In the past we also experienced similar issues, not on CSS but on some
other RBL.
We was using a RIPE-assigned /22 since there was IP classes free (
unassigned / never assigned ) so nobody used that IPs before us.
We was adding DNS records only when we deploy a mailserver but we often
found them already listed somewhere.
It's always difficult to get trusted (or only answered) when sending
correctly but there is a mass of spammer that (technically) do the same
job better than you (properly configuring the DNS) even if you send
correctly and they send spam.
We solved the problem adding A, SPF, MX, and reverse (PTR) record for
the entire 1024 IP class, even never used IPs, even those assigned to
the router that can't send e-mail, even the broadcast address and the .0
IP that doesn't exists (just to be sure).
The automatic checks usually read them periodically and de-list the IP
if the configuration became correct (in some cases you need to ask for
de-listing to get re-checked).
For what I know, CSS is the automatic system of Spamhaus, it may works
in a similar way, I don't know how CSS ingest IPs but a single e-mail
sent to your mailbox internally trough your ISP may be enough to be
verified.
I suggest to configure properly an hostname A record, MX pointing to the
same IP, reverse PTR and SPF as well, if possible even DKIM for every
domain used (also for internal e-mail) and ask for a de-listing after
these configurations.
A nice day to everyone,
-Luca
Il 26/08/2026 15:02, Ralph Seichter via mailop ha scritto:
My ISP notified me that an IPv4 address assigned to one of my servers is
listed on Spamhaus. This came as a big surprise, because the server in
question is not set up to send mail to the outside world. The occasional
cron job report is forwarded to another server of mine, but that happens
over via private network connection (vSwitch), and only to a fixed
recipient mail address.
The listed server has been chugging along for more than a year in this
configuration. Logs show nothing out of the ordinary. This leads me to
wonder how a Spamhaus CSS listing could occur? The explanatory text is
not too helpful:
Your IP address is either exhibiting suspect behavior, is
misconfigured, or has a poor sending reputation. As a result, this IP
is listed in the CSS Blocklist (CSS).
I tried to initiate Spamhaus' delisting process, but that attempt gets
stuck on step 2 "Troubleshooting PTR and HELO issues". Possibly because
the server does not even listen on TCP port 25, I guess.
If you have ideas about what may have caused the CSS listing, or
suggestions about how to proceed with delisting, I'd appreciate you
sharing your thoughts. Thanks.
-Ralph
_______________________________________________
mailop mailing list
[email protected]
https://list.mailop.org/listinfo/mailop
_______________________________________________
mailop mailing list
[email protected]
https://list.mailop.org/listinfo/mailop
