Read the category, not just “listed”

Spamhaus PBL covers IP space that should not deliver mail directly to third-party MX systems. It commonly includes broadband/dynamic and other ranges whose policy expects users or devices to submit through an authenticated mail server. The listing is not based on actions by every end user in the range.

Other operators have their own policy categories. Link to the exact policy and record response in the incident; do not generalize the PBL definition to every list.

Confirm how the IP appeared

Use the receiver-observed connecting peer. If the address appears only in an earlier Received field from a user device to an authenticated submission server, it is normal for that device IP to be policy-listed and it should not be used to reject the already-relayed message. Spamhaus explicitly warns against deep-parsing PBL across all header IPs.

If the listed IP connected directly to the recipient MX, determine why:

  • a mail client lost SMTP authentication;
  • an application bypassed the approved relay;
  • a device or compromised host opened direct port 25;
  • a new dedicated server lacks appropriate network classification;
  • a forwarder or gateway was misidentified.

Fix the path or the policy

For users/devices, restore authenticated submission to the approved provider. Restrict direct outbound SMTP at the network edge where appropriate. For a legitimate dedicated MTA, work with the address-space owner and list operator under their documented process; ensure forward/reverse DNS, abuse contacts, and ownership are correct.

Do not request removal for an ordinary end-user address merely so a client can send direct-to-MX. Do not use PBL to block web access or URLs; it was not designed for that role.

Verify with a new connection

After correction, send an authorized message through the intended relay and confirm the receiver observes the relay’s outbound IP, authentication passes, and the SMTP response recovers. Record whether the PBL entry remains appropriately in place for the original end-user range.

The incident is resolved when mail uses the approved architecture and the list’s policy is understood. A remaining policy listing can be the correct outcome; removal is not the universal measure of success.