch the email at all.
So typing your website's address into a blacklist checker can show a listing that doesn't affect your email, or miss the one that does.
To find the real sending IP, look at the email's Received headers. In Gmail, open the email, click the three-dot menu and choose "Show original". Read the Received lines from the bottom up: the first one added by a server outside your own setup shows the IP that handed the email over. That's the one to check.
Or skip the header reading and let a test report find it for you.
How to check with the free test
Get a free test address from WP Mail Tester and send an email to it from your WordPress site, for example with a contact form or your SMTP plugin's test email. When the report loads, run the blacklist check. It's on demand, so click the button in the report to start it.
The check uses the real sending IP and domain taken from your email's headers, not a guess based on your website. It also separates listings that affect delivery from informational ones, so you know which to act on.
Which listings are normal
Not every listing is a problem.
Spamhaus PBL
The Policy Block List isn't a spam list. It lists IP ranges whose owners say they shouldn't send email straight to the recipient's mail server, such as home broadband and many hosting ranges. If your email passes through a proper mail server or email service afterwards, a PBL listing on an earlier hop is normal and harmless.
If your site sends directly from a PBL-listed IP with PHP mail(), the fix isn't delisting. It's sending through a real email service, which our PHP mail vs SMTP guide explains.
Shared hosting IPs
On shared hosting, hundreds of sites can send from the same IP. If one of them sends spam, the whole IP can get listed, and you can't fix another customer's site. Your host may request delisting, but it can happen again. Moving your email to a transactional service removes the shared IP from the picture.
Network-wide listings
Some lists, such as UCEPROTECT Levels 2 and 3, list whole networks or hosting providers rather than your IP. Few major mail providers rely on them. Treat them as informational unless you see real rejections that name them.
Step 1: Confirm the listing affects your email
Check the listed IP or domain against your email headers or test report. If the listing is for an IP your email never passes through, you don't need to do anything. If you're seeing real bounces, the bounce message usually names the list. Start there.
Step 2: Fix the cause before requesting removal
If you request delisting while the cause is still there, you'll be listed again, and some lists make the second removal harder. Common causes on WordPress sites:
- A hacked site sending spam through a malicious plugin or a hidden script. Run a malware scan, update everything, remove plugins and themes you don't use, and change admin passwords.
- Spammy content or links injected into posts or emails. This is the usual reason for domain listings.
- Bulk mail from the web server, such as newsletters sent with PHP mail(). Use a proper newsletter service instead.
- A compromised email account sending spam through your mailbox provider.
Step 3: Request delisting from the major lists
Each list has its own process:
- Spamhaus: use the lookup tool on the Spamhaus website. It explains why the IP or domain is listed and, where removal is possible, guides you through it.
- Barracuda: submit the removal request form on the Barracuda Central website. You'll need the listed IP and a contact email.
- SpamCop: listings expire on their own once spam reports stop. There's no manual removal.
- UCEPROTECT: Level 1 listings expire on their own once the spam stops. You don't need to pay for express removal.
- Microsoft (Outlook, Hotmail): if Outlook rejects your email, use Microsoft's sender support delisting form.
- Domain lists (Spamhaus DBL, SURBL, URIBL): each has a lookup page with a removal request option once the domain is clean.
If your email goes through a transactional email provider and its IP is listed, contact their support. They manage their own IPs and usually act quickly.
Step 4: Stay off the lists
- Send through a transactional email service. Install an SMTP plugin and connect it to Brevo, Mailgun, Postmark, SendGrid or Amazon SES. Their IPs are monitored and protected.
- Set up SPF, DKIM and DMARC so receivers can tell your real email from forgeries. See our SPF, DKIM and DMARC guide.
- Never send bulk mail from your web server. Newsletters and marketing campaigns belong in a newsletter service.
- Keep WordPress, plugins and themes updated, and protect your forms with spam protection so bots can't use them to send mail.
- Re-test after changes. A fresh test with a blacklist check confirms you're clean.
Common questions
My website's IP is listed. Will that block my emails?
Only if your email is sent from that IP. If you send through an email service, it won't. Check the sending IP in your email headers or a test report.
Can I pay to be removed faster?
Some lists offer paid express removal. Don't pay. Fix the cause and use the free process, or wait for the listing to expire.
I was delisted but got listed again. Why?
The cause is still there. A hacked site that keeps sending spam is the usual reason. Clean the site properly before requesting removal again.
Is a blacklist the reason my emails go to spam?
Sometimes, but authentication problems are far more common. If you're not listed, check SPF, DKIM, DMARC and whether you're still using PHP mail(). Our guide to WooCommerce order emails going to spam covers the full fix.