ivmURI delisting: how Invaluement lists link domains, and how to get out

ivmURI lists domains found inside the clickable links of spam, not the IP that sent it. If you are listed, the question is not "what did I send" but "what did I link to". That single distinction decides the whole investigation, and it is the step most delisting guides skip.

The Invaluement lists, side by side

Invaluement is subscription-only for subscribers, which has two effects worth understanding. It is small, so it is absent from many multi-list checkers. And it is paid, so the filters using it tend to be enterprise mail systems whose users are the people you most want to reach. A listing you cannot see in a free checker can still be the thing blocking your pipeline.

Note that the URI list's self-identification has been in flux — rejection text and TXT records have been observed naming it ivmLinkingDomains with ivmURI given as the former name. Go by the lookup URL in the TXT record rather than the label; the procedure below is unchanged either way.

Confirm the listing and the exact listed item

1. Read the rejection text in full. URI-list rejections normally quote the offending domain: that is the answer handed to you. 550 5.7.1 Message contains a link to a site listed by ... plus a domain is a complete diagnosis.
2. Read the spam-filter headers on a message that landed badly. Rspamd, SpamAssassin and commercial filters write the rule name and the matched domain into X-Spam-Report or similar.
3. Use Invaluement's own lookup on the candidate domains. Their site offers a lookup chooser and a delist request path.
4. Run a broad multi-list check too, so you know whether this is an isolated URI listing or part of a wider reputation problem. A domain listed on ivmURI *and* Spamhaus DBL *and* SURBL has a bigger cause than a single bad link.

The link inventory nobody runs

Open a real production message, in its final rendered form, and list every domain it can send a click to. Most senders are surprised by the count:

• The primary brand domain and any landing-page domain.
• The click-tracking domain — often a shared CNAME host provided by your sending platform. If it is shared, you inherit other customers' behaviour.
• The unsubscribe and preference-centre host, which is frequently different again.
• Image and asset CDNs.
• Calendar-booking, form, survey, document and video hosts.
• Link shorteners. Any shortener. These are listed aggressively and for good reason: a shortened link's destination can change after you send it.
• Partner, customer and case-study domains you cite in the body.
• Email-signature links, which are the most commonly forgotten of all.

Any one of those being compromised, expired, parked or repurposed is enough to list the message. A domain you linked to last year that has since been bought by someone else is a classic cause.

Getting delisted, in order

1. Identify the exact listed item. A specific hostname, a domain, or a redirect destination — not "my company".
2. Stop using it immediately. If it is a shared tracking host, move to a dedicated subdomain under your own domain. If it is a shortener, replace it with full URLs. If it is a third party's site, remove the link until they clean up.
3. Fix your own property, if it is yours. Hijacked WordPress installs that serve spam redirects are the most common single cause. Find the injected redirect, remove it, patch, rotate credentials, and check for a second backdoor before declaring victory.
4. Verify the destination of every redirect you control. A redirect chain whose final hop is listed will list the first hop too.
5. Request delisting through Invaluement's delist request path, naming the item, what caused the listing and what you changed. Short, factual and specific beats a long appeal.
6. Re-check after a day or two, and re-check the whole link inventory a week later.

What not to do

• Do not request removal while the link is still in your sending templates. Automated systems see the same spam sample again and relist.
• Do not assume a listing is about your sending. ivmURI listings regularly belong to a domain you merely mentioned.
• Do not swap domains to escape. Registering a fresh domain and carrying on gets you the same listing plus a snowshoe pattern on other lists.
• Do not use a shared tracking domain for anything you care about. Your sending platform offers a custom tracking subdomain; use it, and warm it.
• Do not dismiss it because the list is small. Reach is about who subscribes, not how many entries the zone has.

Preventing the next one

Audit the link inventory quarterly, keep every click-tracking and unsubscribe host on a subdomain you control, never use shorteners in email, and remove links to third-party sites you have no visibility into. Those four habits remove most URI-list exposure permanently.

MailPilot warms mailboxes and measures per-provider inbox placement daily, and checks SPF, DKIM and DMARC alignment on the domains you actually send from — so when a link-level listing starts suppressing delivery, you see the placement change rather than guessing from bounce volume.