Clean IP, Blocked Mail
You've done everything right. SPF, DKIM and DMARC all pass. Your sending IP has a clean record on every DNSBL you can find. Bounce rates are low, complaint rates are lower.
And your campaign still lands in spam.
There's a category of blocklist that a lot of senders never check, because it doesn't look at your IP at all. URI blacklists — SURBL, URIBL, Spamhaus DBL and others — look at the domains inside your message. Every hyperlink in the body, every image host, sometimes every domain mentioned in plain text.
If any of those domains is listed, the message can be filtered no matter how pristine your sending infrastructure is.
Why Link Reputation Beats IP Reputation for Spam Detection
The logic is neat once you see it from the filter's side.
Spammers rotate sending infrastructure constantly. Compromised hosts, throwaway VPS instances, botnets, hijacked ESP accounts — the IP address behind a spam run changes fast and cheaply.
What doesn't change is the destination. A spam campaign has to send the recipient somewhere. That landing page has a domain, that domain costs money and time to set up, and the whole campaign is worthless without it.
So the domain is the durable, expensive part of the operation. Blocking it kills the campaign regardless of how many IPs the sender burns through. From an anti-abuse perspective it's a far higher-leverage target than the IP.
How the Lookup Works
Mechanically it's similar to an IP-based DNSBL, but without the reversal step.
To check whether example.com is listed on a URI blacklist, the filter queries:
example.com.multi.surbl.org
An A record response means listed. NXDOMAIN means not listed. The response IP encodes which sublist matched — different bits correspond to different data sources or listing categories.
Some URI blacklists also check the registered domain rather than the full hostname, so promo.example.com and mail.example.com inherit the reputation of example.com. That's deliberate — otherwise spammers would just spin up unlimited subdomains.
The Domains That Get Checked
More than most people expect:
- Every hyperlink target in the HTML body
- Image source domains, including hosted assets and tracking pixels
- Click-tracking and redirect domains used by your ESP
- Plain-text domain mentions, in many implementations, even without a link
- The unsubscribe link domain
- Domains in the plain-text alternative part of a multipart message
That list is the source of most surprises. Senders audit their links carefully and forget the tracking pixel, the CDN hosting their logo, or the third-party domain their footer builder inserted.
Where the Listings Come From
Shared tracking domains
If your ESP puts every customer's click-tracking behind a common domain, that domain accumulates reputation from every customer. One abusive sender on the platform can get the shared domain listed, and everyone's links inherit the problem.
This is the strongest argument for a custom tracking domain. When links.yourbrand.com is yours alone, its reputation reflects only your behaviour. Most ESPs support this, and it's usually a fifteen-minute DNS change.
URL shorteners
Public shorteners are heavily abused because they hide the destination from both filters and recipients. Some are listed outright; others carry enough accumulated bad reputation to hurt.
Use of a public shortener in commercial email is a reliable spam signal to most filters. Link to your real URLs, or use a branded shortener on your own domain.
Compromised sites you link to
Link to a partner's site, a news article, a supplier's product page — and if that domain gets compromised and starts serving malware, it can be listed. Your message now contains a listed domain through no fault of your own.
This is why long-lived automated emails need periodic link audits. A link that was safe when you wrote the template two years ago may not be safe today.
Your own domain, after a compromise
A vulnerable CMS, an outdated plugin, an exposed upload directory. Attackers commonly plant redirect scripts or spam pages on legitimate sites and use them in campaigns. The site owner often has no idea until their email stops delivering.
Expired domains with history
Buying a domain that was previously used for spam means inheriting its listings. Check any domain's reputation before you buy it — the price is often low for a reason.
Diagnosing the Problem
Start by checking every domain that appears in your message, not just your sending domain. The Blacklist Checker will query your domain against multiple lists:
- Enter your sending domain and check it.
- Repeat for your click-tracking domain.
- Repeat for any image host or CDN domain in the template.
- Repeat for every third-party domain you link to.
- Also check your sending IP, so you know which layer the problem sits in.
If the IP is clean and a body domain is listed, you've found your answer. If both are clean, the problem is somewhere else — content filtering, engagement metrics, or provider-specific reputation that no public list exposes.
A practical shortcut: send the exact campaign to a seed address at a provider you can inspect, and read the full headers. Many filters add headers naming the rule or list that triggered. That's faster than guessing.
Getting Delisted
The process resembles IP delisting but with an extra step that people skip.
Fix the underlying cause first. Delisting a domain that's still hosting a compromised redirect gets you relisted within days, often with a longer penalty. If your site was hacked: find the entry point, patch it, remove every injected file, rotate all credentials, and update the CMS and plugins. Then verify with a malware scanner before you request anything.
Identify the specific list. Different operators have different processes. Some remove automatically once their scanner sees the site is clean; others need a manual request. Spamhaus DBL, SURBL and URIBL each publish their own procedure.
Submit the request with evidence. Explain what happened, what you changed, and when. Vague requests get ignored or deprioritised.
Wait for cache expiry. Even after delisting, receiving mail servers cache DNS responses. It can take up to a day or two for the change to propagate through everyone's resolvers.
Watch for the pattern. Repeated listings for the same domain mean the root cause was never actually fixed.
Prevention That Actually Works
Use a custom tracking domain. The single highest-value change for most senders. Isolates your reputation from every other customer on your ESP.
Audit template links quarterly. Automated and transactional emails run for years. Their links rot.
Keep the domain count low. Every additional domain in a message is another reputation you're depending on. Consolidate where you can.
Never use public shorteners in bulk mail. The reputation risk is not worth the character saving.
Harden the sites you link to that you control. Keep CMS and plugins updated, restrict upload directories, use strong admin credentials with MFA.
Monitor proactively. Checking your domains monthly means you find a listing before your campaign does.
FAQ
Can my email be blocked if my IP is completely clean? Yes. URI blacklists evaluate domains in the message body independently of sending IP reputation. A single listed link can trigger filtering.
Does a listed domain affect my Google search rankings? Email blacklists and search ranking are separate systems. However, the underlying cause of a URI listing — a compromised site serving spam or malware — can absolutely affect search visibility through Google's own security warnings.
Should I use a URL shortener in email? Not a public one. Use your own domain, or your ESP's custom tracking domain feature.
How long does delisting take? Varies by operator. Some are automatic within a day of a clean rescan; others take manual review. Add up to two days for DNS caches to clear afterwards.
Do URI blacklists check subdomains separately? It depends on the list. Some check the exact hostname, some roll up to the registered domain. Assume a bad subdomain can affect the parent domain's reputation.
What if a partner's domain I link to gets listed? Remove the link until they resolve it. You can't delist someone else's domain, and continuing to link to it keeps hurting your delivery.
The Takeaway
Sender reputation and link reputation are two independent systems, and most delivery troubleshooting only examines the first. If your infrastructure checks out clean and mail is still being filtered, work through every domain that appears inside the message — including the ones you didn't put there deliberately.
Check your domains and IPs against major blacklists free with the Blacklist Checker at sadiqbd.com — no sign-up, instant results.
