Spamhaus DROP: why you cannot delist, and what to do instead

DROP is not a mail blocklist and it does not work like one. It is a list of IP netblocks and ASNs that Spamhaus considers so dangerous that they should not be routed or peered at all, published free for use in routers, firewalls and BGP filters. There is no sender-facing delisting form, because there is no sender-level entry: a DROP range is there because of a Spamhaus Blocklist (SBL) record, and it leaves DROP automatically when that SBL record is removed.

The three datasets

Two housekeeping facts that out-of-date guides get wrong. eDROP no longer exists as a separate list — it was merged into DROP on 10 April 2024, so nothing needs separate eDROP configuration. And the legacy .txt files were deprecated in favour of the JSON feeds above.

Spamhaus is explicit that IP address space under the control of a legitimate network will never be listed. DROP is aimed at hijacked space, netblocks leased wholesale to criminal operations, and ASNs that exist to serve them.

What a DROP listing actually does to you

Worse than a DNSBL listing, and differently. A DNSBL rejects your mail at the SMTP conversation. DROP is applied at the network layer by the operators who use it: packets to and from the range are discarded. The symptoms are therefore not bounces with a helpful code — they are connection timeouts, to mail and to everything else. Email is a small part of the damage.

Equally important: because DROP is for routing, your mail problems may be caused by the *same* SBL record while your DROP status is just a downstream effect. The SBL record is the object to deal with.

Work out your position first

1. Determine who owns the netblock. A whois lookup on the IP gives you the allocation, the ASN and the abuse contact. If the holder is a hosting provider you have never heard of, that is already the answer.
2. Check the listing itself. Spamhaus's IP and Domain Reputation Checker will tell you about the IP and point at the SBL record the DROP entry references. The JSON files carry the SBL reference for each range.
3. Read the SBL record. It states why the range is listed. Hijacked space, a bulletproof-hosting operation, an ASN leased to spammers — these read very differently from an individual sender's mistake, and none of them is fixed by you.
4. Ask whether you are the network operator. Everything that follows depends on the answer.

If you operate the network

You are the only party who can resolve it. The work is not a form:

• Terminate the abusive customers and document it.
• Fix the hijack: correct the route objects, RPKI ROAs and IRR records so the space is announced only by its legitimate holder.
• Publish a working abuse contact and respond to reports.
• Then contact Spamhaus about the SBL record, with evidence of what changed. Removal of the SBL record removes the DROP entry automatically.

ASN-DROP removals start from the same reputation checker, and the same logic applies: the ASN is listed because of what it hosts.

If you are an end user on that network

This is the common case, and the honest answer is uncomfortable. You cannot get a netblock removed from DROP, and your provider may have no intention of changing the behaviour that put it there. Practical steps, in order:

1. Open a ticket with your provider, quoting the SBL reference. A legitimate provider will act; the reply tells you which kind you have.
2. Move your sending immediately. Do not wait for the outcome. Relay through a reputable provider or migrate to a different host with clean space.
3. **When you move, change IP *and* review the domain.** If your mail has been failing from this range for weeks, your domain reputation at the big receivers has suffered independently.
4. Warm up the new address or mailbox properly. New space with no sending history is not the same as good space.

What not to do

• Do not file a sender delisting request. There is no sender-level DROP entry to remove, and the SBL record behind it belongs to the network holder.
• Do not pay anyone to "remove you from DROP". Nobody outside the network operator and Spamhaus can affect it.
• Do not configure eDROP. It has not been published separately since April 2024.
• Do not use DROP for inbound mail filtering as a substitute for a DNSBL. It is coarse by design — appropriate at the router, too blunt as your only mail filter.
• Do not assume a new IP in the same /24 helps. DROP lists ranges, not addresses.

The lesson DROP teaches cheaply

Where you rent IP space is a deliverability decision. Cheap hosting in a netblock full of churned customers will cost you more in blocked mail than you save, and DROP is the extreme end of a spectrum whose mild end is a shared pool with a mediocre reputation.

MailPilot checks the lists receivers consult against the IPs and domains you actually send from, validates SPF, DKIM and DMARC, and measures per-provider inbox placement daily — so after a move to clean infrastructure you can see reputation rebuild rather than hope it has.