cPanel/WHM Mail Server IP Blacklisted? Here's How to Fix It Fast

Go to mxtoolbox.com/blacklists.aspx and enter your server's sending IP address (not your domain name). MXToolbox checks against 100+ DNSBLs simultaneously and highlights any active listings in red. Note every list you're on — prioritise Spamhaus (SBL/XBL/PBL), Barracuda BRBL, and SpamCop.

The SMTP rejection message in the bounce usually names the blacklist explicitly:

550 5.7.1 Service unavailable; Client host [203.0.113.45] blocked using
zen.spamhaus.org; https://www.spamhaus.org/query/ip/203.0.113.45

This tells you exactly which list to target first.

Use WHM's Email Delivery Tools

Navigate to WHM > Email > Email Delivery Report. Set the time range to the last 24–48 hours and sort by "Failed". This shows which domains and accounts are generating the most bounce traffic and which remote MX servers are rejecting your mail.

Use WHM > Email > Track Delivery to trace the path of a specific message and confirm whether the rejection is blacklist-related or a recipient-side policy block.

exim -bpc

A healthy server has fewer than 100 messages queued. Anything over 500 is a red flag. Over 5,000 means you have an active spam source right now.

exim -bp | head -100

Look at the sender addresses. If hundreds of messages share the same From: domain or are all destined for random external addresses (dictionary-attack pattern), that domain is almost certainly the source.

Navigate to WHM > Email > View Relayers. This shows which cPanel accounts have relayed the most mail in the last hour. The top offender is your compromised account.

grep "cwd=" /var/log/exim_mainlog | grep "/home/" | sort | uniq -c | sort -rn | head -20

This command extracts the working directory (cwd) from Exim log lines and counts how many messages each directory has sent. A path like /home/user/public_html/wp-content/uploads/ is a dead giveaway of a compromised upload directory used as a mailer drop.

# Suspend the cPanel account
/scripts/suspendacct username "Suspected spam source — under investigation"

# Flush spam from the queue (careful: this deletes ALL queued messages)
exim -bp | exiqgrep -i | xargs exim -Mrm

If you only want to remove messages from the compromised account rather than the entire queue:

exiqgrep -f 'compromised@domain.com' -i | xargs exim -Mrm

find /home/username/public_html -name "*.php" -newer /home/username/public_html/wp-config.php -ls 2>/dev/null | head -30

Look for recently modified PHP files in uploads/, tmp/, or disguised as image files (image.php, thumb.php). Delete them and change all passwords (cPanel, FTP, database, WordPress admin).

Navigate to WHM > Email > Authentication. Ensure SPF is enabled for all domains. A typical cPanel server SPF record looks like:

v=spf1 +a +mx +ip4:YOUR.SERVER.IP ~all

Use ~all (softfail) rather than +all (pass all). For strict enforcement, switch to -all (hardfail) once you've confirmed all legitimate senders are covered.

DKIM

In WHM > Email > Authentication, confirm DKIM is enabled globally. For individual domains, check via:

dig TXT default._domainkey.yourdomain.com

If no TXT record is returned, regenerate the DKIM key for that domain in cPanel > Email > Email Deliverability. Use a 2048-bit key — 1024-bit keys are considered weak and some MTAs reject mail signed with them.

DMARC

DMARC ties SPF and DKIM together and tells receiving MTAs what to do when either check fails. Add this TXT record to your DNS:

_dmarc.yourdomain.com.  IN  TXT  "v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com; pct=100"

Start with p=quarantine rather than p=reject until you've monitored DMARC reports for 2–4 weeks and confirmed no legitimate mail is failing.

rDNS / PTR Record

The PTR (reverse DNS) record for your sending IP must resolve to your server's SMTP hostname, and that hostname must resolve back to the same IP (forward-confirmed rDNS, or FCrDNS). Set the PTR record via your hosting provider's control panel or VPS dashboard. Verify:

dig -x YOUR.SERVER.IP
dig +short YOUR.SERVER.HOSTNAME

Both lookups must return matching values. Mismatched rDNS is one of the most common reasons IPs end up on the Spamhaus PBL.

Query zen.spamhaus.org (the combined lookup) at check.spamhaus.org. Each sub-list has a different removal path:

• SBL (Spamhaus Block List) — manually reviewed spam sources. Removal requires fixing the issue and submitting via the SBL removal page. Typically takes 24–72 hours.
• XBL (Exploits Block List) — compromised/infected IPs. Fix the compromised account, then request removal. Usually automated; processes within 1–4 hours.
• PBL (Policy Block List) — dynamic/end-user IPs not meant to send mail directly. If your server IP is listed on PBL, set the PTR record and request removal at spamhaus.org/pbl. Automated removal, typically under an hour.

Removal URL: https://www.spamhaus.org/lookup/

Barracuda BRBL

Go to barracudacentral.org/rbl/removal-request. Fill in your mail server IP, your email address, and your phone number. Include a brief explanation of what caused the listing and what you've fixed. Barracuda typically processes requests within 12–24 hours. Note: Barracuda BRBL is widely used by corporate mail gateways — treat this as high priority even if Spamhaus is already clean.

SORBS

SORBS is effectively offline as of 2025–2026. The list is no longer actively maintained and removal requests go unprocessed. It still appears in multi-checkers (like MXToolbox) due to cached data, but very few receiving MTAs actively use SORBS for rejection. Focus your effort on Spamhaus and Barracuda first.

SpamCop

SpamCop listings expire automatically within 24 hours if no new spam reports arrive from your IP. You cannot manually request removal — just ensure the spam has stopped and the listing will clear on its own.

Navigate to WHM > Service Configuration > Exim Configuration Manager > Advanced Editor. In the RATELIMIT section, add per-domain sending limits:

# Limit each domain to 500 outbound messages per hour
ratelimit = 500 / 1h / strict / $sender_address_domain

This prevents a single compromised account from flooding thousands of messages before you notice. Adjust the threshold to match your expected legitimate volume — a typical small business domain rarely sends more than 200 emails per hour.

BoxTrapper

BoxTrapper is a challenge-response filter available in individual cPanel accounts. It stops inbound spam from triggering backscatter, which can itself get your IP listed. Enable it for any account receiving heavy inbound traffic: cPanel > Email > BoxTrapper.

SpamAssassin

Navigate to WHM > Email > Apache SpamAssassin Configuration. Recommended settings:

• Required Score: 5.0 (default) — lower to 4.0 for stricter filtering on shared servers
• Rewrite Subject: Enable, add ***SPAM*** prefix
• Auto-Delete Spam: Enable for scores over 10.0 to prevent inbox flooding
• Scan Outgoing Mail: Enable this — SpamAssassin can flag high-scoring outbound messages before Exim delivers them

Proactive Blacklist Monitoring

Don't wait for client complaints to discover a listing. Use a monitoring service that checks your IP against major DNSBLs daily and emails you on any new listing:

• MXToolbox Monitor (mxtoolbox.com) — free tier checks your IP every 24 hours against 100+ lists
• HetrixTools (hetrixtools.com) — more granular, checks every 30 minutes on paid tiers
• Postmaster Tools (postmaster.google.com) — add your domain to track your Gmail reputation score and spam rate directly with Google

Early detection means you can act before clients notice. A listing caught within an hour causes far less damage than one discovered after 12 hours of bounced mail.

Keep Exim and cPanel Updated

Navigate to WHM > Server Configuration > Update Preferences. Set cPanel/WHM to automatically install minor and security updates. Enable Automatic Daily Updates for Exim. Unpatched Exim versions have historically had remote code execution vulnerabilities (CVE-2019-10149, CVE-2020-28017) that attackers actively exploit to turn mail servers into spam relays.

For more expert help hardening your cPanel environment and preventing future deliverability incidents, see our CloudHouse server management service.