Spamhaus SBL vs CSS: what each listing means for your IP space
A Spamhaus hit is often the first thing that turns up when someone checks an IPv4 range, and the two names that cause the most confusion are the SBL and the CSS. Both sit under the SBL umbrella and both can stop mail being delivered, but they are created differently, listed for different reasons and removed in different ways. This article explains the difference and what each one means if you hold, buy or lease address space.
Where SBL and CSS sit in the Spamhaus family
Spamhaus publishes several IP reputation datasets. The ones you will meet most often are:
- SBL (Spamhaus Block List): listings created by Spamhaus researchers for addresses and ranges linked to spam operations, spam support services, malware hosting and similar abuse.
- CSS: an automatically generated component of the SBL that targets individual IPs sending low-reputation mail.
- XBL: compromised machines, such as hosts infected with malware or abused as open proxies.
- PBL: a policy list of address space that should not send mail directly to mail servers, typically end-user and dynamic ranges.
- DROP: ranges Spamhaus considers so thoroughly controlled by criminals that it recommends networks refuse to route traffic to or from them.
Many mail servers query the combined ZEN zone, which bundles these datasets. The DNS return code shows which one matched: 127.0.0.2 for an SBL listing, 127.0.0.3 for CSS. The Spamhaus IP and Domain Reputation Checker shows the same distinction.
What an SBL listing means
An SBL listing is a decision made by a person. Each one has a public record with a reference number, the listed address or range, and a short explanation of why Spamhaus listed it. The listing can be a single IP, but it can also cover a /24 or wider when the problem is an operation rather than one machine, such as a spammer renting space across several subnets.
Because the listing is evidence-based, removal is too. Spamhaus generally expects the network operator responsible for the space, meaning the ISP or resource holder, to deal with it: terminate or fix the abusive customer, then ask for removal through the Spamhaus ticket process. An end customer asking for removal without the network’s involvement rarely gets far. Spamhaus does not charge for removal.
For a holder, an SBL listing is a signal about how the space was used and how well the network responds to abuse.
What a CSS listing means
CSS listings are generated by Spamhaus systems, not written up by researchers. They target individual IPs that show patterns associated with low-reputation mail: snowshoe spam spread thinly across many addresses, compromised mail accounts or web forms, poorly configured servers with mismatched HELO names or missing reverse DNS, and senders hitting spam traps.
There is no detailed public record. The reputation checker gives a general description of the issue, and you have to work out the cause from your own logs. Once the problem is fixed, removal can usually be requested through the checker. If the activity continues, the IP is listed again, and repeated relisting makes self-service removal harder.
For a holder, a CSS listing is mainly an operational problem on one host. It says little about the wider range unless many IPs in the same block are listed at once, which points to snowshoe sending or a systematic configuration fault.
Side by side, the main differences are:
| Aspect | SBL | CSS |
|---|---|---|
| Created by | Spamhaus researchers | Automated systems |
| Typical scope | Single IP up to large ranges | Individual IPs |
| Public evidence | Numbered record with reasons | General description only |
| Who requests removal | Usually the network operator | The operator of the IP, via the checker |
| What it signals | Abuse hosted or tolerated on the network | A sending or configuration problem on a host |
What to do when your IP space is listed
Work in this order:
- Identify the dataset and scope. Note whether it is SBL or CSS, and whether it covers one IP or a range.
- Find the source. Match the listed IPs to customers, servers or services. For CSS, check mail logs, outbound queues, HELO configuration and reverse DNS.
- Stop the activity. Suspend the customer, secure the compromised account or fix the server. Requesting removal while the cause is still active usually ends in relisting.
- Request removal through the right channel. Use the checker for CSS. For SBL, the responsible network contacts Spamhaus and explains what has changed.
- Make sure abuse reports reach you. Check that the abuse contact in the RIPE Database is current and monitored, so the next problem is caught early.
Listings on space you are buying or leasing
Spamhaus listings attach to addresses, not owners, so they can outlast a change of holder. Before signing, check every IP in the block against Spamhaus, not just the network address. Treat an open SBL record on a range as a condition to resolve before transfer or lease start: ask who caused it, whether that customer has gone and who will handle removal, and write the answer into the agreement.
A handful of historical CSS hits on individual IPs are more routine, but confirm they are no longer active before you start sending mail. A DROP listing is a different category altogether: it can mean traffic is dropped at network edges, and it should be resolved with Spamhaus before any deal goes ahead.
How TACS can help
Our IP security audit checks every address in a block against Spamhaus and other major lists and explains what each listing means for your plans. If space you hold is already listed, our Blacklist delisting service handles the investigation and removal requests for a fixed fee, and if you need clean space, see Buy IPv4.