SMTP 554 5.7.1: rejected due to blocklist or spam

What the message looks like

554 5.7.1 Service unavailable; Client host [203.0.113.10] blocked using zen.spamhaus.org

Common causes

• A compromised mailbox or web form sent spam through your server.
• The IP is in a dynamic range (Spamhaus PBL) and is not supposed to deliver directly.
• Shared IP: another customer on the same IP caused the listing.
• On your own server: DNSBL lookups go through public resolvers (8.8.8.8), Spamhaus returns error codes and every mail gets rejected.

Check

1. Check the IP at Spamhaus (octets reversed)
   dig +short 10.113.0.203.zen.spamhaus.orgCopy
2. Find blocklist rejections in the log
   journalctl -u postfix --since today | grep -i 'blocked using'Copy
3. Find accounts with suspiciously many logins/mails
   journalctl -u postfix --since today | grep -o 'sasl_username=[^ ,]*' | sort | uniq -c | sort -rn | headCopy
4. Which resolver is used for DNSBL lookups?
   cat /etc/resolv.confCopy

Fix

• Stop the source first: lock the account, change the password, secure the form, delete spam from the queue.
• Only then request delisting from the list operator – otherwise the next listing follows.
• For a PBL listing, relay through a smarthost with a clean IP or use a static IP with a proper PTR.
• For your own DNSBL checks, run a local resolver (e.g. Unbound) instead of public DNS.
• Add per-account outbound rate limits so one hijacked account cannot send thousands of mails.

FAQ

What does a 127.255.255.254 answer from Spamhaus mean?

It is not a listing but an error: the query came through a public or open resolver that Spamhaus does not answer.

How long does delisting take?

For Spamhaus SBL/XBL usually minutes to hours after the request, as long as the spam has stopped. Some lists also expire automatically after a few days.