Summary
When reporting a client mailing from a stolen list to an ESP, the general consensus is to report the incident immediately and allow the ESP a reasonable amount of time to investigate. The suggested timeframe typically ranges from 24 to 72 hours. This duration depends on factors such as the size and responsiveness of the ESP, its history with abuse reports, the level of detail provided in the initial report, and whether the problematic sending continues. Smaller ESPs may require more time due to limited resources. If no action is taken within the given timeframe, it's recommended to follow up and consider escalating the issue to anti-spam organizations, blocklists, or even legal options.
Key findings
- Immediate Reporting: Report the incident as soon as possible with as much detail as possible.
- 24-72 Hour Window: Allow the ESP a 24-72 hour window to investigate the issue before escalating.
- Tiered Approach: Start by reporting to the ESP and then escalate to anti-spam organizations or blocklists if no action is taken.
- ESP Size Matters: Smaller ESPs may need more time to respond due to limited resources.
Key considerations
- Previous History: Consider the previous history and relationship with the ESP when determining the response time expectation.
- Level of Detail: Provide detailed information in the initial report to expedite the investigation.
- Continuous Monitoring: Monitor the situation closely after reporting and see if problematic sending continues. Escalate if needed.
- Escalation Paths: Understand the available escalation paths, including anti-spam organizations, blocklists, and legal options.
What email marketers say
8 marketer opinions
When reporting a client mailing from a stolen list to an ESP, the consensus is to allow the ESP a reasonable response time before taking further action. The suggested timeframe generally ranges from 24 to 72 hours, depending on several factors, including the size and responsiveness of the ESP, the completeness of the initial report, and whether the sending continues after the report. Smaller ESPs may require more time due to limited resources. If no action is taken by the ESP within the given timeframe, escalation to blocklists and potential legal options should be considered.
Key opinions
- Response Time Range: A common response time is between 24-72 hours.
- Tiered Approach: Start with reporting to the ESP, then escalate to anti-spam organizations or blocklists if no action is taken.
- ESP Size Matters: Smaller ESPs might need more time due to limited resources.
- Monitor Sending: Closely monitor if the sending continues after reporting.
Key considerations
- ESP Responsiveness: Consider the ESP's historical responsiveness to abuse reports.
- Report Details: Provide comprehensive information in the initial report to expedite the investigation.
- Escalation Options: Be prepared to escalate to blocklists or legal options if necessary.
- Continuous Monitoring: Continuously monitor email sending activity to verify the issue is resolved.
Marketer view
Email marketer from Webmaster World suggests giving the ESP 24-48 hours to respond before escalating the issue further or taking independent action, like reporting to blocklists.
2 Dec 2021 - Webmaster World
Marketer view
Email marketer from Email on Acid recommends monitoring the situation closely after reporting. If the sending continues, escalate to blocklists and consider legal options.
5 Dec 2022 - Email On Acid
What the experts say
3 expert opinions
Experts recommend that the appropriate response time when reporting a client mailing from a stolen list to an ESP depends on several factors. These include the previous history with the ESP, the size and responsiveness of the ESP, and the level of detail provided in the initial abuse report. While immediate reporting is encouraged, a follow-up within 24-72 hours is advised if no response is received.
Key opinions
- Prior History Matters: The appropriate action depends on previous interactions and history with the specific ESP.
- Detailed Reporting: Providing detailed information in the initial abuse report is crucial.
- Timeframe Variability: Response time expectations vary based on ESP size, responsiveness, and the complexity of the investigation, but a 24-72 hour window is a common benchmark for initial investigation.
Key considerations
- ESP Size: Larger ESPs may require longer response times due to higher volumes of abuse reports.
- ESP Responsiveness: Consider the ESP's usual response time to abuse reports in the past.
- Follow-Up: If no response is received within a reasonable timeframe (24-72 hours), follow up on the report.
Expert view
Expert from Word to the Wise (Laura Atkins) emphasizes the importance of providing detailed information in your abuse report and recommends following up within 24-48 hours if you don't receive a response. The specific timeframe depends on the ESP's size and responsiveness.
28 Sep 2021 - Word to the Wise
Expert view
Expert from Email Geeks explains that the appropriate action depends on the previous history with the ESP.
28 Jan 2022 - Email Geeks
What the documentation says
3 technical articles
Documentation from Spamhaus, RFC-Editor, and M3AAWG suggests reporting a client mailing from a stolen list to an ESP as soon as possible with available evidence. Although Spamhaus doesn't specify a timeframe, RFC-Editor highlights the potentially lengthy human-processed nature of such checks, advising patience. M3AAWG recommends following up within a reasonable timeframe (24-72 hours) to ensure action is being taken and considering escalation if necessary.
Key findings
- Report Immediately: Submit evidence of a stolen list and unsolicited emails to the ESP as soon as possible.
- Process Time Varies: The investigation and response process may take time due to human review and verification.
- Follow-Up Recommended: Follow up on abuse reports within 24-72 hours to ensure the ESP is taking action.
Key considerations
- Evidence is Key: Ensure sufficient evidence is provided when reporting the incident.
- Reasonable Expectations: Be patient and allow the ESP time to investigate, acknowledging it's a manual process.
- Escalation if Needed: If no action is taken by the ESP within a reasonable timeframe, consider escalating the issue.
Technical article
Documentation from Spamhaus explains that they do not specify a time to report, but says if you have evidence of unsolicited emails, or a stolen list, they recommend submitting the evidence as soon as possible.
7 Jun 2024 - Spamhaus
Technical article
Documentation from M3AAWG recommends to follow up on abuse reports within a reasonable timeframe (24-72 hours) to ensure the ESP is taking action. If no action is taken, consider escalating.
7 Jun 2025 - M3AAWG
How can ESPs identify and block spammers before they damage IP reputation?
How can I prevent my domain from being blacklisted due to an infected employee's computer or scraping contact information?
How can I report fraudulent emails and domains to Spamhaus and other relevant organizations?
How can you identify spammers?
What actions should I take if my inbox is spoofed and how will it impact my sender reputation?
Why are ESPs enforcing DMARC policies and what are the implications?
