PSBL removal: a spam-trap list that mostly delists itself

The Passive Spam Block List (PSBL), published at psbl.surriel.com, lists sending IP addresses that delivered mail to its spam-trap addresses. It is still active — public trackers show new listings daily — and it is a modest list by reach, included in many filtering configurations as one scoring input rather than an outright block.

The mechanics are deliberately simple. Traps receive mail, the sending IP is listed, and listings expire automatically once the traps stop seeing mail from that address. For a one-off incident you can do nothing and the entry will go away.

That makes PSBL far more valuable as a diagnostic than as a crisis. A trap hit is proof that your list contains addresses nobody consented with, because a spam trap has no owner to subscribe you.

Confirm it

dig +short 9.113.0.203.psbl.surriel.com        # reversed octets of 203.0.113.9
dig +short -t txt 9.113.0.203.psbl.surriel.com

A 127.0.0.x answer means listed; the TXT record carries detail, typically a short note and a timestamp of the most recent trap hit rather than a category code — PSBL does not grade listings the way Hostkarma does. PSBL also provides a web lookup and removal page on its own site, and that page is the faster path if you just need the timestamp and do not want to parse a DNS answer by hand.

Use the IP from a Received header of mail you genuinely sent. If you send through Google Workspace, Microsoft 365, SES, SendGrid, Mailgun or Postmark, that IP is the provider's — you cannot remove it and should not try. Your signal in that case is the trap hit itself, and your action is list hygiene.

Where trap addresses come from

Every one of these routes puts traps on your list, and all of them are avoidable:

• Purchased or rented lists. The most reliable way to acquire traps. Vendors cannot filter what they cannot see, and seeded traps are designed to be indistinguishable.
• Scraped addresses. Traps are published on web pages specifically to be harvested.
• Recycled addresses. An abandoned mailbox can be converted into a trap after it has been closed long enough. Any address you have not successfully engaged in a year is a candidate.
• Typo and catch-all domains. Misdirected mail to lookalike domains lands in collectors.
• No confirmation on sign-up forms. Someone else's address typed into your form, never confirmed, then recycled.
• Importing an old export. The list you exported in 2021 and re-imported last week is the single most common cause.

Removing the listing, and doing the real work

1. Confirm the listing and the IP.
2. Find the send that caused it. Narrow by timestamp: which campaign, which segment, which import. If one import is responsible, you have found your problem.
3. Quarantine that segment. Stop sending to it entirely until it has been verified. Do not thin it, stop it.
4. Suppress hard bounces permanently and convert repeat soft bounces to suppressed after a few attempts.
5. Sunset disengaged contacts. No engagement in 90 days means no more sending. Recycled traps live in exactly that cohort.
6. Add confirmation to sign-up. Double opt-in removes most future trap exposure in one change.
7. Use PSBL's self-service removal once the cause is addressed, or simply let the listing expire — it will, once the traps go quiet.
8. Re-check in a day, then again in a week. A second listing means you have not found the whole source.

What not to do

• Do not request removal and resume the same send. The trap is still on the list and will fire again, and repeated listings are what turn a minor list into a persistent one.
• Do not try to identify and delete "the trap address". You cannot, by design, and senders who try end up guessing at valid recipients. Fix the acquisition source instead.
• Do not dismiss it as a small list. The listing barely matters; the trap hit matters enormously, because every serious reputation system — Spamhaus, the enterprise filters, Gmail's and Microsoft's internal scoring — uses trap data too. PSBL is often the only one that tells you out loud.
• Do not change IPs to clear it. You take the list with you and dirty a second address.
• Do not treat a clean PSBL result as proof of a clean list. Its traps are a sample, not a census.

The habit that prevents it

Never send to an address you did not verify, suppress bounces and complaints the day they happen, sunset unengaged contacts on a schedule, and never re-import an old export without re-verification. Senders who do those four things stop seeing trap-driven listings entirely.

MailPilot warms mailboxes at a controlled pace, checks the lists receivers consult against your sending domains and IPs, verifies SPF, DKIM and DMARC, and measures per-provider inbox placement daily — so you can confirm that a cleaned list actually restored delivery instead of assuming an expired listing did.