🚫 Spamhaus ZEN
What Spamhaus ZEN actually checks, which sub-zone you are on, and how to get delisted from SBL, XBL or PBL.
Published · Last verified · Maintained by TamingDNS
ℹ️ About This Blocklist
ZEN bundles four Spamhaus lists into one query: SBL (known spammers), CSS (snowshoe and other static spam emitters, published inside the SBL zone), XBL (hijacked and compromised machines), and PBL (ranges that should not be sending mail directly). Spamhaus describes it as "the combination of all Spamhaus' free IP-based DNSBLs into one single powerful and comprehensive blocklist".
What a Listing Means
The IP is flagged by at least one of the four lists, and the return code says which. SBL means a known spam operation, CSS an automated behavioural listing, XBL a compromised or botnet host, PBL a range declared as non-sending.
🔢 DNSBL Return Codes
When listed, the DNSBL returns one of these 127.x.x.x addresses. The specific code indicates the reason for the listing.
| Return IP | Meaning |
|---|---|
| 127.0.0.2 | SBL: direct spam source |
| 127.0.0.3 | SBL CSS: snowshoe spam operation |
| 127.0.0.4 | XBL: compromised or infected host (CBL data) |
| 127.0.0.9 | SBL: Spamhaus DROP or EDROP listing |
| 127.0.0.10 | PBL: range declared non-mail by the ISP |
| 127.0.0.11 | PBL: range declared non-mail by Spamhaus |
✅ How to Request Delisting
Run the IP through the Spamhaus Blocklist Removal Center to see which sub-zone hit. SBL and XBL have self-serve removals. PBL removal goes through your ISP or the Spamhaus PBL form.
Request Removal from Spamhaus ZEN ↗📚 Official Documentation
🔍 Check Your IP or Domain Against Spamhaus ZEN
Run a live blacklist check against all 20 blocklists we monitor, including Spamhaus ZEN.