SURBL delisting: your mail is blocked by a link, not your IP

SURBL is a URI blocklist: it lists domains and hostnames that appear inside the body of a message, not sending IPs. A receiving filter extracts every link from your email and queries each domain. One listed domain anywhere in the body can cause the whole message to be rejected or scored into spam, no matter how clean your sending infrastructure is.

That inverts the usual investigation. The question is not "what did we send" but "what did we link to".

What SURBL lists, and why

SURBL's combined zone is multi.surbl.org, and the answer is a bitmask, so one query can report several reasons at once:

The cracked category is the one that catches honest senders. It does not mean you are a spammer; it means a site you linked to — possibly your own — has been compromised and is serving someone else's redirect.

Confirm the listing

Domain lists take the domain as-is, with nothing reversed:

dig +short yourdomain.com.multi.surbl.org
dig +short -t txt yourdomain.com.multi.surbl.org
dig +short links.yourdomain.com.multi.surbl.org

SURBL also provides a lookup on its own site, which is more informative than a bare DNS answer. And read the rejection text: URI-list rejections normally quote the offending domain, which hands you the answer.

Check each of these separately — they are evaluated independently:

• The From domain and every sending subdomain.
• The click-tracking host, especially if it is a shared domain supplied by your sending platform.
• The unsubscribe and preference-centre host.
• Landing-page and campaign domains.
• Image and asset CDNs.
• Booking, form, survey, document and video hosts.
• Any link shortener. Shorteners are listed aggressively because their destinations can change after you send.
• Partner, customer and case-study domains you cite.
• Email-signature links — the most frequently forgotten.

Getting removed, in order

1. Identify the exact listed host. A hostname or domain, not "our email".
2. Stop sending it immediately. Pull the link from every template and automation, including signatures and footers.
3. If it is your site, clean it properly. Injected redirects in a CMS are the most common cause of a cracked listing. Remove the injection, patch the platform and plugins, rotate credentials and admin sessions, then look for a second backdoor. A listing that returns a week later means you found one of two.
4. If it is a third party's site, keep the link out until they clean up. You cannot fix it and SURBL will not remove it for you.
5. Move off shared infrastructure. Replace a shared click-tracking domain with a dedicated subdomain under your own domain, and replace shorteners with full URLs.
6. Check your redirects. If a redirect chain ends at a listed destination, the first hop gets listed too.
7. Request removal through SURBL's removal process, naming the host, the cause and the remediation. Keep it short and factual. Many listings also expire on their own once the domain stops appearing in spam, so for a cleaned compromise the honest options are to wait or to ask once.

What not to do

• Do not request removal with the link still live in your templates. Fresh samples relist you automatically.
• Do not assume it is your fault. Half of these listings belong to a domain you merely mentioned.
• Do not register a new domain to escape. You inherit nothing good, you lose your sending history, and the rotation pattern itself gets flagged elsewhere.
• Do not use URL shorteners in email. There is no version of this that is worth the deliverability risk.
• Do not check only the `From` domain. The tracking host is the single most likely listed object for senders on hosted platforms.
• Do not forget URIBL and Spamhaus DBL. They are separate lists with separate processes, and the same bad link usually shows up on more than one.

Prevention that actually works

Audit your link inventory quarterly against a real rendered message. Keep every tracking, unsubscribe and asset host on a subdomain you control, and warm those subdomains with the mail that references them. Remove links to sites you have no visibility into. Monitor your own web properties for injected content, because a compromised marketing site damages email long before anyone notices the website.

MailPilot warms mailboxes and measures per-provider inbox placement daily, and checks SPF, DKIM and DMARC alignment on the domains you send from — so when a link-level listing starts pushing messages into spam, you see the placement change rather than inferring it from a quiet pipeline.