"554 5.7.1 Service unavailable; Client host [IP] blocked using zen.spamhaus.org": what it means and how to fix it

What it means

The server receiving your email checked your sending IP against a public blocklist and found it. This exact wording comes from Postfix, a very common mail server, but many other servers write something similar:

554 5.7.1 Service unavailable; Client host [203.0.113.10] blocked using zen.spamhaus.org; https://...

ZEN is not one list: it is a single lookup that combines several Spamhaus lists:

• SBL: IPs seen sending spam or run by spam operations. Managed by people at Spamhaus.
• XBL (with the CSS data): IPs that look infected or hacked, or servers sending junk automatically.
• PBL: ranges that should not send email directly, like home internet connections. A policy list, not a punishment.

A similar bounce says blocked using bl.spamcop.net. SpamCop is another list, fed by spam reports from users. Listings there expire automatically once the reports stop, usually within a day or so.

Why it happens

• A hacked mailbox, website or contact form on your server sends spam.
• A computer or device on your network is infected and sends junk through your IP.
• You send directly from a home or office connection (PBL).
• Your cloud IP was used by a spammer before you.
• You share an IP with other customers of your hosting company.

When it is not your fault

Spamhaus refuses lookups made through big public DNS resolvers. A badly set up receiving server can then show a "blocked using zen.spamhaus.org" error with a mention such as "open resolver" even though you are not listed. If Spamhaus shows no listing for your IP, send the bounce to the recipient's IT team: they must fix their server.

How to check

1. Copy the IP from the bounce, between the brackets.
2. Look it up on check.spamhaus.org. The result shows which list (SBL, XBL/CSS or PBL), the reason and the removal steps.
3. Run a Delivmail test. Send an email from the same server or tool to the unique address on the home page (/). The report shows the IP that actually sends your mail, its blacklist status, reverse DNS, and whether it is a shared provider.
4. Check more lists at /blacklists, including SpamCop, with the IP and your domain.

How to fix it

SBL listing

Read the reason given by Spamhaus. On a hosting or email provider, open a ticket with them and paste the bounce: only they can fix their network and request removal. On your own server, stop the spam source first, then follow the removal request process shown on the listing.

XBL or CSS listing

1. Find the cause: hacked email account, outdated website plugin, unprotected contact form, infected computer behind the same IP.
2. Change passwords, update software, add a captcha to forms, clean the mail queue.
3. Make sure your server greets with a real hostname and has a correct reverse DNS.
4. Use the self-removal option on check.spamhaus.org. If spam continues, the IP will be listed again quickly.

PBL listing

• Home or office connection: send through your email provider's outgoing server instead of sending directly.
• Real mail server on a fixed IP: set a proper reverse DNS name, then use the PBL self-removal form.

SpamCop listing

Fix the cause (usually the same as for XBL) and wait. The listing disappears automatically when no new reports arrive.

Check that it is fixed

Look the IP up again on check.spamhaus.org and on /blacklists. Removal is usually effective within an hour, but receiving servers may cache the old answer a bit longer. Send a new Delivmail test to confirm the blacklist section is clean, then resend the email that bounced. A new listing after removal means the problem is still active.