Spamhaus ZEN Blocklist
Spamhaus ZEN combines four IP blocklists into one query to help filter spam and malicious traffic. Use Suped to monitor your standing on this blocklist.
Updated on 17 Jun 2026: We updated this guide with clearer ZEN query guidance, return codes, resolver errors, and delisting steps by component list.
Summarize with
Check if you are listed on Spamhaus ZEN Blocklist
And 143 other blocklists.
Spamhaus
0Spam
Cisco
NoSolicitado
URIBL
abuse.ro
ALPHANET
Anonmails
Ascams
BLOCKEDSERVERS
Calivent Networks
EFnet
JustSpam
Kempt.net
NordSpam
RV-SOFT Technology
Scientific Spam
Spamikaze
SpamRATS
SPFBL
Suomispam
System 5 Hosting
Team Cymru
Validity
www.blocklist.de Fail2Ban-Reporting Service
ZapBL
2stepback.dk
Fayntic Services
ORB UK
technoirc.org
TechTheftSpamhaus0SpamCiscoNoSolicitadoURIBLabuse.roALPHANETAnonmailsAscamsBLOCKEDSERVERSCalivent NetworksEFnetJustSpamKempt.netNordSpamRV-SOFT TechnologyScientific SpamSpamikazeSpamRATSSPFBLSuomispamSystem 5 HostingTeam CymruValiditywww.blocklist.de Fail2Ban-Reporting ServiceZapBL2stepback.dkFayntic ServicesORB UKtechnoirc.orgTechTheftSpamhaus0SpamCiscoNoSolicitadoURIBLabuse.roALPHANETAnonmailsAscamsBLOCKEDSERVERSCalivent NetworksEFnetJustSpamKempt.netNordSpamRV-SOFT TechnologyScientific SpamSpamikazeSpamRATSSPFBLSuomispamSystem 5 HostingTeam CymruValiditywww.blocklist.de Fail2Ban-Reporting ServiceZapBL2stepback.dkFayntic ServicesORB UKtechnoirc.orgTechTheftSpamhaus0SpamCiscoNoSolicitadoURIBLabuse.roALPHANETAnonmailsAscamsBLOCKEDSERVERSCalivent NetworksEFnetJustSpamKempt.netNordSpamRV-SOFT TechnologyScientific SpamSpamikazeSpamRATSSPFBLSuomispamSystem 5 HostingTeam CymruValiditywww.blocklist.de Fail2Ban-Reporting ServiceZapBL2stepback.dkFayntic ServicesORB UKtechnoirc.orgTechTheftSpamhaus0SpamCiscoNoSolicitadoURIBLabuse.roALPHANETAnonmailsAscamsBLOCKEDSERVERSCalivent NetworksEFnetJustSpamKempt.netNordSpamRV-SOFT TechnologyScientific SpamSpamikazeSpamRATSSPFBLSuomispamSystem 5 HostingTeam CymruValiditywww.blocklist.de Fail2Ban-Reporting ServiceZapBL2stepback.dkFayntic ServicesORB UKtechnoirc.orgTechTheftWhat is the Spamhaus ZEN blocklist?
The Spamhaus ZEN Blocklist is an IP-based DNSBL (DNS blocklist) that combines Spamhaus's free IP blacklists into one DNS zone. It includes SBL, CSS, XBL, and PBL, so mail servers can perform one blacklist (blocklist) query instead of querying each component list separately.
Email administrators at internet service providers, corporations, and other organizations use ZEN to evaluate connecting IP addresses during SMTP traffic. A positive result can reduce spam, phishing, malware, and botnet-driven mail before messages move deeper into the filtering pipeline. Because ZEN is an IP list, it does not evaluate suspicious domains or URLs inside accepted messages.
ZEN includes four component IP lists:
- SBL (Spamhaus Blocklist) lists IPs identified as direct spam sources, spam operations, or spam-support infrastructure.
- CSS (Combined Spam Sources) lists IPs sending low-reputation or spam-like email, including unsolicited bulk email and misconfigured systems.
- XBL (Exploits Blocklist) lists exploited hosts, malware-infected devices, open proxies, and other sources of botnet or trojan-driven abuse.
- PBL (Policy Blocklist) lists IP space that should not send email directly to the internet, including many residential, dynamic, and provider-designated ranges.
For most configurations, ZEN should be queried at zen.spamhaus.org. Querying SBL, CSS, XBL, and PBL separately after querying ZEN adds duplicate DNS traffic because ZEN already returns the component-list result codes.
A ZEN DNS query can return multiple answers in one DNS response when the IP is listed on more than one component blacklist. Each answer has a distinct return code, which gives administrators more detail than a simple listed or not-listed result.
Who runs the Spamhaus ZEN blocklist?
The Spamhaus ZEN Blocklist is operated by the Spamhaus Project, a non-profit organization founded by Steve Linford in 1998. Spamhaus tracks IPs, domains, and networks associated with spam, phishing, malware, ransomware, botnets, and other abuse.
Spamhaus publishes DNSBL data for mail filtering and network protection. Public DNSBL mirror access is limited by fair use criteria, including non-commercial use, reasonable query volume, and identifiable DNS query sources.
How do Spamhaus ZEN return codes work?
A ZEN DNS query returns one or more 127.0.0.* answers when the queried IP is listed. Multiple answers can appear in the same DNS response when the IP is on more than one component blacklist.
Common ZEN return codestext
127.0.0.2 SBL listing 127.0.0.3 CSS listing 127.0.0.4 XBL listing 127.0.0.9 SBL DROP data 127.0.0.10 PBL, ISP-maintained 127.0.0.11 PBL, Spamhaus-maintained NXDOMAIN IP is not listed
Responses in the 127.255.255.* range are error signals, not blacklist listings. Common causes include a misspelled DNSBL zone, queries through a public or open resolver, or query volume that exceeds the allowed use pattern.
For a manual resolver test, reverse the IP and append zen.spamhaus.org. For example, a test query for 192.0.2.10 would use 10.2.0.192.zen.spamhaus.org.
Do not automate lookups against the Spamhaus website checker. Mail-server checks should use DNS queries, and website checks should be kept to manual investigation of a specific IP or domain.
How do I get delisted from the Spamhaus ZEN blocklist?
A ZEN listing means the IP appears on at least one component list: SBL, CSS, XBL, or PBL. Start by checking the listed IP in Spamhaus's IP and Domain Reputation Checker, then follow the instructions for the specific component list. Do not request delisting until the source of abuse or the policy mismatch has been fixed.
Removal differs by component list. SBL listings often require the network owner or provider abuse team to work with Spamhaus. XBL and CSS listings usually require fixing a compromised host, malware infection, proxy, spam source, or sending configuration issue. PBL listings are often normal for residential, dynamic, or provider-designated IP space and should only be changed when the IP is meant to send direct-to-internet mail.
Before requesting removal, fix the operational cause and record the evidence:
- Restrict outbound SMTP traffic to approved mail servers on destination port 25.
- Check infrastructure providers and recent network changes for abused, reassigned, or misrouted IP space.
- Use confirmed or double opt-in for marketing lists to reduce spam-trap risk and complaints.
- Verify hostname, HELO/EHLO, and reverse DNS (PTR) consistency for every outbound mail server.
- Authenticate legitimate mail with SPF, DKIM, and DMARC, then monitor aggregate reports for unauthorized sources.
Some fixes require coordination with network administrators, abuse teams, or the owner of the affected IP range. Keep change logs for malware cleanup, firewall rules, account suspensions, DNS corrections, and authentication fixes so the delisting request has clear remediation evidence.
Suped can help teams compare Spamhaus ZEN events with DMARC, SPF, and DKIM data, so investigation starts with the sending sources and authentication changes most likely to explain the listing.
What is the impact of a Spamhaus ZEN listing?
The impact of being listed on the Spamhaus ZEN Blocklist is high. Mail servers using ZEN can reject mail during SMTP, quarantine it, or apply stronger filtering to messages sent from the listed IP. A shared sending IP can affect every domain using that IP, even when one sender caused the listing.
Bounce messages and SMTP logs usually identify the rejected IP and sometimes include the Spamhaus return code or checker reference. Treat that evidence as the starting point, because a ZEN result points to a specific component blacklist with its own policy and removal path.
Other Spamhaus blocklists
Spamhaus Blocklist (SBL)
Organization
Spamhaus
Zone
sbl.dq.spamhaus.net
Type
IP
Impact
High
Delisting
Manual
Spamhaus Domain Blocklist (DBL)
Organization
Spamhaus
Zone
dbl.dq.spamhaus.net
Type
Domain
Impact
High
Delisting
Manual
Spamhaus Exploits Blocklist (XBL)
Organization
Spamhaus
Zone
xbl.dq.spamhaus.net
Type
IP
Impact
High
Delisting
Manual
Spamhaus Policy Blocklist (PBL)
Organization
Spamhaus
Zone
pbl.dq.spamhaus.net
Type
IP
Impact
High
Delisting
Manual
Spamhaus Zero Reputation Domain (ZRD)
Organization
Spamhaus
Zone
zrd.dq.spamhaus.net
Type
Domain
Impact
Medium
Delisting
Automatic
