How to know if your server IP is blacklisted (and what to do)

When one compromised cPanel account sends spam, the whole server IP can land on blocklists — and every other customer's mail goes to junk.

Early warning signs

• Sudden spike in Exim queue depth
• Customers report "mail works in webmail but not Gmail"
• SPF/DKIM pass but messages still defer with policy blocks

Check blacklists

Reflex polls major DNS blocklists (Spamhaus zen, etc.) for each cPanel connection IP and surfaces results in the Email health dashboard alongside SPF/DKIM/DMARC status.

For a single domain, run the free email health checker first — authentication failures often precede listing.

Response playbook

1. Identify the sending account and suspend outbound mail
2. Flush the spam queue and patch the vulnerable site (contact form, compromised WP plugin)
3. Request delisting from each blocklist with evidence the abuse stopped
4. Tighten DMARC and monitor for repeat offenders

See the blacklist response playbook and DMARC glossary.

Prevent recurrence

Daily email auth checks per account catch missing SPF before reputation damage. cPanel integration for resellers ships fleet monitoring without agents on client servers.