SURBL Blacklist: What It Lists and How to Get Removed

A blocklist checker returns a red row for SURBL, and the first instinct is to look at the sending domain. That is the wrong place. SURBL does not evaluate who sent a message. It evaluates the domains that appear inside it, which means the listed name is frequently a link shortener, a click-tracking host or a partner site, and frequently belongs to somebody else entirely.

Getting that backwards is expensive, because a removal request filed for a domain you do not own goes nowhere, and the remedy that does work takes about ten minutes.

What SURBL actually is

SURBL publishes reputation datasets over DNS, keyed on domain names and IP addresses that turn up in the body of a message. Its own lists page describes the datasets as intelligence "that can be used to filter or tag application data", usable with programs that check message body web sites, and notes that most of its current use cases are no longer about email at all: DNS firewalls, hosting providers looking for bad actors in their own customer base, and botnet mitigation.

The distinction that matters for a sender is stated most plainly in SURBL's FAQ, in a passage about configuring local exclusions. The entries, it says, "should only apply to domains and IPs (hosts) that appear in message body URIs. They should not apply to mail server names, sender domains, message headers, etc."

That is the whole mechanism in one sentence. Your sending IP, your envelope sender and your HELO hostname are not what is being tested.

Sender-side blocklistsWho is sending

• The connecting IP address
• The envelope sender domain
• The HELO hostname your platform announces
• Remedy can involve moving sending infrastructure
• A listing is usually about your own behaviour

SURBL datasetsWhat the message links to

• Domains found in message body URIs
• Link shorteners and redirect hosts
• Click and open tracking domains
• Remedy is removing the named domain from the message
• A listing is frequently somebody else's domain

The complementary problem, which of your four domains is being tested and at which point in the delivery, is worked through in blacklist domain name checks.

The lists behind the one name

SURBL is not a single list. Its lists page names six datasets, each with a different source and a different meaning, and combines them into one public zone.

ABUSE covers spam and abused sites, described as mainly general abused sites such as pills, counterfeits and dating, with data from anti-abuse, ISP and ESP communities alongside SURBL's own research.

PH is phishing, drawing on PhishTank, PhishLabs, URLAbuse and other sources. MW is malware sites, including data from abuse.ch and others.

CR is cracked sites. SURBL's description is worth knowing because it explains a listing that looks impossible: criminals break into sites through vulnerabilities in a CMS such as WordPress or Joomla and add malicious content, and in SURBL's own wording, "Cracked sites usually still contain the original legitimate content". A perfectly ordinary company website can be listed without its owner noticing anything.

DM is disposable email domains, described as domains that classify as disposable email solutions, on the reasoning that somebody signing up with one is most likely hiding their identity. What that class does to a list you bought is in disposable email.

CT is the one that matters most to anybody running cold outbound, and it is worth quoting exactly. The CT list, in SURBL's own words, "contains domains used for tracking clicks in emails", and then: "We only list domains used by senders that send emails to mailboxes without confirmed opt-in (e.g. emails also sent to spamtraps)."

Read that twice if you run outbound. The criterion for the click-tracker list is not malware or fraud. It is sending to addresses that never confirmed opt-in. A shared click-tracking domain on a sending platform carries the aggregate behaviour of every customer using it, and a single customer running an unverified list is enough to put that domain into the population the CT list describes. Your own copy, your own list quality and your own sending discipline do not protect a domain you share.

Reading the answer, not just the red row

The combined public dataset is multi.surbl.org, and SURBL publishes how to decode it. Bitmasking, its lists page explains, "means that there is only one entry per domain name or IP address, but that entry will resolve into an address (DNS A record) whose last octet indicates which lists it belongs to."

The bit positions sit on the same page, written as "4 = listed on DM" through to "128 = listed on CR", with 8 for PH, 16 for MW, 32 for CT and 64 for ABUSE in between. A domain on more than one list returns the sum, so a last octet of 80 means the entry sits on both MW and ABUSE, because 16 plus 64 is 80.

That number is the diagnosis, and most aggregated checkers throw it away. A response of 127.0.0.32 puts the domain on the click-tracker list, which points at opt-in and list quality. A response of 127.0.0.128 puts it on the cracked-sites list, which points at a security incident on somebody's server and has nothing to do with mail at all. The two findings have no remedy in common, and a red row reading only SURBL cannot tell them apart.

Two operational details sit alongside it. SURBL publishes a default TTL of 60 seconds for the live multi data, and says the data "is highly dynamic and on average gets updated every 30-40 seconds". A listing can therefore appear and clear faster than a daily monitoring job will ever see, which argues for reading your bounce strings rather than trusting a scheduled scan.

Which domain in your message is listed

• ✓Yes: The click and open tracking domain, and whether it is dedicated or shared
• ✓Yes: Any link shortener in the body
• ✓Yes: The destination domain of every link, including your own landing page
• ✓Yes: A partner, client or case-study site referenced in the copy
• ✓Yes: Any domain in an email signature, including a calendar booking host
• ~Depends: The sending domain itself, which is the least likely of the six

Getting removed, and the faster alternative

SURBL's FAQ gives one route: start at the SURBL lookup page and follow the instructions on its removal form. There is no separate portal per dataset, and no email address to negotiate with.

That route only applies where the listed domain is yours. Where it is a shortener, a shared tracking host or a third-party site, the request would have to come from whoever owns the name, and a shortener operator has no reason to prioritise one sender's campaign.

1. Step 1Decode the response

   Query the domain and read the last octet, which names the dataset and therefore the cause.

2. Step 2Establish ownership

   If the listed name is a shortener, a shared tracker or a third-party site, there is nothing for you to file.

3. Step 3Remove the domain from the message

   Replace a shortener with a full link on a domain you control, and a shared tracker with a dedicated one.

4. Step 4Resend to the untouched audience

   The remainder of the list has not been attempted, and the message no longer carries the listed name.

5. Step 5File for removal only if the name is yours

   Fix the cause first, because a relisting after a granted removal is a worse position than the original.

Replacing a shared tracking domain with a dedicated one is a platform configuration rather than a campaign change, and it is the single highest-value fix in this whole area, because it converts a reputation you cannot influence into one you can.

What a listing is worth worrying about, and what it is not

A URI listing and a sender reputation problem produce different symptoms and respond to different work, so the first question is which one you have. Refusals that name a list, arrive suddenly and cluster at particular receivers point at a listing. Mail that is accepted and lands in spam while reply rates fall points at reputation, which no operator publishes and no form fixes. How to improve domain reputation, step by step is the work that follows in that case, and the delisting paths for the sender-side lists are in email blacklist check and recovery.

Weighting matters too. SURBL data is consumed by content filters and by the various server-side integrations its own links page catalogues, and a listing on a domain in your body copy is a real problem at every receiver that consults it. It is a different event from a listing on the list that gates inbox placement at the large consumer providers, and treating every red row on an aggregated checker as equally urgent produces a lot of work with no delivery improvement attached. Weight the row by which dataset fired and by whether any of your bounce strings has ever named it.

The structural answer costs less than either remedy. Sending domains stay separate from the corporate domain so a listing can never reach the mail that matters. One purpose per domain, so outbound cannot contaminate transactional mail. Tracking domains are dedicated rather than shared. Links in the body point at domains you own. And spare warmed capacity exists, so a compromised name is replaced rather than rescued. The rest of that architecture is in email domain reputation and the wider cold email deliverability guide.

The short version

SURBL evaluates domains that appear in message body URIs, not the sending IP, the envelope sender or the HELO hostname. Its own FAQ puts exclusions on hosts that "appear in message body URIs" and adds that they "should not apply to mail server names, sender domains, message headers, etc."

Six datasets sit behind the one name: ABUSE, PH for phishing, MW for malware, CR for cracked sites, DM for disposable email domains and CT for click trackers. CT is the one an outbound programme hits, because the criterion for it is senders mailing "mailboxes without confirmed opt-in", which makes a shared tracking domain a shared liability.

The combined multi.surbl.org zone encodes membership as a bitmask in the last octet, 4 for DM through 128 for CR, so the response names the dataset and therefore the cause. Most aggregated checkers discard that number, and it is the only part of the answer that tells you what to do.

Removal starts at SURBL's lookup page and its removal form, and only applies to a domain you own. For everything else the fix is removing the name from the message: a full link in place of a shortener, a dedicated tracking domain in place of a shared one, then a resend to the part of the audience that was never attempted.

If you would rather run on infrastructure where tracking domains are dedicated and a compromised name is replaced before it costs a campaign, we plan the first campaign for free.

Dataset descriptions, the multi bitmask values, the update cadence and the removal route are taken from SURBL's own lists and FAQ pages, fetched on 1 September 2026. Verify current list behaviour with the operator before relying on it.