Why Your New VPS IP Is Already Blacklisted
You provision a VPS, SSH in, check your IP against a blacklist tool, and discover you are already listed on Spamhaus, UCEPROTECT, or both. You have not sent a single email. You have not installed a mail server. The IP arrived dirty. This is not a fluke. It is how VPS IP allocation works, and some providers are far worse than others.
Why new VPS IPs come pre-blacklisted
IPv4 addresses are a finite resource. There are no new ones. Every VPS provider maintains a pool of addresses that get recycled when accounts are terminated. When the previous tenant ran an open relay, operated a botnet, or just sent a marketing blast to a purchased list, their IP accumulated negative reputation across multiple blacklist databases. When that account gets terminated and you spin up a server, you inherit every complaint and listing that IP ever collected.
The recycling problem is structural. A WebHostingTalk user described purchasing three separate unmanaged VPS servers and receiving blacklisted IPs on all three. A DigitalOcean community post from 2018 reported that a blacklisted IP caused "70% of our customers unable to do business." A follow-up two years later described the same problem persisting.
Budget providers get hit hardest because of the tenant cycle they create. Low prices and instant signup with no identity verification attract spammers. Those accounts burn through IPs in days or weeks, get terminated, and the IPs go back into the pool carrying blacklist entries. The next customer gets a dirty IP, and the pattern repeats. A LowEndTalk thread titled "VPS with dirty IP" treats this as an expected cost of budget hosting.
Even premium providers are not immune. A WebHostingTalk thread documented LiquidWeb handing out a blacklisted IP on a new server. The provider's reputation matters, but no provider can guarantee a clean IP on every deployment.
Which blacklists actually matter (most don't)
Blacklist checkers like MXToolbox scan against 100+ lists. You might see your IP flagged on 8 of them and panic. The reality: only one blacklist organization has confirmed impact across Gmail, Microsoft, and Yahoo. That organization is Spamhaus.
| Blacklist | Used by major providers? | Action needed |
|---|---|---|
| Spamhaus ZEN (SBL + XBL + PBL + CSS) | Yes. Gmail, Microsoft, Yahoo all check it. | Fix immediately. This is the only listing that blocks delivery to consumer inboxes across all three providers. |
| Barracuda BRBL | Enterprise only | Affects delivery to organizations running Barracuda appliances. Not used by Gmail, Microsoft, or Yahoo for consumer inbox filtering. |
| SpamCop | Some ISPs | User-report-driven. Not integrated by major consumer providers. Auto-expires when reports stop. |
| UCEPROTECT | No | Gmail, Microsoft, and Yahoo do not use it. Sucuri documented UCEPROTECT blocking 2.4 million IPs based on 937 spam emails. Ignore unless you send to very small ISPs that may reference it. |
| SORBS | Dead | Permanently decommissioned June 5, 2024. All DNS zones emptied. Any tool still showing SORBS listings is reading stale data. |
The practical rule: if your IP is clean on Spamhaus, you will deliver to Gmail, Outlook.com, and Yahoo inboxes regardless of what other lists say. If your IP is on Spamhaus SBL or XBL, request a new IP. Delisting is possible but slow, and you have not sent a single email yet, so a fresh IP is faster than paperwork.
UCEPROTECT deserves special attention because it causes the most confusion. Their Level 3 listing flags entire ASNs (Autonomous System Numbers, meaning a provider's complete IP range). AS36352 (ColoCrossing/RackNerd), AS16276 (OVHcloud), and AS51167 (Contabo) have all appeared on UCEPROTECT L3. This sounds catastrophic until you check who actually uses UCEPROTECT: InMotion Hosting, Sucuri, and multiple industry sources have called UCEPROTECT's paid express delisting model (449 CHF for ASN removal) extortionate. Less than 0.001% of email volume goes to recipients whose servers check UCEPROTECT.
The PBL listing that is not a blacklist
This is the most misunderstood listing in email. The Spamhaus PBL (Policy Block List) lists IP ranges that "should not be sending email directly to the Internet." This includes residential broadband, dynamic IPs, and VPS IP ranges that have not been explicitly excluded.
A PBL listing is not evidence of spam. It is a policy statement: this IP belongs to a range where direct-to-MX sending is not expected. Many VPS IPs land on PBL by default because they sit in allocation blocks that ISPs or hosting providers have registered as "end-user" rather than "mail server" ranges.
What PBL blocks: direct email delivery on port 25 without authentication. If you connect to a recipient's mail server directly (as Postfix does by default), the receiving server checks Spamhaus, sees the PBL listing, and rejects your connection.
What PBL does not block: email sent through an authenticated SMTP relay on port 587. If you relay through a service like Amazon SES or your domain registrar's SMTP server, PBL is irrelevant because the receiving server sees the relay's IP, not yours.
How to remove your VPS IP from PBL:
- Go to check.spamhaus.org and enter your IP.
- If listed on PBL, click "show details" for the self-service removal form.
- Requirements: your IP must be static (not dynamic), you must run an outbound mail server, and you need both forward DNS (A record pointing to the IP) and reverse DNS (PTR record pointing back to the hostname) configured.
- Removal requests from free email addresses (Gmail, Hotmail, Yahoo) are automatically rejected. You need a domain-based email address to submit the form.
- DNS propagation takes about 15 minutes after approval.
One catch: PBL exclusions expire after one year and must be renewed. They are also reversed immediately if Spamhaus detects spam from the IP. This is reasonable. It means you have to maintain a clean sending record, not just apply once and forget.
Which providers hand out the dirtiest IPs
IP pool hygiene varies enormously by provider. The pattern is consistent: providers with low prices, instant signup, and no abuse gates have the worst IP reputation because they attract and churn through the most abusive tenants.
| Provider | IP reputation | Why |
|---|---|---|
| BuyVM / FranTech | Poor | AS53667. FranTech operates 67,797 IPs. BuyVM allows Tor exit node hosting, which generates abuse complaints at volume. SlickStack documented BuyVM as "a huge sponsor of email spam and malware." Multiple reports of abuse complaints going unaddressed. Cheap storage slabs attract bulk operations that compound the problem. |
| ColoCrossing / RackNerd | Poor | AS36352. 383,683 total IPs with a 1.86% spam rate per CleanTalk data. The worst subnet (107.172.195.0/24) hits a 43% spam rate, with 109 active spam IPs out of 250. A WebHostingTalk thread stated: "ColoCrossing isn't doing enough to stop outbound spam, and Spamhaus is blacklisting large blocks of their IP ranges as a result." RackNerd uses ColoCrossing infrastructure, so changing your IP within RackNerd does not escape the ASN-level reputation. |
| DigitalOcean | Poor | AS14061. Blocks port 25 by default (a tacit admission of their IP pool state). MXRoute added ALL DigitalOcean IP space to their in-house blocklist on October 30, 2021. iCloud directly rejects email from many DO ranges. Amsterdam datacenter IPs are the worst. Moot for email since DO blocks SMTP ports anyway, but the reputation contaminates other use cases that depend on IP cleanliness. |
| GreenCloud | Poor | LowEndTalk users report frequently receiving blacklisted IPs on new orders. Support charges $2 per IP change, which creates an incentive loop: dirty IPs cost the customer money, not the provider. |
| OVHcloud | Mixed | AS16276. Listed on UCEPROTECT Level 3, but that does not affect Gmail, Microsoft, or Yahoo delivery. OVHcloud refuses to pay UCEPROTECT's 449 CHF express delisting fee. Spamhaus status is generally clean for individual IPs, meaning OVH IPs deliver fine to consumer inboxes despite the UCEPROTECT noise. The real risk is IP recycling within their large pool (4.2 million IPs). |
| Contabo | Mixed | AS51167 (Europe), AS40021 (US). UCEPROTECT L3 listed, but again, that does not matter for consumer delivery. Contabo's FAQ correctly states Gmail, Hotmail, and Yahoo do not use UCEPROTECT. Individual IP quality varies. Contabo will not submit blacklist removal requests on your behalf. |
| Hetzner | Better | AS24940. Two structural advantages: port 25/465 are blocked for roughly the first month on new Cloud accounts (customers must pay an invoice and request unblock with a stated use case), and Hetzner runs an active abuse team that cooperates with blacklist organizations. The trust-building gate filters out throwaway spammer accounts. Community reports suggest Hetzner IPs are cleaner on average, though not guaranteed clean. |
| Netcup | Better | Fewer ASN-level complaints than budget providers. Cloudron forum reports indicate Netcup has resolved Microsoft blocklist issues by contacting Microsoft directly. Smaller customer base means less churn and fewer abuse-and-recycle cycles. |
The pattern behind the pattern: port 25 gates work. Hetzner's month-long wait, DartNode's automatic SMTP disable on blacklisted IPs, and DigitalOcean's blanket port 25 block all serve the same function. They prevent spammers from burning through IPs at high speed. Providers that let new accounts send email immediately (RackNerd, Contabo, BuyVM) absorb the cost in reputation.
How to audit an IP before installing anything
Provision your VPS, note the IP address, and check it before installing Postfix, Mail-in-a-Box, Mailcow, or anything else. The order matters: start with the only blacklist that affects consumer delivery, then broaden.
Step 1: Spamhaus (the only check that matters for consumer email)
Go to check.spamhaus.org. Enter your IP. This queries SBL, XBL, PBL, and CSS in a single lookup.
- Listed on SBL or XBL: this IP has been directly involved in spam or is a compromised host. Request a new IP from your provider. Do not waste time delisting. You have not sent any email yet, so a fresh IP costs you nothing.
- Listed on PBL only: this is normal for VPS IPs. It means the IP range is not pre-authorized for direct email. Removable through the self-service form once you configure rDNS (see the PBL section above).
- Listed on CSS: automatically produced listing for low-reputation IPs. Can indicate snowshoe spam operations from the previous tenant. Consider requesting a new IP.
- Not listed: proceed with your mail server setup.
Step 2: MXToolbox broad scan
Go to mxtoolbox.com/blacklists.aspx. Enter your IP. This checks against 100+ DNS-based blacklists. Green means clean, red means listed.
If you are clean on Spamhaus but listed on several minor lists, the practical impact is low. Minor blacklists affect delivery to organizations running specific gateway products (Barracuda appliances, Proofpoint, SpamAssassin with custom rulesets), not to Gmail, Outlook, or Yahoo consumer inboxes.
Step 3: MultiRBL deep scan (optional)
Go to multirbl.valli.org/lookup/. Enter your IP. This checks 200+ blacklists and whitelists simultaneously. It also performs FCrDNS (Forward-Confirmed reverse DNS) validation, which catches PTR record mismatches that some mail servers use as a rejection signal.
Blue/neutral entries in MultiRBL are informational only and do not indicate blocking.
Decision tree
- Spamhaus SBL or XBL listing: request new IP.
- Spamhaus PBL only: remove through self-service form (15 minutes).
- UCEPROTECT only: ignore. No consumer provider uses it.
- Clean on Spamhaus, listed on minor lists: acceptable. Install your mail server.
- Multiple Spamhaus component listings (SBL + CSS): request new IP. This IP has deep reputation damage.
Delisting timelines by blacklist
If you decide to delist rather than swap IPs, here is what to expect:
| Blacklist | Auto-expire? | Delisting time | Process |
|---|---|---|---|
| Spamhaus SBL | No | 24-48 hours (first offense), 1-2 weeks (repeat) | Self-service removal at check.spamhaus.org after fixing the root cause. Repeat offenders may require direct communication with the Spamhaus team. |
| Spamhaus XBL | Yes | Automatic once the infection is cleaned | Auto-delists when the ISP removes the IP from the threat feed. Self-service request available to accelerate. |
| Spamhaus PBL | No | 24-48 hours | Self-service form. Requires a non-free email address, static IP, and configured rDNS. Exclusions expire after 1 year and must be renewed. |
| Barracuda BRBL | No | 12-24 hours (first), 24-72 hours (repeat) | Submit removal at barracudacentral.org/lookups. Submit once. Multiple requests reset your queue position. |
| SpamCop | Yes | 12-24 hours from last report | No manual delisting available. Listings expire automatically when spam reports stop. Each new report resets the clock. |
| UCEPROTECT L1 | Yes | ~7 days | Auto-expires. "Express delisting" available for 89 CHF (~$100). Do not pay. Multiple industry sources call this extortion. |
| UCEPROTECT L2/L3 | Yes | ~7 days after underlying L1 issues clear | No manual removal. L2 clears when individual IPs in the subnet delist. L3 clears when the ASN's abuse level drops. Express delisting for ASNs: 449 CHF (~$500). Do not pay. |
The bottom line for a new VPS with a dirty IP: if it is on Spamhaus SBL, delisting takes 24-48 hours at minimum and requires demonstrating that the root cause (the previous tenant) is gone. If you have not installed anything yet, requesting a new IP takes 5 minutes. The math favors swapping.
IP swap policies by provider
When you get a dirty IP, your first question is whether the provider will give you a clean one. The policies are inconsistent.
| Provider | Free IP change? | Cost after | Method |
|---|---|---|---|
| RackNerd | 1 free within 72 hours | $3 per change | Self-service via client portal ("Change IP" button). LowEndBox documented the feature launch. No open support tickets required. |
| Hetzner Cloud | Yes, free | Free | Delete the server without unassigning the Primary IP (IP gets released). Create a new server to receive a fresh IP. Can also create a new Primary IP in the Cloud Console. |
| Contabo | Free (via reinstall) | Contact support for additional IPv4 | "New deployment" reinstalls the OS and assigns a new IP but destroys all data. Additional IPv4 addresses limited to 1 per VPS. |
| DigitalOcean | No direct feature | Free (destroy/recreate) | Snapshot the droplet, destroy it, create a new droplet from the snapshot. New droplet gets a new IP. No guarantee the new IP is different; wait before destroying the old one. |
| Vultr | No direct feature | Free (destroy/recreate) | Snapshot, destroy, deploy from snapshot. Reserved IPs ($3/month) exist but do not solve the blacklist problem since they draw from the same pool. |
| OVHcloud | Contact support | Up to 16 additional IPs (paid) | Additional IPs available through the control panel. Pricing varies by region. |
| GreenCloud | No | $2 per change | Contact support. Community reports describe frequent dirty IPs plus paid swaps as a frustrating combination. |
After getting a replacement IP, check it against Spamhaus before doing anything else. The replacement may also be dirty. If you go through two or three dirty IPs from the same provider, the problem is the provider's IP pool, not bad luck. Consider moving to a provider with better IP hygiene (Hetzner, Netcup) rather than cycling through contaminated inventory.
FAQ
Why is my brand-new VPS IP already blacklisted?
VPS providers recycle IPv4 addresses from terminated accounts. If the previous tenant sent spam, ran a botnet, or hosted malware, the IP carries that reputation into your hands. Budget providers with instant signup and no identity verification churn through the most abusive tenants, making their IP pools the dirtiest. There are no "fresh" IPv4 addresses left to allocate. Every IP has a history.
Which blacklists do Gmail, Outlook, and Yahoo actually check?
Only Spamhaus. Gmail checks Spamhaus PBL to block direct sends from unauthorized IPs. Microsoft checks Spamhaus ZEN (SBL + XBL + PBL combined). Yahoo has used Spamhaus SBL, XBL, and PBL since 2008. None of them use UCEPROTECT, Barracuda BRBL, or SpamCop for consumer inbox filtering. SORBS shut down permanently on June 5, 2024. If your IP is clean on Spamhaus, it will deliver to consumer inboxes.
How do I check a VPS IP before installing a mail server?
Check Spamhaus at check.spamhaus.org first. If listed on SBL or XBL, request a new IP immediately. If listed on PBL only, that is normal for VPS IPs and removable via self-service. Then run MXToolbox at mxtoolbox.com/blacklists.aspx for a broad scan. Minor blacklist listings without a Spamhaus listing have minimal impact on consumer email delivery.
Can I get a new IP from my VPS provider if mine is blacklisted?
Varies by provider. RackNerd: 1 free change within 72 hours, then $3 each. Hetzner: free (delete and recreate server). Contabo: free via reinstall (destroys data). DigitalOcean and Vultr: snapshot, destroy, recreate. GreenCloud: $2 per change. Always check the replacement IP against Spamhaus before installing your mail server.