SURBL is a domain blocklist published at surbl.org. When you're listed, mail servers that consult SURBLwill block, defer, or spam-folder your messages — so fixing it matters for deliverability. Here's why it happened and exactly how to get off.
Why you got listed
SURBL listings almost always trace back to one of these:
A domain in your email body has been reported in spam or phishing
Most commonA domain in your email body has been reported in spam or phishing. This is the most common trigger for a SURBL listing — address it first.
A shortened/redirect URL resolving to flagged content
CommonA shortened/redirect URL resolving to flagged content.
Your domain reputation dropped after a compromise or aggressive campaign
Less commonYour domain reputation dropped after a compromise or aggressive campaign.
How to get delisted
Delisting that lasts has two parts: fix the root cause, then request removal. Skip the first part and you'll be re-listed almost immediately.
- 1
Find and stop the source
Identify what triggered the listing — a compromised mailbox, a script or web form being abused, a poor-quality list, or a misconfigured mail server. Check your outbound logs for unusual volume and secure any account that looks compromised (rotate passwords, enable MFA, revoke stale API keys).
- 2
Fix the underlying issue
Check the SURBL lookup to see which list and why. Remove or replace the offending URL, secure any compromised accounts, then submit a removal request. Clean domains are typically delisted quickly.
- 3
Confirm your authentication is solid
Make sure SPF, DKIM, and DMARC are all passing before you ask for removal — a clean authentication setup is part of demonstrating you're a legitimate sender. Run a free EmailHealth check to confirm.
- 4
Submit a removal request at surbl.org
Go to
surbl.org, look up your domain to confirm the listing and its stated reason, and use their removal/delisting form. Many listings here also expire on their own once the cause stops.
Stay off it for good
- Keep your list clean — remove hard bounces and never mail purchased or scraped addresses
- Authenticate every sending source with SPF, DKIM, and DMARC
- Monitor your domain so you catch a new listing within a day, not after customers complain
EmailHealth can monitor your domain daily and alert you the moment a blacklist listing (or any other deliverability change) appears.