SpamAssassin rule
RCVD_IN_XBL
Sending IP is on the Spamhaus XBL
+0.724 points
Header test
What RCVD_IN_XBL means
The IP is listed for being infected or hijacked (botnet, open proxy).
The rule's description in SpamAssassin: “Received via a relay in Spamhaus XBL”
How to fix it
Scan the server or network for malware and compromised accounts, then request delisting at spamhaus.org.
Does your email trigger RCVD_IN_XBL?
Send it to a free test address: we run SpamAssassin, check SPF, DKIM and DMARC and show every rule with a fix.
Open the email spam checkerRelated rules
RCVD_IN_BL_SPAMCOP_NETSending IP is on the SpamCop list
RCVD_IN_DNSWL_HISender is on the DNSWL allowlist (high trust)
RCVD_IN_DNSWL_LOWSender is on the DNSWL allowlist
RCVD_IN_DNSWL_MEDSender is on the DNSWL allowlist (medium trust)
RCVD_IN_MSPIKE_BLSending IP has a bad Mailspike reputation
RCVD_IN_PBLSending IP is on the Spamhaus PBL
RCVD_IN_PSBLSending IP is on the PSBL
RCVD_IN_SBLSending IP is on the Spamhaus SBL
RCVD_IN_SBL_CSSSending IP is on the Spamhaus CSS list
Frequently asked questions
What does RCVD_IN_XBL mean?
The IP is listed for being infected or hijacked (botnet, open proxy).
How do I fix RCVD_IN_XBL?
Scan the server or network for malware and compromised accounts, then request delisting at spamhaus.org.
How many points does RCVD_IN_XBL add?
0.724 points in the default SpamAssassin ruleset (network tests on, Bayes off). A message is treated as spam from 5.0 points. Mail servers can change scores locally.