SURBL: what it is, how domains get listed, and how to get removed

SURBL is a set of reputation lists of domains that show up in links inside unwanted email. The name stands for Spam URI Realtime Block List, and a company called SURBL BV runs it (SURBL FAQ).

The difference from an IP blocklist matters. An IP blocklist asks who sent the message. SURBL asks which websites the message points to. A filter pulls the domains out of the links in your email body and looks each one up.

That means SURBL cares about every domain you link to: your sending domain if it appears in a link or signature, your website, your click-tracking domain, your unsubscribe link.

SURBL publishes six public lists and combines them into one, multi.surbl.org (SURBL Lists):

SURBL does not ask whether your outreach is legal. CAN-SPAM compliance, a real offer and a working opt-out do not enter into it. The only test is whether your links appear in mail the recipient never asked for.

SURBL describes its sources this way (SURBL Lists):

• its own proprietary research, including passive DNS and zone files from TLD operators
• data from security, anti-abuse, ISP and ESP communities
• spam traps: the CT list description says it covers senders whose mail also reaches traps

A spam trap is an address that never signed up for anything. Any mail it receives is unsolicited by definition.
Our theory on where some of these traps come from: blocklist operators buy the domains of companies that have shut down, keep the old website up or park it, and collect everything sent to those addresses. SURBL has not confirmed this. It does fit what we see, because stale B2B contact lists are full of people at companies that no longer exist.

The consequence for a sender is the same either way. One old list with a few trap addresses is enough to get a domain listed, even if every other recipient is a real prospect.

Use SURBL's own Lookup page. Enter the domain to see whether it is listed. The removal request starts from the same page.
Check every domain your emails link to, not only the one you send from. That includes your tracking domain and the site in your signature.

If you manage many domains, query DNS directly. Append .multi.surbl.org to the domain:

dig +short yourdomain.com.multi.surbl.org

An empty answer means the domain is not listed. A listed domain returns an address starting with 127.0.0., and the last number tells you which lists it is on (SURBL Lists):

The numbers add up when a domain is on several lists. 127.0.0.96 means CT and ABUSE (32 + 64).
One catch: 127.0.0.1 is not a listing. It means SURBL has blocked the DNS server you queried through. Repeat the query through a different server or use the Lookup page.

For years the answer was simple. A SURBL-listed domain did not reach inboxes, and the only fix was to discard it and buy a new one.

That changed around the second half of 2025. We found out by accident. One customer had about 200 domains listed on SURBL, did not know, and kept sending. Their reply rate did not move.

An unchanged reply rate across 200 listed domains means the mail was still landing in inboxes. The condition is warmup: listed domains that were warmed up properly keep reaching Gmail and Microsoft mailboxes.

In September 2025 Google confirmed to the New York Post that Gmail had stopped using SURBL's data in its filtering (Yahoo News, republishing the New York Post).

Google spokesperson José Castañeda said a review had found the company's own protections more effective, so "we stopped incorporating SURBL as a signal." He added that Gmail relies on hundreds of signals, and the main one is users reporting mail as spam.

The trigger was a case involving WinRed, a US fundraising platform. Links to it were on a SURBL list, and Gmail was labeling
emails that contained them as dangerous and sending them to spam. SURBL agreed to remove WinRed on August 20, 2025, and Google then dropped SURBL data from Gmail altogether.

The timing matches what we saw with our customers.

For Gmail there is now an official statement. For Microsoft we only have our own observations. This is how we understand the reasons:

• SURBL was one signal among many. Google itself describes it as one of hundreds. We believe the big providers never had a hard rule of "listed on SURBL, send to spam."
• SURBL got aggressive. In recent years it listed a lot of ordinary B2B companies doing ordinary outreach. We see the same with Spamhaus.
• False positives hurt the mailbox provider. When a real company is listed, its emails to its own clients, contractors and partners go to spam too. The loser is a paying Gmail or Microsoft 365 user who was waiting for that email.
• Treat this as an observation with a date on it. Filters change, and we will update this article if listed domains start underperforming again.

Do not delete the domain on the day you find the listing. Measure first.

1. Find which list you are on. ABUSE or CT is a reputation issue. PH, MW or CR means SURBL sees phishing, malware or signs of a hack on your site. Fix security before anything else.
2. Compare reply rates. Take the two weeks before the listing appeared and the two weeks after. A flat line means your mail still reaches inboxes.
3. Run an inbox placement test to Gmail and Microsoft mailboxes from the listed domain.
4. Decide on the numbers. If replies and placement hold, keep sending. If both dropped, retire the domain, or rest it and warm it up again.

You can. Requests go through the form on the Lookup page (SURBL FAQ).

In our experience SURBL usually refuses cold email senders. That sets the priority:

• Secondary outreach domains: not worth the time. Test deliverability and keep working.
• Your main company domain: worth one attempt, because that domain sits in every link, signature and invoice you send.

For PH, MW and CR listings SURBL asks you to clean and secure the site, and the computers used to upload content to it, before you contact them (SURBL Lists).

If SURBL says no on your main domain, that is not a disaster. From what we see, the listing does not stop your email from reaching your clients.

Our observation covers Gmail and Microsoft. Other receivers run their own filters. SpamAssassin, for one, has supported SURBL checks by default since version 3 (SURBL FAQ). If your prospects sit on self-hosted mail servers or with regional providers, take a listing more seriously.

You cannot make a domain immune to SURBL, but four habits cut the risk:

• Send from secondary domains. Keep your main company domain out of cold email. Then a listing never touches the domain your clients and invoices depend on.
• Clean the list before sending. Remove contacts at companies that no longer exist. Abandoned addresses are where spam traps live.
• Use fewer links. SURBL reads links. A first email with no tracking link and no extra URLs gives it less to match, and the CT list exists specifically for click-tracking domains.
• Warm up and keep volume low. We recommend 14 days of warmup before the first campaign and about 15 cold emails per mailbox per day. The second number is a recommendation, not a technical limit: the higher the volume, the higher the chance of burning the domain.