New Domain Blocklisted? It's Probably Spamhaus ZRD, Not You

If you registered a domain in the last day and a blocklist checker now says it is listed on "Spamhaus ZRD," nothing has gone wrong and nobody is accusing you of spamming. The Zero Reputation Domain list automatically lists every newly registered domain on the internet for its first 24 hours — yours included — and removes it automatically when the clock runs out. There is no delisting process because none is needed. It is policy, not a judgment.

The blocklisting that happens to every domain

Spamhaus operates dozens of datasets, and most of them list things because those things did something bad. ZRD is the exception. The official ZRD FAQ is explicit that the list contains newly registered domains for a 24-hour period, that domains are removed automatically after 24 hours, and that Spamhaus does not accept removal requests for this list at all. The feed updates every 60 seconds, so a freshly registered domain appears on it almost instantly.

The practical consequence was spelled out by deliverability practitioner Al Iverson, who runs his own mailbox provider and wrote about discovering this first-hand at Spam Resource in January 2023: any mailbox provider that subscribes to the full suite of Spamhaus filters will reject mail from a domain that is less than 24 hours old. Not defer it — reject it. His warning is worth internalising: you cannot register a domain at noon and send your first test message at 2pm. Even test messages bounce at receivers running the full suite.

One caveat for accuracy: ZRD is a Spamhaus Technology dataset distributed through the paid DQS service and data feeds, not through the free public mirrors. That means not every mail server on earth enforces it — but the ones that do subscribe tend to be large, well-run providers, which is exactly the audience you care about reaching.

How to read a ZRD return code

Blocklists answer through DNS. A receiving mail server asks a question in the form of a hostname lookup; if the answer is NXDOMAIN, the domain is not listed, and if an A record comes back — always inside 127.0.0.0/8 — the domain is listed, and the exact value encodes why (Spamhaus DBL FAQ).

ZRD's encoding is unusually elegant. Per the Spamhaus dataset documentation, ZRD answers in the 127.0.2.x range, where the fourth octet is the number of hours since Spamhaus first observed the domain — from 127.0.2.2 up to 127.0.2.24.

Return code	What it means
127.0.2.2	Domain first observed about 2 hours ago
127.0.2.8	About 8 hours old
127.0.2.16	About 16 hours old
127.0.2.24	About 24 hours old — about to fall off the list

This lets receivers make graduated decisions rather than binary ones: a filter can hard-reject mail from a 2-hour-old domain while merely adding a spam-score penalty to mail from a 20-hour-old one. If a bounce message or a blocklist report shows you a 127.0.2.x code, you now know two things — you are on ZRD, and exactly how many hours remain until you automatically drop off.

Why Spamhaus blocklists every new domain

Because the numbers justify it. In the six months from October 2025 to March 2026, Spamhaus observed 46.9 million newly registered domains and flagged 2.15 million of them as malicious, with botnet command-and-control domains up 289% and malware domains up 206% over the prior period. The ZRD FAQ's rationale is behavioural: cybercriminals register hundreds of domains at a time and burn them within hours, while legitimate organisations rarely send mail from a domain on the day they buy it. A 24-hour quarantine costs legitimate senders one day and costs bulk-registering criminals their entire operating model.

The same logic explains why the penalty does not fully end at hour 24. The Spamhaus DBL FAQ notes that unknown reputations "begin as 'poor' by default" — a new domain is not neutral, it starts in the penalty box and earns its way out. And Spamhaus's own best-practice guidance for newly registered domains says that for roughly the first 30 days, most threat-intelligence companies will flag a newly registered domain. Iverson lands on the same 30-day figure from the sender's side, recommending a domain be at least 30 days old before commercial traffic.

What to do about a ZRD listing: nothing

This is the rare deliverability problem with no action items. You cannot appeal, you cannot pay (there is nothing to pay for), and you cannot speed it up. What you can do is plan around it:

1. Wait out the 24 hours before sending anything — including tests. Below that line, ZRD-subscribing receivers reject outright.
2. Register your sending domain well before launch. The cheapest deliverability insurance available is buying the domain a month early. Both Spamhaus and Iverson converge on ~30 days of aging before commercial volume.
3. Use the waiting time. Publish a real website, set up SPF, DKIM, and DMARC, and add DNS TXT validation records — Spamhaus explicitly counts these as evidence of domain control and investment.
4. Then ramp gradually. Spamhaus's guidance for new domains is to avoid bulk sends entirely at first and increase volume based on each previous send's results. That controlled ramp is the part WarmEnvelopes automates, sending through your own Resend account. For realistic timelines — the aging window plus the ramp itself — see how long it takes to warm up an email domain.

How to check what you're actually listed on

The definitive check for Spamhaus listings is check.spamhaus.org, which covers the DBL and the IP lists and doubles as the delisting entry point. You can also query the public DBL zone directly — domains are queried as-is, with no octet reversal:

# Check a domain against the Spamhaus DBL
dig +short yourdomain.com.dbl.spamhaus.org A

# No answer (NXDOMAIN)  = not listed
# 127.0.1.x             = listed; the code says why
# 127.0.2.x             = you'd see this shape on ZRD: age in hours

# The TXT record gives a human-readable reason and a link
dig +short yourdomain.com.dbl.spamhaus.org TXT

One serious footgun: do not run these queries through a public resolver like 8.8.8.8 or 1.1.1.1. Spamhaus's free-use policy refuses service to queries arriving via public/open resolvers, and the failure mode is silent — blocked queriers tend to get NXDOMAIN for everything, which reads as "not listed" even when you are. Query from a machine with its own recursive resolver, or use the web checker. Our free domain checker queries the Spamhaus DBL for you, alongside the rest of a new domain's DNS setup.

If every list comes back clean and your mail still lands in the spam folder, you are dealing with reputation or authentication rather than a blocklist — a different problem with a different fix, covered in why are my emails going to spam.

ZRD vs. actually listed: the difference that matters

A ZRD hit is a timestamp. A DBL hit is an accusation — the Spamhaus Domain Blocklist lists domains observed in spam, phishing, malware, and botnet traffic, and its return codes tell you which:

Code	Meaning
127.0.1.2	Spam domain
127.0.1.4	Phishing domain
127.0.1.5	Malware domain
127.0.1.6	Botnet C&C domain
127.0.1.102–.106	"Abused legit" — a real domain that has been compromised

The bands carry different messages. The .2–.6 band means Spamhaus believes the domain is inherently bad. The .102–.106 band means a legitimate domain is currently compromised — a security incident to clean up, not a reason to abandon the domain.

Real listings have real delisting processes, and for every reputable operator they are free. The Spamhaus DBL FAQ states there is never a charge for removing any Spamhaus listing; self-service delisting at check.spamhaus.org takes minutes, with up to 24 hours of propagation. SURBL, URIBL, Barracuda, SpamCop, Proofpoint, Abusix, and Invaluement all delist for free too. The rule before filing any request: fix the cause first — every operator relists faster than you can delist, and repeat requests without remediation get flagged.

The exception that proves the rule is UCEPROTECT, which charges roughly 89 CHF per IP for "express" delisting from its Level 1 list while offering free removal only after a 7-day wait — a model that InMotion Hosting and Sucuri both characterise as a scam. If UCEPROTECT is the only place you are listed: do nothing and pay nothing. Almost no major mailbox provider consumes it, and the listing expires on its own.

The TLD trap: cheap domains start deeper in the hole

ZRD penalises your domain for being new. A related, longer-lived penalty comes from where it is registered. No mailbox provider publishes a rule like "reject .xyz" — but some TLDs carry so much concentrated abuse that domains there start with a worse-than-neutral prior and need more positive history to clear the same bar (Suped on abused TLDs).

The concentration numbers are stark. In Spamhaus data for October 2025 – March 2026, as compiled by Suped, .cfd had 17.54% of its entire zone listed as bad — roughly one domain in six. .top had over 270,000 listed domains and .bond, .sbs, and .xyz tens of thousands each. .com had the most listings in absolute terms (~506,000) but as a fraction of its ~168-million-domain zone that is a rounding error — which is why Spamhaus's own "world's worst TLDs" methodology ranks by the ratio of bad domains to active domains, not raw counts. The trend is also against the cheap zones: in April–September 2025, Spamhaus reported .top registrations up 94%, .xyz up 103%, and domain blocklistings up 48.3%.

The practical read, as of August 2026: a brand-new domain on a high-abuse TLD stacks two negative priors — newness and neighbourhood. Since a .com costs about $12 a year, there is no reason to accept that handicap on a domain you intend to send email from. Buy the .com (or your market's ccTLD) and let the cheap gTLDs be someone else's problem.

Ignore any guide that tells you to check SORBS

A surprising number of blocklist tutorials still list SORBS as a place to check. SORBS was decommissioned by its owner Proofpoint on 5 June 2024, with all 18 of its DNS zones emptied. At its peak it listed over 12 million hosts and was consumed by more than 200,000 organisations (CSO Online) — which is exactly why so much stale content still references it. As of August 2026, any "listing" a checker reports against a SORBS zone is meaningless, and any guide telling you to request SORBS delisting is describing a process that no longer exists. Treat a SORBS mention as a freshness test for the rest of the guide.