SURBL Blacklist: How to Check & Remove Your Domain

Your sending IP can have a clean reputation and your emails can pass SPF, DKIM, and DMARC while a SURBL listing still causes deliverability problems. That’s because SURBL doesn’t primarily evaluate the server sending your email. It checks the domains and URLs that appear inside the message.

If one of those domains appears in SURBL’s reputation data, receiving systems can use the result when filtering the message. Changing your sending IP or moving to another email service therefore won’t fix a listing tied to a domain you’re still linking to.

Here’s how SURBL works, why domains get listed, and what to do if yours appears in its database.

What is the SURBL blacklist?

SURBL stands for Spam URI Realtime Block List. Unlike traditional IP blocklists that identify sending infrastructure, SURBL identifies websites associated with unsolicited, malicious, or otherwise abusive messages.

Mail-filtering software extracts domains from URLs in a message and checks them against SURBL. A positive result can then contribute to the system’s decision to flag or filter the email. SURBL data can also be used outside email filtering, including in DNS firewalls and safe-browsing systems.

The main public dataset is Multi, which combines several SURBL categories into a single lookup through multi.surbl.org. SURBL recommends using Multi instead of querying its component lists individually.

What do the SURBL lists mean?

SURBL combines several datasets through its Multi list. The category attached to a listing tells you what kind of problem to investigate.

List	What it flags	Where to start
PH	Domains associated with phishing and identity theft	Check the website for phishing pages, redirects, or signs of compromise
MW	Domains associated with malware distribution	Remove malicious content and investigate how the site was compromised
CR	Legitimate websites that have been compromised and used for abuse	Secure the website, patch vulnerable software, and remove injected content
ABUSE	Domains associated with spam and other abusive activity	Investigate your sending practices and whether the domain is being abused
Multi	Results from SURBL datasets combined into one lookup	Use the result to identify the underlying category and investigate from there

The CR list is particularly important for legitimate businesses. Appearing on SURBL doesn’t necessarily mean the domain owner intentionally sent spam or hosted malicious content. A compromised website can result in an otherwise legitimate domain being associated with abuse.

Why does a domain get listed by SURBL?

A SURBL listing generally means the domain has appeared in messages or activity associated with spam, phishing, malware, or another form of abuse. The cause can originate with your own sending practices, but it can also point to a security problem.

A compromised website, for example, may contain injected phishing pages, malware, or redirects without the owner realizing it. Attackers can also gain access to email accounts or third-party sending services and use legitimate infrastructure for abusive campaigns.

List hygiene matters too. Sending unsolicited email or continuing to mail old, unengaged addresses increases the chances of generating abuse reports and other negative reputation signals.

The important distinction is that changing your sending IP doesn’t remove a problem attached to the domain itself. You need to identify why the domain was listed and address that cause first.

How can a SURBL listing affect email deliverability?

SURBL is typically used as one reputation signal within a larger filtering system, so a listing doesn’t necessarily mean every provider will reject every message containing your domain.

That can make the problem harder to spot. Messages may reach certain recipients normally while being filtered or rejected by systems that use SURBL data. A receiving system can also combine a SURBL result with other reputation signals when deciding how to handle a message.

This is why deliverability problems caused by a domain reputation issue can persist even when your sending IP is clean and SPF, DKIM, and DMARC are configured correctly. If the problem appears concentrated around messages containing a particular domain or URL, checking its SURBL status is worth adding to your troubleshooting process.

How to check if your domain is listed by SURBL

Check with the official SURBL lookup tool. Enter the domain you want to check, without a protocol such as https:// or a path after the domain. The result will show whether SURBL currently has reputation data for it.

If you’re troubleshooting a specific campaign, check every domain that appears in the message, not only your main website. Tracking domains, landing pages, redirects, and other linked domains can also affect filtering.

Pay attention to the category shown in the result. A compromised-site listing calls for a security investigation, while a listing associated with abusive sending points toward your email practices.

How to remove your domain from SURBL

Don’t submit a removal request before investigating why the domain was listed. If the underlying problem is still active, removing the listing won’t solve the deliverability problem for long.

1. Fix the cause of the listing

For a PH, MW, or CR listing, investigate the website for signs of compromise. Remove malicious or injected content, update your CMS and plugins, check for unauthorized redirects or subdomains, and rotate credentials that may have been exposed.

Also review any third-party services that can send email using your domain. If an account or integration has been compromised, revoke unauthorized access and rotate the affected credentials.

For an ABUSE-related listing, review where your recipients came from and how recently they’ve engaged with your messages. Stop sending to addresses without clear permission and remove old or problematic contacts before resuming campaigns.

2. Request removal from SURBL

When you’ve addressed the cause, search for the domain using SURBL’s lookup tool and follow the removal instructions provided with the result. SURBL removal is free.

Explain what caused the listing, what you’ve changed, and what you’ve done to prevent the problem from happening again. SURBL recommends providing useful details with removal requests, particularly when a compromised site has been cleaned up.

How to stay off SURBL

After your domain has been removed, keep an eye on both website security and sending practices to reduce the chance of another listing.

Keep your CMS, plugins, themes, and other website software up to date, and regularly review the site for unauthorized pages, redirects, or subdomains. Protect administrative accounts with strong, unique passwords and rotate API keys or other credentials if you suspect they’ve been exposed.

For email, send to people who have agreed to hear from you and regularly remove invalid or long-inactive addresses. Review the domains used in your campaigns too, including tracking and redirect domains, since SURBL can evaluate URLs beyond your main website.

If you use third-party applications to send email, periodically review which services still have access to your accounts and remove anything you no longer use.

Should you switch to a new domain?

Starting over with a new domain usually isn’t the best response to a SURBL listing. It doesn’t fix whatever caused the original domain to be listed, and a new domain starts without an established sending reputation.

If compromised infrastructure or poor sending practices caused the listing, moving the same setup or campaigns to another domain can simply recreate the problem. Fix the original cause and request removal instead.

There are legitimate reasons to separate email across domains or subdomains, such as keeping transactional and marketing traffic separate. But using a new domain purely to bypass a blocklist isn’t a substitute for fixing the underlying issue.

Conclusion

A SURBL listing points to the domains linked inside your email, so changing your sending IP won’t fix the underlying problem. Check which SURBL category contains your domain, address the security or sending issue behind it, and then submit a removal request through SURBL’s lookup tool.

FAQ

Is SURBL an IP blacklist?

No. SURBL primarily lists domains and websites found in messages associated with spam or other abuse, rather than the IP address that sent the email. This means your sending IP can have a clean reputation while a domain linked in your message appears on SURBL.

Can I be listed by SURBL if my website was hacked?

Yes. SURBL’s CR list covers compromised legitimate websites that have been used for abusive activity. If your site has been hacked, remove any malicious pages, files, or redirects and secure the site before requesting removal.

How do I check if my domain is on SURBL?

Use SURBL’s official lookup tool and search for the affected domain. The result can provide information about its reputation and, when applicable, access to the removal process.

Does SURBL charge for delisting?

No. SURBL does not charge domain owners to request removal. Before submitting a request, investigate and fix the problem responsible for the listing.

Will changing my sending IP fix a SURBL listing?

Usually not. SURBL evaluates domains and URLs in messages, so moving to another IP or email provider won’t remove a listing attached to a domain you continue to use. Fix the cause of the domain listing and follow SURBL’s removal process instead.