SpamhausのCSSブロックリストに登録されたので解除申請する

投稿日：

maillogに下記ログが出力されてメール送信に失敗したので対応したときの覚書。

Sep 11 07:01:20 hoge01 postfix/smtp[14386]: 070C98E372: to=<info@hoge.jp>, relay=hoge-jp.mail.protection.outlook.com[2a01::...::1]:25, delay=3679, delays=3678/0.01/0.33/0.88, dsn=5.7.1, status=bounced (host hoge-jp.mail.protection.outlook.com[2a01:...::1] said: 550 5.7.1 Service unavailable, Client host [2400:...:135] blocked using Spamhaus. To request removal from this list see https://www.spamhaus.org/query/ip/2400:...:135 AS(1440) [OS1PEPF0000D215.JPNP286.PROD.OUTLOOK.COM 2025-09-10T22:01:20.224Z 08DDF035F67B7600] (in reply to RCPT TO command))

環境： FreeBSD 14.3-RELEASE-p2

上記メールログの意味

  • メールを送信しているサーバーの IPv6アドレス 2400:...:135 が、迷惑メールの送信元として有名なブラックリスト（RBL）である「Spamhaus」に登録された。
  • Spamhausからのブロック解除を申請するには「https://www.spamhaus.org/query/ip/2400:...:135」を参照。


Spamhausとは？

Microsoft 365 のメールサーバー（Exchangeサーバー）が参照しているブラックリストサービス。
参考： Strengthening trust and safety across the internet | Spamhaus
参考： Spamhausの解除申請をするには？ ブラックリスト掲載を防ぐベストプラクティスも解説 - ベアメールブログ


ブロック解除の申請

ブロック解除申請のURLにアクセスする。

CSS Blocklist - Why is this IP address listed?
Your IP address is either exhibiting suspect behavior, is misconfigured, or has a poor sending reputation.

As a result, this IP is listed in the CSS Blocklist (CSS)

Click on More Info to see if you can request a delisting from this blocklist. This will also display any further information we have relating to this listing.

Less Info
Why is 2400:...::/64 listed?
CSS lists IPv6 addresses by (/64). CSS listings are influenced by:

Email showing indications that it is of an unsolicited nature;
Poor email list hygiene;
Sending out bad email due to a compromise, insecure installation or misconfigured server;
Other indicators of low reputation or abuse.
CSS listings are based on a wide range of inputs and are always the result of multiple events and heuristics.

What should be done about it?
According to current agreed upon standards, any given /64 is intended to be one single entity.

CSS and IPv6:
CSS lists /64 subnets (or larger) of IPv6 addresses as dictated by industry standards.
The industry standard for the smallest IPv6 allocation to individual customers, even for home-uses like cable, DSL or wireless is a /64.
Some providers choose to not follow the industry standard, and allocate smaller subnets. As a result, you are sharing the same network segment as other customers, which can include problematic ones.
This non-standard allocation practice can result in IPv6 IPs being listed in CSS because of neighboring IPs that share the same /64 - contrary to industry standard.
NOTE: If your allocation is smaller than /64, we cannot remove it from CSS, and the situation needs to be corrected with the provider prior to requesting removal. For more information about IPv6, IP allocation, and industry standards, please see our FAQ. A spammer can cycle through IPv6 addresses every 5 seconds (or even faster, with custom kernels). Since an IPv6 /64 is twice the size of the entire IPv4 mask, lots of spam can be produced with very minimal effort. Thus, listing the whole /64 is warranted.

Removal from CSS
If the problem on 2400:...::/64 has been addressed, you can start the delisting process.

このメッセージの日本語要約

  • 迷惑メールを送信している疑いがある。
  • サーバーが乗っ取られたり、設定が不適切だったりする。
  • 全体的に送信者としての評価が低い。


解除申請して翌日に確認する。
Lookup | Reputation Checker | Spamhaus

Historical Listing
This IP is not currently listed. Here is the most recent information provided regarding the listing of 2400:...:135

Date Listed: September 10, 2025 18:02:21

Date Removed: September 11, 2025 07:19:06

解除されるまで約12時間掛かった。


ちなみにこのサーバーはSPF／DKIM／DMARCへ対応済み。
他サーバーからの評価（レピュテーション）について調べる。


▼ 関連記事